12 Info Sec Principle

A company installs an intrusion detection system, firewall, and incident response plan.

Admin convinces management to buy expensive encryption citing vague threats.

An agency publishes technical specs of its encryption system.

Developers avoid reporting software bugs to avoid attention.

Startup spends ₱3M to protect data worth ₱500k.

Employees fall for phishing simulation offering concert tickets.

Developers skip testing logout functionality.

Encrypted health app crashes, blocking access.

Bank relies on secrecy of method to protect authentication.

Only one person understands backup, who later leaves.