It's all been social engineering. Are you saying the software developers should have programmed all the humans in these organizations better?
- "cybersecurity industry"
- "sloppy software development"
- "lazy pointy haired boss"
Combine the three, and you end up with breaches like these, although I agree that "sloppy software development" is probably the least likely source of these issues. Thinking that security is just checklists that have to be checked (thinking done by party #1 and party #3) probably carries most of the blame here.
They should have used login mechanism that didn't failed so spectacularly as passwords. Anything that forces server to prove its identity to client, should be a good start.
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-...
Ah, MFA because bolting more passwords(things user knows and by knowing is able to prove his identity) on top of first one is a great idea. I'm sure no bad actor will try to get this information too.
MFA might or might not authenticate server. And relaying on user action for security is asking for problems. Does user is a security expert to be able to choose appropriate action? Because sometimes even security experts get phished.
I'm thinking about something simple, that have minimal user interactivity. Something like WireGuard, but not with random keys in plain text. There are ways to prove identity/exchange keys without directly using private keys.
Something like tpm/yubikey.
It is about building a level of trust and psychological safety between software developers and their managers. This way, blameless postmortems can be done in the event of an incident without finger-pointing.