http://www.sans.org/resources/errors.php
This list is from May 1999. Technology has evolved so much in that time but looking at this list the 'human factor' hasn't changed much. If they polled them again today the list would probably look somewhat similar.
What would you add to a list like this?
I think that not having proper procedures for sharing information with other employees.Quote:
What would you add to a list like this?
You can have the best computer security in the world but if someone gets a phone call from some one they don’t know asking for what they think is a harmless piece of information it dose not matter how much security you have on your network.
I would also like to add admins and other people in charge not following their guide lines they make for the building or company for information handling.
I don't think that there are too many people that would argue with their number one.
As far as what I would add, I don't know that I would necessarily add anything, but I would reword number six. I think that waiting until you have a problem to realize that you need security is a HUGE management failure. I know that in my company, security was seen as something that I (as the SysAdmin) did for fun. It wasn't until we got hit with Nimda that they sent me to some training, bought me a bunch of books, and got me a Safari subscription.
I would add Number 8 as that some of the top dogs are security breaches within themselves. I’m sure many of us know of folks in management positions that have caused some major problems. Here’s one of the most recent I know of: Regardless of all the acceptable use banners flashing during login, we had (he gone now!) an executive plugging his personal laptop into our network to surf/download porn. He said he didn’t think it mattered since it was his own computer. D’ohhhh.
cheers
yeah right - you think you got problems? get this thing to run on your network. you will never look at your users the same way ever again.Quote:
Originally posted here by Relyt
I would add Number 8 as that some of the top dogs are security breaches within themselves. I’m sure many of us know of folks in management positions that have caused some major problems. Here’s one of the most recent I know of: Regardless of all the acceptable use banners flashing during login, we had (he gone now!) an executive plugging his personal laptop into our network to surf/download porn. He said he didn’t think it mattered since it was his own computer. D’ohhhh.
cheers
warning - possible invasion of privacy alert! (kind-a, maybe, the jury is still out - read the guys web site - he makes mention of it)
I dunno Jebu....
Look at your "mood".. Look at your Sig....
Hard as you try you are still a moron.... Do _yourself_ a favor... Be quiet, read, _do not_ respond, just learn stuff in the time you would waste typing....
Do it please... Save yourself and the rest of us the grief of your "professional" experience.
:bigsmile:
:bigsmile:
This thread isn't going to get off topic :rolleyes:, and Jebo Majku take it from me it really is better to just say nothing.
:bigsmile:
Jebo Majku
You are being a post whore...posting without really contibuting to the thread....yes and it pisses me off ...cause your wasting my time.
:mad:
And I am sure there are lots of people like me that dont have alot of spare time
I know I can just ignore your posts...but you are interupting a thread I am very interested in...and I have to wade through your bullshit
With all your statements tonight..looks like you are trying to get banned....
You know when I first joined AO...I lurked for about 6 months...and didnt post much.
I learned about the members and which ones actually offered accurate advice...or were obviously well informed...and I learned...and read...and read...and read :rolleyes:
Anyway....if you dont like the "AO LUZERS" then leave...go away
CIAO
MLF
I would add (and this was discussed a bit at the recent ISSA CISO event in San Fran) an incorrect business structure that places corporate security under IT is perhaps the biggest threat to security any corporation can face.
Security should report to a CISO/CSO not CIO/IT director/etc.
cheers,
catch
Hi, can you provide any links for this? I would be very interested to read that.Quote:
Originally posted here by catch
I would add (and this was discussed a bit at the recent ISSA CISO event in San Fran) an incorrect business structure that places corporate security under IT is perhaps the biggest threat to security any corporation can face.
Security should report to a CISO/CSO not CIO/IT director/etc.
cheers,
catch
I don't understand (to the most patient thinking) if why the above quote had been bothering someone so much... Any ideas?Quote:
Assign untrained people to maintain security and provide neither the training nor the time to make it possible to do the job.
Must have touched the guy so much.
Anyway, it's better to try to contribute constructively. You can do it Jebo, right? Besides, training is very useful, make it useful.
Yo!
I think the unwillingness of some managers to learn or follow security basics hurts bads. Many don't want to take the time to learn the basics because either they don't think they'll understand or there is the attitude "that's what we pay you for".
I'm talking very basics like strong, private passwords and some discretion opening attachments. This has a huge trickle down effect because if workers know there manager doesn't buy in they know they probably won't be reprimanded.