The 7 Top Management Errors that Lead to Computer Security Vulnerabilities

[whatthe]

http://www.sans.org/resources/errors.php

This list is from May 1999. Technology has evolved so much in that time but looking at this list the 'human factor' hasn't changed much. If they polled them again today the list would probably look somewhat similar.

What would you add to a list like this?

[Riot]

What would you add to a list like this?

I think that not having proper procedures for sharing information with other employees.

You can have the best computer security in the world but if someone gets a phone call from some one they don’t know asking for what they think is a harmless piece of information it dose not matter how much security you have on your network.

I would also like to add admins and other people in charge not following their guide lines they make for the building or company for information handling.

[pennconservativ]

I don't think that there are too many people that would argue with their number one.

As far as what I would add, I don't know that I would necessarily add anything, but I would reword number six. I think that waiting until you have a problem to realize that you need security is a HUGE management failure. I know that in my company, security was seen as something that I (as the SysAdmin) did for fun. It wasn't until we got hit with Nimda that they sent me to some training, bought me a bunch of books, and got me a Safari subscription.

[Relyt]

I would add Number 8 as that some of the top dogs are security breaches within themselves. I’m sure many of us know of folks in management positions that have caused some major problems. Here’s one of the most recent I know of: Regardless of all the acceptable use banners flashing during login, we had (he gone now!) an executive plugging his personal laptop into our network to surf/download porn. He said he didn’t think it mattered since it was his own computer. D’ohhhh.

cheers

[Jebo Majku]

Originally posted here by Relyt
I would add Number 8 as that some of the top dogs are security breaches within themselves. I’m sure many of us know of folks in management positions that have caused some major problems. Here’s one of the most recent I know of: Regardless of all the acceptable use banners flashing during login, we had (he gone now!) an executive plugging his personal laptop into our network to surf/download porn. He said he didn’t think it mattered since it was his own computer. D’ohhhh.

cheers

yeah right - you think you got problems? get this thing to run on your network. you will never look at your users the same way ever again.

warning - possible invasion of privacy alert! (kind-a, maybe, the jury is still out - read the guys web site - he makes mention of it)

[Tiger Shark]

I dunno Jebu....

Look at your "mood".. Look at your Sig....

Hard as you try you are still a moron.... Do _yourself_ a favor... Be quiet, read, _do not_ respond, just learn stuff in the time you would waste typing....

Do it please... Save yourself and the rest of us the grief of your "professional" experience.

[Jebo Majku]

[Jebo Majku]

[Riot]

This thread isn't going to get off topic , and Jebo Majku take it from me it really is better to just say nothing.

[Jebo Majku]