What if that strong outer layer gets breached? Does this mean the war is over? No. Not even close. Once an attacker gains access to the inside of a network, a whole new process starts. Now they must try gaining access to the most critical and valuable data; Servers, Executives’ data, Cloud Resources, etc.

Things like preventing passwords from being stored in plain text, avoiding the use of old and insecure encryption methods, multifactor authentication, and so forth. Why are these not enabled by default? Well, one reason is that you always exchange security for usability. As one goes up, the other goes down. Lots of vendors tend to default to the side of more usability. In high-security environments, this can be a real problem, especially when the ability to stop a successful attack vector was just sitting there, waiting to be turned on. Like a door, you forgot to lock.