10 Immutable Laws of Security

•  If an attacker can persuade you to run his program on your computer, it is not your computer anymore
   
•  If an attacker can alter the operating system on your computer, it is not your computer anymore
   
•  If an attacker has unrestricted physical access to your computer, it is not your computer anymore
   
•  If you allow an attacker to upload programs to your Web site, it is not your Web site any more
   
•  Weak passwords prevail over strong security
   
•  A computer is only as secure as the administrator is trustworthy
   
•  Encrypted data is only as secure as the decryption key
   
•  Out-of-date antivirus software is only marginally better than no antivirus software at all
   
•  Absolute anonymity is not practical in real life nor on the Web
   
•  Technology is not a panacea

Source : Clinic 2801 // microsoftelearning.com