Security Compliance Quotes

The methods that will most effectively minimize the ability of intruders to compromise information security are comprehensive user training and education. Enacting policies and procedures simply won't suffice. Even with oversight the policies and procedures may not be effective: my access to Motorola, Nokia, ATT, Sun depended upon the willingness of people to bypass policies and procedures that were in place for years before I compromised them successfully.

It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

Software companies should take more responsibility for security holes, especially in browsers and e-mail clients. There are some straightforward things the industry should be doing right now to fix things, and I don't know why they haven't been done yet.

A lot of companies are clueless, because they spend most or all of their security budget on high-tech security like fire walls and biometric authentication - which are important and needed - but then they don't train their people.

US intelligence agencies will only use such data to meet specific security requirements: counterintelligence, counterterrorism, counterproliferation, cybersecurity, force protection for our troops and allies, and combating transnational crime, including sanctions evasion.

What we are seeing now is customers shifting their attention from security products like firewalls and intrusion sensors, to the policies that need to be in place, and the technologies that help them enforce policy compliance.

I'm also the chairman of the board of Symantec, which is the world's largest cybersecurity - software cybersecurity company.

If you accept that security is a process, and if you can eliminate the human interaction or intervention in that process by automating more, that is a good thing.