(1) It is impossible to make an arbitrary system secure against all threats and still be usable, functional, and productive, and (2) all security is relative to a security policy. […] Risk management is a spectrum from none to complete, where zero risk is unreachable.

— Cybersecurity Myths and Misconceptions by Eugene Spafford, Leigh Metcalf, Josiah Dykstra (Page 43)