Cryptography can be misapplied. It will not matter how strong a random number algorithm is if uses a system clock seed and a hacker can determine the exact time the number was seeded. Key exchanges are often done in insecure ways. Although one type of encryption may be strong enough for a simple use, that does not imply that it is sufficient for another. Encryption should be carefully matched with the cost of the information it is protecting.
Security is determined by the overall design and implementation of a system.
Misunderstanding Complexity Security problems are often extremely subtle, and may span the entire source code or project. For instance, buffer overflow exploits may only work in conjunction with each other. Looking for these holes is both complex and boring. Often they are the result of accidental, subtle information leaks, or applying applications in unforeseen ways. It is often difficult to understand the complexity involved with securing a system, or predict how the system will be used in the future with such rapidly evolving technology.