Security Best Practices Quotes

Too many companies are reluctant to share technical information about threats with each other, and most open platforms and tools don't see widespread adoption. As a result, lots of us are reinventing the wheel and solving the same problems without realizing that our neighbors have already built great solutions.

Security used to be an inconvenience sometimes, but now it's a necessity all the time.

Security is a process, not a product.

It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

Software companies should take more responsibility for security holes, especially in browsers and e-mail clients. There are some straightforward things the industry should be doing right now to fix things, and I don't know why they haven't been done yet.

Security should not be a black and white thing.

Security isn't just a feature, it's a base, it's a fundamental, right.

Note that I hold the single-author record for total CERT advisories, proving that in my copious youth I knew how to sling code but not how to manage risk.

The secret to strong security: less reliance on secrets.

Don’t damage computer systems you break into (including crashing them); don’t change the information in those systems (except for altering logs to cover your tracks); and share information.