My favorite "n00b litmus test" is to scan a post for the word "just" - VERY few things in infosec can be boiled down to a "just" and these posts almost always lack substance. Posts that say "obviously" and "it's not hard" are similarly likely to contain little value. 1/n
Infosec is amazingly complex. If the problems were easy to solve, we'd have "just" enabled the evil bit in all TCP communications. Seriously, does anyone think we're sitting on a solution to all the breaches? If so, why?! 2/n
I see some really experienced people fall victim to this too. I think hindsight bias is to blame. Situations may seem obvious after the fact, but intrusions are rarely so straightforward. Even root cause (the root of the root) can be difficult to *really* determine. 3/n
Suppose the root cause is "8 character admin password." Is that really the root cause? Not in 2018 it isn't. The root cause is really more like "the business said increasing password length was most disruptive than risking a breach." The two are VERY different. 4/n
Even then, maybe ask why increasing the password length/complexity was such an issue? It shouldn't be. Is the limitation technical? Procedural? Cognitive? Until you ask (and answer) what's at the root of the issue, it's not going away (and others are still there, hiding) 5/n
One of my favorite test taking tips is "if the answer seems obvious, it probably isn't." The same applies for tacking any sort of hard problem. There isn't always an obvious answer. If you think you've found one, ask "if this is so obvious, why isn't it already a thing?" 6/n
I don't say this to dissuade innovation, but merely to ask for some critical introspection before saying "Eureka - I've got it!" Coming full circle to "just" - there are few problems in this (or any) field that can be reduced to "just" 7/7
