I came to security as a cryptographer, as a mathematician. But I learned over the years of analyzing systems and building systems that that's just not true. Mathematics, while it's very strong, isn't enough.
Security is a chain.
A chain includes the mathematics, includes the protocols, the software, the implementation, the user interface, the people. The security of that chain is only as strong as the weakest link. And cryptography, while an incredibly strong link, says nothing about all those other links, and those other links are how you break systems. It's necessary, but by no means will it give you security. . . . There are lots of examples of problems that cryptography doesn't solve.