Many businesses are still adjusting legacy security policies to embrace the rapid explosion of services purchased from other providers, rather than building inhouse. Chief information security officers (CISOs) and CIOs may long for the simpler times, but now they must assess the impact of the Internet of Things (IoT). What are the new threat surfaces the "things" will introduce to the business environment and what countermeasures could be considered? Can security policies even be enforced, economically, with the available security controls?