According to common wisdom, there are only two hard things in computer science: cache invalidation, naming things and off-by-one errors.
In similar vein, here’s my list of hard things in software engineering (not in order):
- dealing with people
What makes them hard is that when solving a security/concurrency/people problem, the difference between a good solution and a catastrophically bad one is often subtle. All of these are commonly seen as much more simple than they are.