The unglamorous control that stops most attacks

Most successful attacks on organisations do not involve breaking anything. They involve signing in, with credentials that were guessed, reused, phished or found.

Which means identity is the boundary, not the firewall. Once somebody has a valid account, most of your other controls are irrelevant because everything they do looks legitimate.

Where credentials come from. Reused passwords, where somebody used the same one on a site that was breached, and the attacker simply tried it on your system. Phishing, which is still the most effective technique there is. Weak passwords that are guessed. Credentials left in code repositories. And passwords shared between people, which then belong to everybody who ever worked there.

The reused password problem is the largest. Billions of credentials from past breaches are available, and automated attempts using them against every service are continuous. A staff member using their personal password at work has connected your organisation to every site they have ever registered on.

Which is why multi factor authentication is the single highest value control available. It prevents the large majority of account compromises, including every attack based on a stolen password alone, and it is frequently free with services you already pay for.

And why the classic password advice was wrong. Forced regular changes produce predictable variations, complexity rules produce a password written on a note, and both made things worse while feeling rigorous.