Schneier's keynote at ToorCon

Here is my impressionistic transcript of Bruce Schneier's keynote, "Following the Money, or Why Security has so Little to do with Security" from the ToorCon infosec conference in San Diego.

* We want to get the most security for the least trade-off

* Determine the acceptable risk-level

* Figure out the trade-offs

THE BEST WAY TO DO THIS IS TO MAKE THE PERSON WHO CAN FIX THE PROBLEM ON THE HOOK FOR FIXING THE PROBLEM.

We have no choice but to accept some residual risk. "No terrorism is acceptable" in nonsense: there IS an amount of rat-droppings that are acceptable in your breakfast cereal. Some risk is inherent in everything. We've decided that 40k auto deaths/year is OK. In the end, there's an amt of danger that we are willing to accept.

Link