Twelve mistakes security managers make

Computerworld - There's a quote by 19th century American theologian Tyron Edwards that goes, "Some of the best lessons we ever learn we learn from our mistakes and failures. The error of the past is the wisdom and success of the future."
Mistakes are an unfortunate fact of life, and when it comes to making them, the personnel in charge of IT security are certainly not exempt. With the help of security consultant Ken M. Shaurette of MPC Solutions, I've collected the following dozen common and not-so-common mistakes and misconceptions made by organizations when it comes to the security of their networks.

1. Misconfiguring system security (firewall, antivirus and intrusion-detection/prevention systems).


2. Trying to fix all of an organization's security problems with a purely technical approach, believing in a technological solution for the foibles of human nature.


3. Allowing and even urging users to chose difficult-to-guess passwords, assuming that personnel can't become familiar with good practices and regularly change passwords.


4. Not patching and, more importantly, not having a patch management architecture that goes beyond just applying the latest patches.


5. Trusting that every security consulting firm is the same and can deliver the same quality.


6. Believing that applying the minimum security requirements to comply with security regulations is enough.


7. Not creating a security management program and simply buying the latest and greatest "cool" vendor solution.


8. Not having an information security operation plan.


9. Believing that users can't be taught to improve their security habits and that it therefore doesn't pay to create a security awareness program.


10. Assuming that because antivirus software is installed and a personal firewall is running, the organization is secure


11. Not maintaining the operating system (such as patching Windows NT, 98 or XP)


12. Trusting in human nature (that updates to personal account information will be provided for free, that they'll send over the promised winning millions, etc.)