When security staffers 'fail up'
Containing the painfully unqualified or essentially overwhelmed
July 21, 2008 12:00 PM ETComputerworld - Think your security staffers are trustworthy? Competent? Knowledgeable? Ask a security professional for horror stories and you might think again.
Here's one from Kevin McDonald, executive vice president at managed services provider Alvaka Networks, a member of the national board of directors of the American Electronics Association and author of several books on cybersecurity. A construction company client of his had a senior IT person who was also in charge of security. Somehow, this head of security convinced the firm's owner that it would be cheaper to store the company's employee databases at his home, where he had fiber-optic lines already installed, rather than store those databases off-site.
You can see this one coming from a mile away: A conflict arose between employee and employer. Before you could say "internal threat," the head of security was sending threatening e-mails to the construction firm's customers, telling them that he had their private information.
The action "fundamentally put this guy out of business," McDonald says, reducing the construction company's contracts by some 70%. It took six months to shut the rogue employee down, given that -- of course -- he was an authorized user. Only when the employee threatened, publicly, online, to use the data in an illicit manner, was the FBI in Los Angeles able to enter the employee's home -- after the employee had already built a site and lain plans to put some hurt on his former employer.
It's a worst-case security scenario of hiring a nut case. Unfortunately, the security sector isn't immune from bozos, incompetents or know-nothings, whether in their midst or passing down decrees from above. Indeed, security pros are less likely to be judged on the merits of their output than are, for example, code jockeys. What gets in the way can be politics, bad luck, misguided C-level execs, out-of-control consultants, lack of communication, isolation from other parts of the business, blind faith in certifications or simply the difficulty of getting rewarded for what doesn't blow up.
And that's just a partial list.
But take heart. Good companies can weather bad apples in security. Herein, an outline of common security weak sisters, along with the tools on how to cut them off at the knees.
Bundled badness
At this moment somewhere in corporate America, security staffers are cursing their C-level execs for foisting on them bundled junk. Here's how it works: Salespeople from the big guys -- be it Symantec, Trend Micro, McAfee or CA -- come in and propose to a C-level executive that, for an entire organization, they'll provide a package that does desktop antivirus, e-mail security, intrusion detection and Web filtering, all for $38 per seat.
security professional for horror stories
Additional Resources



White Papers & Webcasts
Share our Strength
Download Now
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Top 10 Things to Know about Data Protection
Download Now
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...
Ponemon Study: The Business Risk of a Lost Laptop
Download Now
Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.
Airport Insecurity: The Case of Lost Laptops
Download Now
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...
