and the most significant cock-ups are ...

... from management. Who don't understand the effects their decisions will have, fail to communicate all the relevant information to the design teams, put pressure on meeting delivery targets rather than quality targets and only have an attention-span long enough for sound-bite conclusions.

Of course, since they're not the people pressing the buttons, none of their mistakes ever make it to the light of day. All that happens with poorly managed companies is that their security gets worse and worse. They implement less and less efficient policies in a series of ill-thought out panic measures, becoming more and more restrictive and slower to innovate: given all the layers of approvals, decision making, buy-ins, CYA-ing and shared responsibility until they are totally unable to compete.

uh...

Presumably this survey was done by someone that's never worked in IT.

I'm not disagreeing with it, it's just that its so blindingly obvious that I wouldn't have thought anybody in the industry* would have had any other opinion of the users.

* Excluding incompetent management that have never done anything other than "management" and so don't know the stark realities of life on the ground.

Permeable By Design

Service Oriented Architectures (mash-ups by any other name) often leave huge holes that are exploited unintentionally by users. Because the services and orchestrators are written to be as context-free and reuseable as possible; they can often be called by naive client programs that don't realize the exposure that results. For example, in a hospital system a client that calls an Admission Discharge and Transfer module to tell Housekeeping and Maintenance which rooms to clean may give unintentional access to Admission Reason, preliminary diagnosis, AIDS. Which maybe you didn't want the janitor knowing?

@Peter2

What you said. Thanks for typing it for me.

@Gannon (J) Dick

What about those who are both idiots and thieves - so somewhere between 100% and 200%.

As it happens I'm in the POC stage of a DJP project at the moment so it isn't exactly news.

largely money, and management incompetence

in the company i work for, whose applications I develop and support, user access rights are managed by a series of flags on people's user profile. It's pretty accurate and secure, and lets access be pretty well changed and defined by the business areas without IT intervention.

However, if you want to add a new flag to a profile, several different areas of the company have to coordinate and create it for us to check against. As this costs money, the managment who have sponsored the change usually rights it off as a bad idea and refuses to get the new flags added, leaving us to find some other way to restrict access. Usually only location is even vaguely suitable, as job roles aren't defined well enough to map onto functionality, which opens up features to many more people than should have access to them. Not in the least of which, we recently found out some idiot gave a load of people access to update their location details.

Massive security lapses, almost as a matter of course, purely so a manager can save a few thousand pounds on their project budget and cut their development/testing period down by a few weeks.

I've got a free solution too.

Brief your staff on security procedures and get them to understand the risks and penalties.

You can't expect individuals to find out for themselves, have you ever tried reading the DPA, RIPA, FOIA, and OSA, or the GPG's.

Re: uh...

>> Presumably this survey was done by someone that's never worked in IT.

>>

>> I'm not disagreeing with it, it's just that its so blindingly obvious that I wouldn't have thought

>> anybody in the industry* would have had any other opinion of the users.

It isn't about what you know it is about what you can prove. At least now when you come across an idiot manager who can't see the blindingly obvious, at least you can beat them over the head with the survey.

@ AC, 09;15

>"It isn't about what you know it is about what you can prove. At least now when you come across an idiot manager who can't see the blindingly obvious, at least you can beat them over the head with the survey."

If your dealing with an incompetent manager who can't see the blindly obvious from evidence and experience from within their own department why do you think they will accept the results of a survey from outside the department?

Hanlon's Razor again

For those who have forgotten the exact text of this puissant rule, which explains so much about human history and affairs:

"Never attribute to malice that which can be adequately explained by stupidity".

As stupidity is far and away the commonest element in the universe (leaving hydrogen in a brave but totally outclassed second place), it is even more frequently encountered than malice.

What happens is...

When IT people who think they know what security is spend time firefighting security problems

Properly experienced Information security professionals take a "comprehensive risk management-based approach to information security" .

When IT management try to make security decisions that's when things really screw-up.

@Peter 2 12:22 GMT

Unfortunately, yes.

Most (if not all) managers like fancy external reports so that they can have something shiny to show their own bosses. (Internal reports are also much detailed and show up too much dirt to be shown to higher-ups.) A fancy *IDC* report will persuade the stupid fuckers even though it doesn't actually say anything at all.

David

"conventional wisdom"?

"conventional wisdom that malicious insiders are the greatest single threat to an organisation."

That would be the "conventional wisdom" of anti-intrusion vendors then. And maybe this of the clueless managers dumb enough to listen to them. Everyone else knows very well that the only significant threat comes from legit users making a small mistake, then breaking their whole system trying to fix it "headless duck" style*, and then get the self-dubbed "wizz" in the next cubicle to bring half the department down trying to fix their computer.

The first step is usually some utterly minor change in some unimportant display setting, but the subsequent "headless duck" syndrome can break things pretty deep in the system, and the last "self-dubbed wizz" step usually spread the FUD. that's you end up with half a department whinning at your door for what was initially a change in Word's display of non-printable characters...

No-one needs an intruder when they have users.

Of course in some high-profile targets the intrusion risk is real, but that would be what, one millionth of the cases?

* hit every single button and change every option in a frantic manner