tl;dr: PEBKAC The less glib answer is that while best practices have gotten better, companies aren't necessarily better at following them (your company or your

tl;dr: PEBKAC The less glib answer is that while best practices have gotten better, companies aren't necessarily better at following them (your company or your vendors). Additionally, on average people have not gotten all that smarter (while scammers have become more sophisticated). Its all about defense in depth. Plan for compromise, trade off the costs (nothing is free). At a technical level there are basic things like: separating dev from production, requiring 2FA across the board, strong passwords, certs, separation of privileges, up to date software, secret management, etc that form strong defenses. Another way to approach this is to pose scenarios and understand defenses: * What information could an employee give away that would then lead to a compromise? How do you stop it? Password to a phisher? Check in credentials to github? Wire money to a fake vendor/wrong account? * If X was compromised, what is the impact? What would it take to recover? Where X is: dev box, production box, customer facing service, etc. Two insidious scenarios that happen way too often: * Latest malware distributed via legitimate sites (ad networks, sharepoint, dropbox, etc) -- Hard to prevent beyond up to date systems and content filtering. If paranoid, all browsing through VMs or other forms isolated environments. It won't stop compromise, but it will restrict scope. * BEC -- Attacker studies your company. They impersonate an employee or partner (down to linkedin profiles) and convince someone to wire money. Or worse -- account compromise of a trusted partner. The attacker then uses this partners' account to hijack an email thread or send a 'normal' request like: "Our account has changed, future payments goto account YYYY." Which brings us to vendors. Can a vendors' weak security break your company? Is it a good idea that your Microsoft Office 365 account allows unlimited password attempts (at least MS used to by default)?