I haven't read antifragile, and its been a while since he's made the book interview rounds. If I recall his point correctly, it's that antifragile systems need

I haven't read antifragile, and its been a while since he's made the book interview rounds. If I recall his point correctly, it's that antifragile systems need to be able to fail, and grow from them. If we design to minimize the impact of any such failures, the system as a whole is considered reliable. The problem with applying this to IT security is that I see no way to lower the impact. With hard drives, we use RAID to build a more resilient system from unreliable components. It seems harder to do that with the concept of customer passwords, credit card numbers and SSNs and still have a system the accountants can use to reliably file earnings reports.