Marcus Ranum: The Six Dumbest Ideas in Computer Security [2005] (old, but still applies)

I disagree with everything besides #1. I think this may actually be too dated to be helpful.