I'd say the first fatal mistake--and I'm basing this on some of the things said on 60 Minutes--was hiring locals for security.
Really? In Syria? Not every Syrian is AQ, but how were they going to be able to tell?
Also, when AQ flags started popping up all around town I'd say the solution wasn't to beef up security, I'd say the solution was to get the hell out of Dodge. At least as far as the ambassador was concerned re: living quarters.