Network security is not a problem that technology can solve. Security has a technological component, but businesses approach security as they do any other business risk: in terms of risk management. Organizations optimize their activities to minimize their cost * risk product, and understanding those motivations is key to understanding computer security today.

—Bruce Schneier, Crypto-Gram