Bruce Schneier Quotes

Our view is that if the network is involved, then we are there to protect it. Based on that, future developments will revolve around ensuring data, networks and applications are protected.

As cyber threats evolve, we need to evolve as well.

Data leaks are impossible to reverse, so the best strategy is to prevent intruders from having prolonged, unfettered access to the systems in the first place.

Too many public and private entities simply don't take advantage of tools already at their disposal to protect themselves from hackers. No amount of information sharing will help solve that problem.

Security is an endless race - one that you can lead but never decisively win. Yesterday's best defenses cannot fend off the attacks of today or tomorrow.

Every single company knows that there is more that they can do to keep themselves safe from cyber-crime.

If security were all that mattered, computers would never be turned on, let alone hooked into a network with literally millions of potential intruders.

In computer circles, any unencrypted data is known as 'cleartext.'

First, our focus on security is on the infrastructure itself. So it is all about how you protect the network, the device, and the application that is riding on the server.

Most people assume that once security software is installed, they're protected. This isn't the case. It's critical that companies be proactive in thinking about security on a long-term basis.

I've always shied away from online data storage. I don't even use my employers' network drives for anything sensitive. I want to control access myself.

It's as if our electric grid didn't even have fences around it. This is disgraceful what we do, and what we don't do, to protect the Internet.

Security is always going to be a cat and mouse game because there'll be people out there that are hunting for the zero day award, you have people that don't have configuration management, don't have vulnerability management, don't have patch management.

The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards -- and even then I have my doubts.

If we start - premise that the information is mine, and we give the individual's rights, we worry about what happens during a breach. If you try to protect access to it, as opposed to not even making it available, you have less to worry about who will break the wall.

We value integrity of information, we value processes, cyber- security. These are things important to the government.

Encryption would help prevent a lot of cyber attacks.

Technology companies have a front-line responsibility to secure their own networks, products, and platforms.

With security, in the early days, we would just have firewalls and you'd check who could come into the network and who could not.

Cyber security is a dynamic space. The user faces different challenges every year because there are always new applications and data.

More organizations than ever are conducting business online. An expanding digital footprint and increasingly sophisticated cyber attacks have created a growing urgency to secure that data and the resources organizations are deploying.

Because I don't believe that it's really desirable to have security on a computer, I shouldn't be willing to help uphold the security regime.

Information agencies operate in an industry that values data. Restricted access to information is what makes it valuable.

I favor strategies that encourage industry to include some sort of key recovery capability in their systems which would also address user requirements for access.

I keep my stuff updated all the time. Being in the security industry, I keep up to date with securities.