How to Run Your Security Program Into the Ground
I enjoy true stories that leaves me feeling "there is no way anyone could be making this up." A case in point is a story in ComputerWorld's Shark Tank about a CIO who has a problem listening to staff about security issues.
The result is Web site defacement, hole-riddled firewalls, and malware infected servers. The organization had security measures in place at one time - take the now non-functioning IPS as an example. Too bad the budget for security didn't fixing the IPS. Seriously, I understand the need to meet business requirements, but confidentiality, integrity and availability are business requirements.
This is a case where the CIO's proposed solution isn't likely to work:
Make the support manager the security officer," reports fish. "This is, of course, the same person who isn't invited to the meetings and whose objections are ignored.
Another example of us being our own worst enemy.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
