You can't defend. You can't prevent. The only thing you can do is detect and respond.
Interpretation
The quote emphasizes the importance of detection and response over prevention in security.
Bruce Schneier's quote highlights the reality that in the realm of security, it is often impossible to completely prevent all threats. Instead, organizations and individuals must focus on being able to detect potential threats quickly and respond effectively to mitigate any damage, emphasizing a proactive stance in security management rather than a purely defensive one.
In practice
During a cybersecurity seminar, one might say, 'As Bruce Schneier noted, you can't defend; you need to focus on detection and response.'
History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It's always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you'll be glad you did.
The whole notion of passwords is based on an oxymoron. The idea is to have a random string that is easy to remember. Unfortunately, if it's easy to remember, it's something nonrandom like 'Susan.' And if it's random, like 'r7U2*Qnp,' then it's not easy to remember.
This is not the internet the world needs, or the internet its creators envisioned. We need to take it back. And by we, I mean the engineering community.
It is poor civic hygiene to install technologies that could someday facilitate a police state.
Digital files cannot be made uncopyable, any more than water can be made not wet.
I am regularly asked what the average Internet user can do to ensure his security. My first answer is usually 'Nothing; you're screwed'.
I think when you get older, things come along that you know are a test in some way of your ability to stay with it. And when e-mail came along, I was just going to fall in love with it. And I did. I can't believe it now - it's like one of those ex-husbands that you think, 'What was I thinking?'
If we do not learn to eliminate waste and to be more productive and more efficient in the ways we use energy, then we will fall short of this goal [for the Nation to derive 20 percent of all the energy we use from the Sun, by 2000]. But if we use our technological imagination, if we can work together to harness the light of the Sun, the power of the wind, and the strength of rushing streams, then we will succeed.
Most software today is very much like an Egyptian pyramid with millions of bricks piled on top of each other, with no structural integrity, but just done by brute force and thousands of slaves.
A new bubble will replace the old one. A new technology will come along to fix the messes we made with the last one. In a way, that is the story of the settling of the Americas, the supposedly inexhaustible frontier to which Europeans escaped.
We have met the Devil of Information Overload and his impish underlings, the computer virus, the busy signal, the dead link, and the PowerPoint presentation.
Good information architecture makes users less alienated and suppressed by technology. It simultaneously increases human satisfaction and your company's profits. Very few jobs allow you to do both at the same time, so enjoy.
Subscribe for the occasional hand-picked quote. No noise.