John W. Thompson Quotes

I keep my stuff updated all the time. Being in the security industry, I keep up to date with securities.

The guardians of your company's cyber security should be encouraged to network within the industry to swap information on the latest hacker tricks and most effective defenses.

You have to have as many defences in place as you possibly can. But even then of course - and it's important to stress this - you cannot guarantee being able to prevent every attack or every kind of attack.

A lot of companies are clueless, because they spend most or all of their security budget on high-tech security like fire walls and biometric authentication - which are important and needed - but then they don't train their people.

When you put new security measures in place there is a greater time lag than before.

Too many public and private entities simply don't take advantage of tools already at their disposal to protect themselves from hackers. No amount of information sharing will help solve that problem.

Security is an endless race - one that you can lead but never decisively win. Yesterday's best defenses cannot fend off the attacks of today or tomorrow.

The threat landscape continues to expand, while cyber threats are continually becoming more sophisticated. This has convinced organizations to expand their security policies and deploy more security solutions.

We must have the strictest adherence to security procedures to protect against compromise by hostile foreign powers.

As cyber threats evolve, we need to evolve as well.

The question is, really, does the nonexistence of another attack prove that the programs that are in place are working?

I'm also the chairman of the board of Symantec, which is the world's largest cybersecurity - software cybersecurity company.

US intelligence agencies will only use such data to meet specific security requirements: counterintelligence, counterterrorism, counterproliferation, cybersecurity, force protection for our troops and allies, and combating transnational crime, including sanctions evasion.

It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

The methods that will most effectively minimize the ability of intruders to compromise information security are comprehensive user training and education. Enacting policies and procedures simply won't suffice. Even with oversight the policies and procedures may not be effective: my access to Motorola, Nokia, ATT, Sun depended upon the willingness of people to bypass policies and procedures that were in place for years before I compromised them successfully.

What we are seeing now is customers shifting their attention from security products like firewalls and intrusion sensors, to the policies that need to be in place, and the technologies that help them enforce policy compliance.

If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology.

We need to shift the paradigm from reactive technologies to more integrative solutions that deal with the variety and complexity of the threats that are out there today.

I've met some smart people doing security work in the government, and they're starting to reach out to a broader audience, which I think is a good thing.

Over the near term there is clearly the opportunity to work with Microsoft to do to a better job of creating a more secure Windows experience for users around the world.

Since other countries and terrorist organizations are working to secure information that could threaten national security, more funding is provided in the bill to increase counter-intelligence activities.

What good does it do to spend millions to protect ourselves against espionage if our secrets just leak away.

The more urgent the message, the more slowly it moves—but those are the penalties of security.

The safety and security of the nation depends more so than ever before on intelligence.