Ten Immutable Laws Of Security

I found this intersting article from Microsoft while reviewing patches this month.

The Ten Laws

1. If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore.
   
2. If a bad guy can alter the operating system on your computer, it's not your computer anymore.
   
3. If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
   
4. If you allow a bad guy to run active content in your website, it's not your website any more.
   
5. Weak passwords trump strong security.
   
6. A computer is only as secure as the administrator is trustworthy.
   
7. Encrypted data is only as secure as its decryption key.
   
8. An out-of-date antimalware scanner is only marginally better than no scanner at all.
   
9. Absolute anonymity isn't practically achievable, online or offline.
   
10. Technology is not a panacea.
    

http://technet.microsoft.com/en-us/library/hh278941.aspx