I was reading about a recent security failure when I saw the phrase "...a series of missed opportunities...". Made me giggle and say to myself "No Kidding Kojak" except I used Sherlock Holmes and a different word.

Fact is, security failures, and hey, let's face it, process failures, almost never come down to a single cause. "If only we had done one thing right, we wouldn't have had a meltdown." That's not reality. Reality is that these kinds of failures, breaches, hacks, collapses, consist of a combination of factors, every time. Which makes it easy to simply throw up your hands, shout "Yeet!", and start deploying code. Yet, down that path lies the next breach. For example, McDonalds had a breach where a login had a password of '123456' (come on, everyone knows to add '78' to that to make it truly secure <cough> </sarcasm>) combined with that login having elevated privileges in the system (and there were actually several other problems exposed as well). The login was old. The password hadn't been changed for years. Would just updating the password have fixed the problem? No. Additional issues lead to the full breach.

As technologists, we can't look at a single factor, good password policy for example, and say, "We're done." How about the firewall? Any holes there? Do we even have a firewall? Are we following least privilege principals, or is it just easier to make everyone the superuser? Sure does speed up deployments. And hacks. Further, do we have a way to review, test, and validate what we're doing when it comes to security? If not, shouldn't we?

I'm not saying if you do these things you'll never, ever, get hacked (metric tons of hacks come from social engineering, so you have to train your people too). The goal is to do as much as you realistically can, to harden your target. Just as a single bad choice is not what leads to the hack, a single good choice won't prevent it. We have to do a whole lot of work.

Now, I'm off to update my passwords. I'm going to add '9' to make them even more secure.