While the defenses are getting better, so are the attacks. He gave six reasons for this. First, software has bugs, and as the number of lines of code in a program increases, so will the number of coding errors. This equals more problems. Third, as systems and applications become more interconnected, a security flaw in one can flow over and affect the rest of the system.
Complex systems are harder to understand and harder to analyze.
The difficulty of security testing. Take a bank, he said. Currently, electronic security products rely heavily on prevention, and practically not at all on either detection or response. Schneier sees detection and response as integral to tomorrow's security, as well as insurance. The CEO of a company just wants to manage the risk of losing data.