“It was a sophisticated attack”

Reality: Most breaches described in headlines as a "sophisticated" or "advanced" attack start with an ordinary technique: a phished credential, a social-engineered helpdesk call, a login with no MFA. The sophistication is rarely in the intrusion, it's in the story told about it afterward.

Elevating an opportunistic break-in to a spy-movie threat actor moves attention away from the mundane design failure that let it happen, an outcome that benefits the manufacturer whose product failed.

Discussion prompts

• Recall a breach described as sophisticated. What was the actual first step?
• Which of your product's defaults would have had to change for that first step to fail?
• When your organization explains an incident, whose account of it are you repeating?