Kevin Mitnick Quotes

A lot of companies are clueless, because they spend most or all of their security budget on high-tech security like fire walls and biometric authentication - which are important and needed - but then they don't train their people.

Companies spend millions of dollars on firewalls, encryption, and secure access devices and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems that contain protected information.

Penetrating a company's security often starts with the bad guy obtaining some piece of information that seems so innocent, so everyday and unimportant, that most people in the organization don't see any reason why the item should be protected and restricted.

I won't be satisfied until I've put the entire security industry out of work.

I learned the technology and tradecraft of electronic security in self defense, with a lot of expert help.

A company can spend hundreds of thousands of dollars on firewalls, intrusion detection systems and encryption and other security technologies, but if an attacker can call one trusted person within the company, and that person complies, and if the attacker gets in, then all that money spent on technology is essentially wasted.

When an attacker fails with one person, they often go to another person. The key is to report the attack to other departments. Workers should know to act like they are going along with what the hacker wants and take copious notes so the company will know what the hacker is trying to find.

If you accept that security is a process, and if you can eliminate the human interaction or intervention in that process by automating more, that is a good thing.

What good does it do to spend millions to protect ourselves against espionage if our secrets just leak away.

The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards -- and even then I have my doubts.

Small businesses are the backbone of the American economy and employ almost half of the working population. Yet because of their size, they rarely have access to the same information security resources as large firms.

We must have the strictest adherence to security procedures to protect against compromise by hostile foreign powers.

Accessibility and openness are good politics but bad security.

US intelligence agencies will only use such data to meet specific security requirements: counterintelligence, counterterrorism, counterproliferation, cybersecurity, force protection for our troops and allies, and combating transnational crime, including sanctions evasion.

It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

I think that is a responsibility we all share as Americans. But as State Department employees, we have a special duty to guard ourselves and our sensitive information. Complying with department policies and being alert to potential threats will help protect all of us.

People often represent the weakest link in the security chain and are chronically responsible for the failure of security systems.

There is no secure data center in the world; they have all been broken into. We can help you prepare for it and minimize the damage when it does occur.

'Cyber-security' is one of those hot topics that has launched a thousand seminars and strategy papers without producing much in the way of policy.

If we start - premise that the information is mine, and we give the individual's rights, we worry about what happens during a breach. If you try to protect access to it, as opposed to not even making it available, you have less to worry about who will break the wall.

Too many public and private entities simply don't take advantage of tools already at their disposal to protect themselves from hackers. No amount of information sharing will help solve that problem.

Safety is not just about trying really hard and being really careful. You have to design technology that makes it possible for a computer to be safe.

We value integrity of information, we value processes, cyber- security. These are things important to the government.

For most companies, they don't want to ever talk about security unless it's an absolute emergency and they've had a breach. And I think that's a mistake.

Security is an endless race - one that you can lead but never decisively win. Yesterday's best defenses cannot fend off the attacks of today or tomorrow.