November 4, 2008
I heard this on Dave Ramsey (www.daveramsey.com) yesterday.
The Ten Cannots
You cannot bring about prosperity by discouraging thrift.
You cannot help small men by tearing down big men.
You cannot strengthen the weak by weakening the strong.
You cannot lift the wage earner by pulling down the wage payer.
You cannot help the poor man by destroying the rich.
You cannot keep out of trouble by spending more than your income.
You cannot further the brotherhood of man by inciting class hatred.
You cannot establish security on borrowed money.
You cannot build character and courage by taking away men's initiative and independence.
You cannot help men permanently by doing for them what they could and should do for themselves.
-- Rev. William John Henry Boetcker, 1873
Information Security should be built on these key "Cannots" and I'll add a few of mine own:
You cannot protect all data everywhere by spending on technology alone.
You cannot defend a network from attack with out the understanding and cooperation of your users.
You cannot manage risk by avoiding all risk.
You cannot implement a technical security control without a policy and business rule that directs it.
Each of these "Cannots" identifes a particular equilibrium of processes, and as we look at making changes, hopefully for the better, we will do well to ascertain the side effects.
Posted by Thomas Siu at 12:48 PM
