Reply to Message

RE: IT security defenses misdirected

mike@... 16th Sep 2009

I am an IT Director for a 6000-member trade association, and the response from my leadership is this, when I attempt to promote training and sensible 'net behavior: "I don't have to know how to build a watch, in order to tell the time".

The "non-tech" side of business, today, IMHO, is filled with ignorance, illiteracy, sense of "entitlement", and a pervasive attitude of free-play abandon, with little or no consideration of security as an issue; "There are geeks in the basement to fix this stuff, if I screw it up. Not my job to know anything about the tools of my trade".

I often use the analogy of a carpenter showing up to build a house, and having no clue how to apply a level, or which end of the hammer should meet the nail.

How do we fix it? Education, I think... but then, that's a whole 'nother area of abject failure in America, these days...

I read the Exec Summary of the report behind this article, and not one item of the information was a surprise or "eye-opener" to me; welcome to my world. I have walked into the home offices of folks originating loans for the largest purchases of peoples' lives, their houses, and found their entire business housed on cheap computers with NO security whatsoever, NO backups, and NO firewall, with all appliances still carrying the default passwords existent "out of the box", and a hard disk stuffed with the personal identities of hundreds of clients, everything needed to approve financing of a half-million-dollar loan.

There are some really basic changes needed, and, at least in America, I think we're going to have an easier time "training" the appliances than the users. AI and adaptive security built in, with NO available circumvention, IMHO, will be the eventual answer. We need systems and interfaces that just won't connect, unless and until the connection is secured properly, and the interfaces themselves able to perform the task.