What are the two main differences between information vs. conventional (physical) assets. Explain why these differences make information security a considerably different challenge than conventional security?