Bruce Schneier Quotes

It proved once again the theory that no security system is a match for a stupid employee.

Companies spend millions of dollars on firewalls, encryption, and secure access devices and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems that contain protected information.

The important thing about security systems isn’t how they work, it’s how they fail.

The methods that will most effectively minimize the ability of intruders to compromise information security are comprehensive user training and education. Enacting policies and procedures simply won't suffice. Even with oversight the policies and procedures may not be effective: my access to Motorola, Nokia, ATT, Sun depended upon the willingness of people to bypass policies and procedures that were in place for years before I compromised them successfully.

Even if you build the perfect reactor, you're still saddled with a people problem and an equipment problem.

Penetrating a company's security often starts with the bad guy obtaining some piece of information that seems so innocent, so everyday and unimportant, that most people in the organization don't see any reason why the item should be protected and restricted.

A lot of companies are clueless, because they spend most or all of their security budget on high-tech security like fire walls and biometric authentication - which are important and needed - but then they don't train their people.

There is no technology today that cannot be defeated by social engineering.

Perimeter defense may not matter if the enemy is inside the gates.

If the leaks continue, we are strong as our weakest link. And I'll say it a little differently in a pun. We're strong as our weakest leak.

Only amateurs attack machines; professionals target people.

For me to think in terms of employing security seems ostentatious.

Social engineering is using deception, manipulation and influence to convince a human who has access to a computer system to do something, like click on an attachment in an e-mail.

In the astronaut business - the shuttle is a very complicated vehicle; it's the most complicated flying machine ever built. And in the astronaut business, we have a saying, which is, 'There is no problem so bad that you can't make it worse.'

We call the fates of the Titanic and the Concordia - as well as those of the space shuttles Challenger and Columbia - 'accidents.' Foreseeing such undesirable events is what engineers are expected to do. However, design trade-offs leave technological systems open to failings once predicted, but later forgotten.

If I needed to know about a security exploit, I preferred to get the information by accessing the companies' security teams' files, rather than poring over lines of code to find it on my own. It's just more efficient.

Every national security threat that has been accepted has then been inflated.

any system, in which the final decisions are referred to human beings, and in which the source of all authority are human, is doomed to failure because it deifies human beings by designating others than God as lords over men.

The pope is a very... passionate man. He likes to get out with the people, and with that comes a large security risk.

There's no such thing as a foolproof system. That idea fails to take into account the creativity of fools.

A back door is a nonstarter. It means we are all not safe... I don't support a back door for any government, ever.

Every breach you look at occurred because somebody inside did something they weren't supposed to do. Sometimes there's an accomplice, but most of the time, it's innocent.

I taught at the FBI for four decades - how to think outside of the box and deal with social engineering.

Being a CISO is a tough job. I have the end responsibility for the personal information of over a billion people.

It turns out that we can build perfectly secure software, and yet people can still get hurt.