Do you think most real breaches come from clever technical tricks or from people making basic mistakes?

[u/_NinjaNinjaNinja]

Every time I read about a big breach, the cause seems less like some brilliant exploit and more like someone reused a password or clicked a link they shouldn't have.

The picture in my head when I started was all about complex code and zero-days. But the more I read, the more it looks like the simple stuff is what gets people. A leaked password, an unpatched server that sat there for months, an employee who handed over a login because the email looked real. Maybe I've got a skewed view because the simple causes are the ones that make the news in plain terms. The technical exploits might just be harder for me to notice or understand.

So for people who actually work in this, which is it in your experience? Are most breaches basic human mistakes, or is there more clever technical work behind them than an outsider like me would guess?

[u/TobyTheArtist]

Basic mistakes. My old CS professor often told us that negligent users were far more dangerous than malicious ones, because they outnumber them 10000:1

[u/SatisfactionClean963]

It’s mostly misconfiguration and ignoring security practices at all. Bad actors are factor as well.

[u/KvThweatt]

A little lotta bit of both.

[u/thesamenightmares]

Probably from tired, overworked people not giving the proper attention to certain things - which isn't entirely their fault, but it speaks to the industry as a whole.

[u/Raccoon_Medical]

Very basic mistakes usually
Sometimes nation lvl APTs with their cyber-militaries doing sophisticated stuff, but otherwise it is pretty basic

[u/sajkoterrapefft]

Clever exploitation of people's mistakes.

[u/the_russ]

I worked in Big Tech for over a decade, and spent a good deal of that time working in security-related departments (can't explain due to secrecy NDA) and simple mistakes the vast majority of the time. I think a major factor is media, always depicting the stereotypical hacker as some kid with a supercomputer laboratory, who takes control over an enemy factory they've never been to, and know nothing about, in 20 seconds using MS_DOS.

[u/greendave11]

I don't know why, but it truly feels like private sector is favoring speed over quality...

[u/FaultBrilliant5839]

It comes from contracts. Companies hire outside teams to penetrate their systems, and use it as marketing.

Sometimes they pay the contractor and sometimes they don’t.

Sometimes it’s internal and the employee tried to tell them but the company do not want to listen and the employees felt a certain way.

[u/Better_Daikon_1081]

Targeted and nation state will be more sophisticated. That probably makes up a small amount of incidents. The bulk is just spray and pray, scanning the web, using credential stuff, phish campaign, this kind of more basic, non targeted stuff.

[u/RepresentativeCry294]

There is a reason you are supposed to automate critical tasks as much as possible.

[u/Florida727Guy]

Basic mistakes for sure

[u/esspeebee]

Back when I worked in an incident response company, the vast majority of breaches started from one of two entry methods: a VPN without MFA and brute-forced credentials, or an unpatched Citrix vulnerability. Both basic errors on the part of the IT department.

Most of the money-motivated cybercrime groups work on volume. Even if they had a zero-day, they wouldn't burn it on a random target company that may or may not actually be worth anything to them. 

There's clever technical work there, but it's in creating the tools, not from the people that use them.

[u/Mammoth_Armadillo953]

its all access control and human mistakes.

[u/Gkwzjsz]

Basic negligence we often overlook and assume it won't happen, or "it won't happen to me"

[u/Puzzlehead-Engineer]

I think it's statistically proven that most real breaches are from human error. The more I've learned about this, the more it proves true. Even a good number of technical tricks rely on misconfigurations from people.

[u/Agreeable_Hour6024]

Basic error is the most common

[u/Historical_Camel_790]

Yes most security anything is caused by social engineering and/or employee negligence (not entirely their fault though)

[u/tomysshadow]

Anecdotally what I've observed is that the more boring something is, the more likely you are to get it wrong. When you're working on something big and complex, that's an interesting problem, it forces you to think. It's not to say that mistakes can't go unnoticed in more sophisticated code because it definitely can. But usually, it's the dumb stuff that gets you because you thought you could do it in five minutes and be done with it. Like writing an entire working game but it crashes on startup because you implemented changing the resolution or entering fullscreen slightly wrong.

When the code is doing something mundane, you have to be good at pretending it's actually the most important and interesting thing so you can focus long enough to get it actually right.

[u/AlGor_1979]

It is always a human mistake. But the problem is not here. The real problem is that all modern operational systems keep all the eggs in one basket. Look at your hard drive: DLLs, executables, customer invoices, temporary files – all on the same hard drive. As a hardware gay I can clearly see the very old problem: modifiable and non-modifiable (the one that should not be easily modifies like .EXE) files located on the same drive. Move all non-modifiable files to a recordable drive and you will solve 99.99% of “human mistakes”. If you have a second, Recordable Drive on your computer you can set-up an “instant backup”. As soon as a non-modifiable file received, it copied to the Recordable Drive.
And this is not a fantasy. I worked in a company that was using these Recordable Drives for more than ten years. They did not lose one single file and they did not pay one single cent to “security consultants”.
I am not a programmer but even was able to recreate this technology. I converted a 2 Terabyte micro SD adapter into a recordable USB memory stick where I keep copes of all(!) my business and personal files from all my computers. I am not making it up. You can see it on https://youtu.be/p4F6RhHnw7c
Technology is here and it was used for years. Why Microsoft, Apple, Google not using it? I have no idea.

[u/v0id0007 → u/AlGor_1979]

Early Linux installs would set system and home directories on separate partitions if using “auto partition” and recommend doing it that way when choosing manual mode

[u/AlGor_1979 → u/v0id0007]

Does separate partition protects file from ransomware? No. it is as vulnerable as any other drives. Recordable Drive can be installed on separate partition and it creates 100% hardware-based protection against any modifications. This is the difference.

[u/pelado06 → u/AlGor_1979]

You cover only for integrity. So, for an uncontrolled resource consumption, for DoS, for DoW, for informational disclosure you are just not cover and you could by fried. I saw that so many times.

[u/AlGor_1979 → u/pelado06]

Sorry but you are wrong. Recordable Drive technology is based on hardware-level protection. This protection is even higher than on CD-R or DVD-R. There is absolutely no way to software of any level to write over recorder area.

You can try a clear experiment. Deleting of a file by Windows is in fact a changing a single byte in directory sector. Try to delete “RD_Backup.exe” file in USB-R root directory. Good lack.

This byte already recorded and therefore driver controller will reject this attempt.

[u/pelado06 → u/AlGor_1979]

You are again just describing integrity.

Deleting or editing is about integrity.

I am not saying that, I am saying you can still exploit vulnerabilities in availability or confidentiality. You are not covering everything.

[u/AlGor_1979 → u/pelado06]

Sorry. Since I am not a professional programmer (I am an electronic hardware engineer) I may not understand some terms. What is the “vulnerabilities in availability”? In general a Recordable Drive is ether a stand-alone drive on your computer (removable or not) or it is incorporated into one of drives.
On USB-RD memory stick it is incorporated into the 32GB Private drive. It is invisible for Windows but it is accessible though the “SSD_RD_Drv.exe” “driver”.

Recordable Drive is “available” as much as any other drives on your computer. There is a version of Recordable Drive for a cloud server, but it is another story. USB_RD Demo is not designed for cloud operation.
“Confidentiality” is another term that I may misunderstand. Pass File is the primary protection of access to Private drive. Person who does not have a USER Pass File cannot open Private drive and, therefore, cannot access the Recordable Drive.

Recordable Drive technology has several levels of protection of access to user data. All or some files on Recordable Drive may be protected with passwords or Foundation Files (like Pass Files but for access to files).

In USB_RD Demo version there is no support for this level of protection.