Re: And it's based on anecdotes like this...
It would be a heck of a leap to connect access to student records with pwn'ing a researcher's desktop machine. Yet this is what I find so often - you can't have admin rights on your machine because "we need to secure the site and that's the first item in the list" whilst calculating the cost of a breach like this and finding it outweighs the inconvenience and cost to staff of not having admin rights. Whereas this, I would argue, is not an appropriate things to do in all cases. Universities are more than just big schools - they have teaching, but often they also have research, and often other roles such as curators of knowledge and wisdom access points for communities (virtual and physical). The balancing act, I feel, is somewhat disjointed, as if you have two kids on each end of a seesaw, but they're actually two different seesaws. You could be doing yourself a disfavour by being too anal about security instead of being smart and securing that which needs to be secure. Layered and appropriate defence instead of one big castle where once you're inside you can run unchecked.
Biting the hand that feeds IT
