For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
|
|
|
|
July 09, 2001 (Computerworld) -- People regularly lock their houses, demand airbags in their vehicles and install smoke alarms in their homes. But put them in front of a computer, and you'd think the word security was magically erased from their brains. People are more careless with computers than perhaps any other thing of value in their lives. The reason is unclear, but observers agree that end users—and even some IT departments—can be pretty dumb when it comes to protecting computers and their contents.
The following are some notable, less-than-bright errors that people and IT professionals commit when it comes to computer security:
1. The not-so-subtle Post-it Note. Yes, those sticky yellow things can undo the most elaborate security measures. Too lazy to remember their passwords, users place them where they—and everyone else—can see them: stuck to the front of their monitors. Lest you think this is so obvious it's uncommon, Garrett Grainger, vice president of information systems at office supply manufacturer Dixon Ticonderoga Co. in Heathrow, Fla., estimates that of his several hundred end users, 15% to 20% regularly do this.
2. We know better than you. You may think that certain security measures are necessary, but not all end users agree, which leads them to do an end-run around you. "People blithely turn things off they think have a good reason to bypass," notes Frank Clark, network operations center manager at Thaumaturgix Inc., an IT consulting firm in New York. "Antivirus software is an example. They think it slows down their machine."
3. Leaving the machine on, unattended. Dan Bent, CIO at Benefits Systems Inc. in Indianapolis, says he's amazed at the number of users who leave their machines on, without protection, and walk away. Who needs a password?
4. Opening e-mail attachments (remember the Love Bug virus?) from mere acquaintances or even strangers. This one drives IT managers nuts. "Users open all their e-mail attachments before thinking," says Marie Phillips, manager of information security services at Amerisure Mutual Insurance Cos. in Farmington Hills, Mich. "We tell them to be careful about opening notes and attachments from strangers or when they get the same notes from several people, even those they know."
5. Poor password selection. If there's a bugaboo among security experts, it's poorly chosen passwords. Ken Hill, vice president of IT at General Dynamics Corp. in Falls Church, Va., recently attended a demonstration with about 20 of his top engineers and some antihacking experts from NASA. Within 30 minutes, the NASA folks broke 60% of the engineers' passwords. Paul Raines, global head of information risk management at London-based Barclays Capital, recommends that users take a common phrase and use its initials for a password. For example: "I pledge allegiance to the flag" becomes "ipa2tf." "That's a difficult password to break because it's a combination of letters and numbers," says Raines.
6. Loose lips sink ships. Clark says people often talk in public places about things they shouldn't. "They will say at a bar, 'I changed my password and added the number 2,' and someone sitting two stools down hears this. Some things you just shouldn't talk about outside the office environment," says Clark.
7. Laptops have legs. Everyone knows how common it is for laptops to be stolen in public places, but Jay Ehrenreich, senior manager at PricewaterhouseCoopers in New York, says it's surprisingly common for a person to leave his laptop in his office, unsecured and unattended, and in full view of passersby. "These things walk," he warns. Users should place their laptop securely out of sight, such as in a locked desk drawer.
8. Poorly enforced security policies. The best-designed security plans are useless if IT fails to rigorously enforce them. "If these things aren't enforced by the system, then the policy isn't useful," notes Chris Smith, vice president of computer information systems at EasCorp, a Woburn, Mass.-based provider of wholesale financial services to the credit union industry.
9. Failing to consider the staff. "Your greatest [security] threat is from in-house," says Hill. Disgruntled employees and others can cause enormous problems if they're not properly monitored. IT departments should do a good job monitoring incidents and have the forensics capabilities to be able to follow problems to their sources.
10. Being slow to update security information. "One thing we see all the time is that service packs are not kept up-to-date," says Ehrenreich. This creates a window of opportunity for hackers.
- Want to Save Some Money? Automate Password Resets
- Knowldge Quest
- Companies Need Security Pros With More Varied Skills
- Finding Answers
- The Enemy Within
- The Threat of XML
- SOAP, Other Protocols Specify Security for XML
- The Problem With Power
- Top 10 Security Mistakes
- Playing By Europe's Rules
- False Alarm?
- An Ounce of Intrusion Prevention
- Deadly Pursuit
- IDS Products and Prices
- Should You Outsource IDS?
- Who He Is
- Manager Offers Primer On Computer Forensics
- Unlocking Secure Online Commerce
- Too Late For Digital Certificates?
- Giving Users Back Their Privacy
- Feeling Safe With IT Security Deals
- Finjan's Software Bolcks Active Content Threat
- Security Statistics
- The Guardian
- Congress Considers Slew of Bills That Will Affect IT, E-Commerce
- U.S. Legislators Ponder Masses of Bills; Outlook Remains Murky
- Rule Changes May Further Protect Company Security Data
- Getting Started in Computer Forensics
- PKI Carries the Mail for U.S. Postal Service
- Security by Syntax
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Enterprise-Class Security Zone Enterprise Solutions Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone The Data Center Management Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- HP confirms XP SP3 endless reboot snafu, promises patch
- Microsoft pulls Windows Home Server backup feature
- Yahoo tells Icahn that its own board knows best
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecurityThere's plenty of talk about how to behave during a Customs search of your computer and gear, but Jon Espenschied's got tips for securing your data (and privacy) before you reach the border. Click here to read the latest column by Jon Espenschied |
 |
 |
Layered Security Solutions
Although basic network security issues have changed very little over the past decade, the
network security landscape has changed dramatically. Today's IT professionals still have the
primary responsibility of protecting the confidentiality of corporate information, preventing
unauthorized access, and defending the network against attacks. Security experts and analysts agree that a security solution comprised of multiple layers is the best defense against today's increasingly sophisticated attacks.Download this white paper 
|
Universal Threat Management - Because Conventional UTM is Not Enough!
This white paper, written by Mark Bouchard of Missing Link Security Services, examines the challenges confronting today's enterprises with respect to managing threats on a network. It also discusses the need for "Universal Threat Management", which is a security solution approach for all physical locations within an enterprise that require threat protection.Download this white paper |
Selecting the Right Threat Management Solution
This short demo will guide you through key considerations for selecting a solution to manage threats on a network. Learn about the popularity of Unified Threat Management (UTM), and how it fits into an overall security solution. Explore critical elements of a network-wide solution for multisite and large network-size deployments and identify the four key features of a threat management solution.View this demo
|
