Anyone can design a security system so clever that they themselves cannot think of a way to break it.
Schneier's law is a warning about self-assessment: the designer cannot test their own system, since the same mind that missed the flaw is doing the looking. It is the case for public cryptanalysis.
In practice
- An engineer who wrote a login system cannot find its flaw in a fortnight, and a stranger finds it in an afternoon.
- A team that reviews its own architecture finds the problems it was already looking for, which is the case for external review rather than for more diligence.