Why does this keep happening?
Sep 29th, 2022 by Jesper Kråkhede
After my last post about the phishing campaign this summer, a manager asked me a fair question: We have known about this for years, so why do incidents keep happening?
I have thought about it a lot. Here are the reasons I see most often.
It is easier to buy a product than to change a habit. Companies invest in new tools, but the admins still log on everywhere, the old VPN still has a password-only login and the backups are still reachable.
Security improvements compete with the business. Every hour spent on hardening is an hour not spent on new features, and the features always seem more urgent until the day of the incident.
The basics are boring. Nobody gets promoted for patching on time or cleaning up admin accounts. But that is where most attacks succeed.
And attackers adapt. When we add a second factor, they phish the codes. When we block macros, they move to other file types. It is a continuous race, and many organisations treat security as a project with an end date.
So what should management do? Treat security as an ongoing capability, not a project. Make the basics a measured, reported priority. And accept that some changes will make life a little harder for the people with the most access.
We know what to do. The hard part is actually doing it.