* The faulty assumption there is but one problem * Incorrectly-formed causal relationships
Mythology. Some may recall the adventures of the CTO who ran a sweep of an net 10.* in a rather modest machine room somewhere in Maine, resulting in memory exhaustion (arp table) in the router, which resulted in 1918 leakage into public address space. The operational mythology of the ever-so-security-minded-yolks was that the initial and very poorly understood presenting problem was an external act of malice, rather than self-inflicted DoS by the security-yolk itself. I've seen many people struggle to fit what little they know into predefined mythos of what could be happening, rather than starting like Sgt. Schultz, who "knew nothing", at least until he really _knew_ it. Eric