QOTD - Spafford on Infosec Training

The approach that’s currently been taken is sort of the equivalent of telling employees, ‘when you come to work, don’t open any square blue boxes.’ But then someone sends in square red boxes, and they all get taken.

-- Eugene Spafford (Spaf), Executive Director CERIAS & Professor at Purdue University

Src: Could more policies help curb cyber attacks on federal agencies? -- Federal Computer Week