Alex Stamos Quotes

It is strange how little harm bad codes do.

If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology.

I don't expect an overnight change of all desktops to what the US Military used to call B3 level security. And even that would not stop users from shooting themselves into the foot.

If you are a big company, a big website, and lots of users come to your website, you will have attacks, and you have to deal with that. It just cannot be a reason to take actions to exit certain markets.

Even if you build the perfect reactor, you're still saddled with a people problem and an equipment problem.

We can't simply blame the engineers when things go wrong because, no matter how well they plan, things don't always go according to plan.

I keep my stuff updated all the time. Being in the security industry, I keep up to date with securities.

Most people assume that once security software is installed, they're protected. This isn't the case. It's critical that companies be proactive in thinking about security on a long-term basis.

Well, the security business has been growing. I think security is one of those areas where it's to some degree not linear but maybe exponential growth.

Companies spend millions of dollars on firewalls, encryption, and secure access devices and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems that contain protected information.

I won't be satisfied until I've put the entire security industry out of work.

While there have been terrific advances in the state of technology around heuristics, behavior blocking, and things like that, technology is only a part of the approach to solving the problem with the more important aspect involving putting the right process in place.

It was immediately clear to me that security was a cross-cutting issue, so rather than dividing the space up in parallel with each of the other areas, I wanted security cut across the areas in addition to having its own content.

I learned the technology and tradecraft of electronic security in self defense, with a lot of expert help.

There is no such thing as perfect security, only varying levels of insecurity.

It is impossible to work in information technology without also engaging in social engineering.

It's simply unrealistic to depend on secrecy for security in computer software. You may be able to keep the exact workings of the program out of general circulation, but can you prevent the code from being reverse-engineered by serious opponents? Probably not. The secret to strong security: less reliance on secrets.

For four years, I listened to stories of intelligence failures, and it wasn't due to incompetence of anyone in the system, but that the system is so arcane.

Personally, I tend to be more interested in security and performance-related issues than other things.

What we are seeing now is customers shifting their attention from security products like firewalls and intrusion sensors, to the policies that need to be in place, and the technologies that help them enforce policy compliance.

You have to have as many defences in place as you possibly can. But even then of course - and it's important to stress this - you cannot guarantee being able to prevent every attack or every kind of attack.

A lot of companies are clueless, because they spend most or all of their security budget on high-tech security like fire walls and biometric authentication - which are important and needed - but then they don't train their people.

If you accept that security is a process, and if you can eliminate the human interaction or intervention in that process by automating more, that is a good thing.

Our security strategies have not yet caught up with the risks we are facing. The globalization that has swept away the barriers to the movement of goods, ideas and people has also swept with it barriers that confined and localized security threats.

The safety and security of the nation depends more so than ever before on intelligence.