Surveillance of power is one of the most important ways to ensure that power does not abuse its status. But, of course, power does not like to be watched.

The very definition of news is something that hardly ever happens. If an incident is in the news, we shouldn't worry about it. It's when something is so common that its no longer news - car crashes, domestic violence - that we should worry.

History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It's always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you'll be glad you did.

I tell people: if it's in the news, don't worry about it, because by definition, news is something that almost never happens.

The mantra of any good security engineer is: "Security is a not a product, but a process." It's more than designing strong cryptography into a system; it's designing the entire system such that all security measures, including cryptography, work together.

If the FBI parks a van bristling with cameras outside your house, you are justified in closing your blinds.

If you ask amateurs to act as front-line security personnel, you shouldn't be surprised when you get amateur security.