"The efficacy of security is determined more by what is done wrong than by what is done right. (Because the bad guys typically attack deliberately and intelligently, not randomly.)"