As I've said before - it's true, breaches will always happen.
Having worked in tech, and even in the internet hosting space for a time, let me tell you - once you scale up, keeping things locked down is very difficult. We tend to think of say, Disney in terms of being a island, and owning and storing all their data, but it's not as simple as that. Think about how many other systems Disney have to work with. From banks, to suppliers, to manufacturing, to international. There are literally hundreds of thousands of dependencies.
Also, data isn't usually kept in a single database. It's scaled across the globe. From subsidiaries to marketing teams, third-party vendors and onward.
The thing to remember, once you have that in mind, is the problems can occur at the point of change. Any time there's an integration, there is the potential for problems. Keeping on top of that for someone like Disney (who I pick only because they're a multinational) is an impossible task.
Not to make an excuse for businesses. But when looking at security, most of all, you have to think of each employee as a risk factor. One clicked link. One exchange of information.
Let me tell you about a major bank in the UK. I worked on a project that would see a migration of servers from one data center to another. To ensure that service would always be maintained, we had to document every server they had, what software it was running, and what data was shared, and calls made between all systems.
On the face it, no problem, but let me tell you, that took a lot of time. But that's not my point - my point was, I was crunching a lot of data at the time, writing scripts to interrogate systems etc. On my laptop, I had all this information - a complete map of the data center. And that laptop went into my bag, and commuted home with me on the train every single day. At the weekend it was at my home. Think about that. If someone had stolen that laptop, they'd of had a clear map of what to target.
Meaning, you have to best people working at security, but one individual worker can destroy things. Worrying about these things is why security people get paid the big bucks.
