https://www.jerrygamblin.com/2014/05/09/the-most-difficult-question-in-security/