Answers are grounded in this paper and cite their sources.
In the author's years of experience in the security industry, he has come across one recurring and universal principle: people make security much more complicated than it really is. Yes, systems are complex; and yes, securing and managing those systems can present real challenges. Yet it is by simplifying security, by getting to its underlying principles, and by applying these to the systems one is trying to protect, that one can really begin to build effective security.
No takes yet. Share an insight, caveat, or question.
Daniel Mouly (2002) studied this question.
Synapse has enriched 10 related papers. Consider them for comparative context: