5 Most-Ignored IT Security Best Practices — InformationWeek5 Most-Ignored IT Security Best Practices – security Blog.
Not too much to quibble with here except for #2, “Train Users in Best Practices”. Why? Why what?, you may ask. Why is this in the top 5 and certainly if it is a top 5 item, why is it #2?
How much training do users need to be safe on the internet? Other studies have shown that high percentages of IT professionals and even IT Security professionals get hacked. Are they not going to be the trainers of the less savvy? If they are vulnerable are they qualified to be trainers?
How many articles, local and national news broadcasts, radio discussions and gazillions of online articles do users have to see to know:
- They should change their password
- They shouldn’t use the same password everywhere
- They shouldn’t open attachments at all or at least not from anyone they don’t know and expect an attachment from
- Clicking links in emails is baaaaad
- etc., etc., blah, blah… I can’t type out anymore I’m nodding off thinking through all the “common-sense” items
It is time for us arguably professional IT folks to quit dumping our problems on our users and give them the tools they need to be safe. Most of these “tools” should actually be invisible to users as the more they have to interact with and learn, the more they will actively work to work around us and defeat our efforts.
Yes, these tools and functions aren’t free and yes, some of them won’t be completely transparent to users and they’ll whine a bit. However, if you keep it to a minimum and the pain items actually result in a better, safer, more enjoyable experience, the whining will die off. Imagine if the whining were only around items such as, “this process is different, I liked the previous one” vs. all the phone calls to the help desk beginning with, “I accidentally clicked this link in my email and now my PC does / doesn’t do…”.
I throw this advice out to enterprise IT folks as well as to the consumer players and to the internet infrastructure and standards groups. If we just used the tools, technologies and inventions that already, exist the internet could be secured. Isn’t anyone else weary of being told, “that’s too hard”, and “you can’t boil the ocean”? Big dreams got us this far and only grabbing for the next big one keeps us going at record speeds.
