Law 7: You are the Weakest Link

Law 6 states that the security of a system is no stronger than the security of its weakest link. Human beings are often part of an overall system. They may operate the system. They may feed information into the system. Unfortunately, in many of these systems, humans are the weakest link. The primary threat is a social engineer inducing a person to perform an action that will compromise the security or will leak valuable information. The second threat is users making wrong security decisions or not applying security policies and procedures.