Why is "absolute security" considered impossible — and what does that imply for security work?

Perfect security is neither achievable nor affordable, so security is always a risk/cost trade-off, never a finished state.

* Protection cost climbs toward infinity as residual risk nears zero — so security settles in a cost-optimum band, never at perfect. *

"Security" (Sicherheit) is defined as a state of being protected from danger or harm — but in practice you can always imagine one more attack, one more failure mode. Defending against every conceivable threat would cost infinitely more than the assets are worth.

The consequence: security decisions are economic. You spend protection effort up to (and not beyond) the value of what you're protecting and the risk it faces. This is why risk management, not "lock everything down," is the core discipline.

Tip: A useful mantra — "Security is a process, not a product." (Bruce Schneier). There's no box you can buy that makes you "secure."

Go deeper:

• Risk management (Wikipedia) — residual risk, risk acceptance and the cost-benefit trade-off of controls — the economics behind no absolute security.
• Schneier — Security Is a Process, Not a Product — the source of the card's mantra; argues perfect security is unattainable and must be managed as ongoing risk.