Security is a process, not a product.
Bruce Schneier, Secrets and Lies (2000)
Worth remembering every time a vendor at the night market promises that one gadget will make you safe.
Security people like to say that the weakest link is always human, but that framing lets a lot of badly designed systems off the hook. When a login screen trains people to click through warnings, when a password policy guarantees sticky notes on monitors, the failure started in a design meeting long before anyone made a mistake at a keyboard. The best defenders we interviewed spend less time lecturing users and more time removing traps. They shorten the path to doing the right thing, they log everything that matters, and they assume that anything exposed to the network will be probed within hours.
Finally someone explains this without the hype.
I remember that place. Spent far too many coins there.