I jotted this down from a speaker at a security conference last year: "My nightmare scenario is that I don't know my nightmare scenario. We can obsess about al

I jotted this down from a speaker at a security conference last year: "My nightmare scenario is that I don't know my nightmare scenario. We can obsess about all the extreme things that could happen; but the truth is when, or if, it does happen the chance of it being one of them is tiny. In fact we probably haven't thought of the very worst sort of scenarios; those tiny little things that someone suddenly figures out they can exploit and turn against us. We cannot predict or offset these scenarios. All we can, all we should, do is make security relevant and robust - and then be ready to meet threats quickly when they occur." (pretty much what Schneier says too; but I thought worth sharing)