I'm a security-concious guy, but I have screwed up before. Here are my security failures over time that I know about:
1994: I downloaded and executed a program from the Internet. The program spun through the Windows 3.11-based system, overwriting all files. This resulted in significant data loss.
Root cause: User trusted untrustworthy software. User failed to back up system.
2001: Fell victim to an SSH exploit on my Linux-based router machine. The machine was compromised by a remote attacker and used to send spam. The machine needed to be wiped and reloaded.
Root cause: Zero-day exploit vulnerability, and/or failure to keep on top of security patches.
2006: I gave administrative rights to my brother's au pair's Windows XP-based PC, under pressure from the au-pair who wanted to install software. The machine was quickly overwhelmed by malware despite anti-virus practices. The machine was kept in service after significant cleanup.
Root cause: The platform assumed users would need powerful privileges; administrator inappropriately complied.
2008: My account at a popular Internet Service, Twitter, was compromised and misused.
Root cause: I followed poor password management practices: I re-used an identical username/password pair with multiple service providers for accounts "I didn't care about".
2008: Unprivileged Mac OS X user account was compromised remotely over SSH via brute force, due to simple username and matching simple password.
Root cause: Administrator enabled remote SSH access but failed to restrict ssh access to specific accounts.
2014: Wireless access point unsecured, resulting in open network access over-the-air.
Root cause: Administrator created a second wireless SSID without properly securing it.
1994: I downloaded and executed a program from the Internet. The program spun through the Windows 3.11-based system, overwriting all files. This resulted in significant data loss.
Root cause: User trusted untrustworthy software. User failed to back up system.
2001: Fell victim to an SSH exploit on my Linux-based router machine. The machine was compromised by a remote attacker and used to send spam. The machine needed to be wiped and reloaded.
Root cause: Zero-day exploit vulnerability, and/or failure to keep on top of security patches.
2006: I gave administrative rights to my brother's au pair's Windows XP-based PC, under pressure from the au-pair who wanted to install software. The machine was quickly overwhelmed by malware despite anti-virus practices. The machine was kept in service after significant cleanup.
Root cause: The platform assumed users would need powerful privileges; administrator inappropriately complied.
2008: My account at a popular Internet Service, Twitter, was compromised and misused.
Root cause: I followed poor password management practices: I re-used an identical username/password pair with multiple service providers for accounts "I didn't care about".
Root cause: Administrator enabled remote SSH access but failed to restrict ssh access to specific accounts.
2014: Wireless access point unsecured, resulting in open network access over-the-air.
Root cause: Administrator created a second wireless SSID without properly securing it.