I like the part about "hard work that very few people have the courage and patience to undertake".  I have worked with a lot of bright people.  Most if not all avoid playing out the full implementation of a secure deployment.  Do they lack courage or patience?  Why?  I still don't know many developers that know much about their platform.  My context is Windows.  I always feel like I have more to learn about platform but I have yet to work with a dev that gets it more than I do.  Am I alone? 

Quotes from Interview with Marcus Ranum

It's not a technology problem, it's a management problem. There are plenty of tools that can be used to control inter-host trust, but they are generally not used because they're "too hard" or "inconvenient" or whatever.

In order to build really secure systems you need to understand the trust relationships between your systems and then build your systems to enhance and support your mission based on those trust relationships. But that's hard work that very few people have the courage and patience to undertake. So instead, they want to just throw technology at the problem - which won't work - because there is no amount of technology that can effectively build your trust relationships for you if you don't understand them yourself. d