>Problem is, though, it only takes one incompetent person - or even one person making a mistake one time - to open the door for a massive breach. In the absenc

>Problem is, though, it only takes one incompetent person - or even one person making a mistake one time - to open the door for a massive breach. In the absence of effective governance and process, sure. But half the point of them is to ensure the single-actor miscarriages get caught and handled. The real problem today is that the maturity of an organization's governance/process is not directly linked to the sensitivity of the data being protected. Instead it's linked to the size and age of the corporation, and the amount of resources (people, money) available to expend on them. For systems of this kind of scale, for organizations of this kind of size, handling data of this level of sensitivity, you'd expect a huge bank of governance and process designed specifically to guard against single-actor breaches. Things like active automated monitoring for change to the network and systems, full change control/approvals process, system certification, risk analysis, penetration testing. These things are hard to implement, take time, and are a significant investment that lacks easily measurable benefits. It doesn't help that this stuff is seen as 'not sexy', either.