Bruce Schneier’s latest newsletter discusses the proper way to think about computer security. His fundamental point is that it’s all about risk management, and not threat avoidance.