Instead, they exploit misconfigurations-for example, permissions that were lowered during troubleshooting but never reset, an account that was created for an employee who is now gone, or a direct Internet connection that someone set up without approval. If your procedures are sloppy, it can be difficult to keep track of these details. The result will be more holes for the attacker to exploit. Therefore, having specific, documented procedures is an absolute necessity. The difficulty of defending a network is directly proportional to its complexity.
More complex networks are more difficult to administer, but it goes beyond just administering it.
The crucial point here is the architecture itself. Few and well-controlled. Few and well-controlled. The point here is that you cannot defend a network you do not understand. Inevitably, the security of any useful network will be less than perfect.