State laws and the FTC require companies to implement “reasonable security,” but definitions remain frustratingly vague. FTI ...