security practices

Common security mistakes are failures of assumption, not of skill — four beliefs that keep breaking

Incidents come from a small set of recurring shapes, and the shapes are clearer sorted by belief than by technology. Four of them: defaults must be safe (nothing was configured), unused things must be harmless (nothing was closed), we would notice (nothing is observable), and validated input must be safe (too much was delegated to the input). None of these needs deep technical knowledge to fix — they need a habit of checking. Here is what to look at for each.