Slashdot Mirror
Senior Managers Are the Worst Information Security Offenders
An anonymous reader writes "As companies look for solutions to protect the integrity of their networks, data centers, and computer systems, an unexpected threat is lurking under the surface — senior management. According to a new survey, 87% of senior managers frequently or occasionally send work materials to a personal email or cloud account to work remotely, putting that information at a much higher risk of being breached. 58% of senior management reported having accidentally sent the wrong person sensitive information (PDF), compared to just 25% of workers overall."
This is supposed to be some great revelation?
They're also the ones who can get security policy overridden so that something can be easy for them. Regardless of the problems.
Who would have thought that immunity from consequences would lead to carelessness?
It all boils down to "who is watching the watcher".
58% of senior management reported having accidentally sent the wrong person sensitive information (PDF), compared to just 25% of workers overall."
Statistics like this are meaningless unless you know how often senior management is sending out information that requires filtering out sensitive information versus general workers. I would expect a CEO to send out more info than the mail clerk and hence a higher chance of sending out sensitive info.
I do not think it means what you think it means.
Senior managers *should* exchange a lot of communication with a lot of people. That creates more opportunities for a mistake. A rational policy would be for the people who most commonly transfer important information to have the best security tools and training.
But nah, let's not educate the executives on how to safely handle critical data, because they should know without being told and it feels so good to laugh at them when they make a mistake.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
Senior management frequently consider themselves exempt from just about all company policies which apply to the lower ranks, it shouldn't be too surprising to find that IT security policy is among the ones they feel are below them.
Work is expected to get done over a weekend so I take it home.
Need anything else be said?
The Daddy casts sleep on the Baby. The Baby resists!
"I am the Senior Vice-Neutron for Intracorporation Multinational Reassignment! You must open port 23 at once so I can check my stocks!" who hasn't heard something like that?
if this is supposed to be a new economy, how come they still want my old fashioned money?
I have to deal with this from several Exec VP's. They just do not understand and refuse to listen. Thankfully I have a nice long paper trail protecting my ass.
"In other news, some news that isn't news"
Like sending AWS/rackspace management passwords in plain text by email. If you choose to drive drunk because you know better and kill someone is not an accident anymore.
This is total BS. The Slashdot summary of the article anyhow.
As a senior, but with practical security experience, plenty of it, I can tell you what is happening is the younger crowd are FAR more likely to lie about having sent business information. The older one gets, the less they care about lying to cover their ass.
Secondly I will say that in every job I worked, I knew a lot more about security than the company did. An exception might be the companies that specifically hired me, to breach security at their companies, as proof their college educated certified IT people were clueless. Someone on the board of those companies knew the difference between book smart and actually smart.
Great example; the white house;
me: why does CICS have all these storage violations everyday?
OPM: oh they are nothing, just program bugs
me: no, they are storage violations. You can't tell the difference between a program bug and someone intentionally going after info.
OPM: your fired.
Guess what news story was next to be covered up and swept under the rug?
Bosses, senior or not, who do not want to hear bad news is what leads to things like the Healthcare rollout fiasco. And they are the #1 security problem in I.T. as well.
slashdot troll = you make a compelling argument I do not like the implications of.
You job as a security wank is to get the policies straight and give them to management to disseminate and get signatures on. Presumably, management has signed off on these just like everyone else. After that, it's mostly an HR problem.
Join the Slashcott! Feb 10 thru Feb 17!
While there probably is some truth behind this, the given statistics are near worthless.
Judging by the absolute number of mistakes (ie "have you even made mistake X?") naturally makes those who have been working longest most probable of being guilty. By this standard interns in their 1st day of work ever are the ultimate example of data security. They have not had a chance to goof up!
A former boss of mine had a bad habit of hitting Reply instead of Compose when writing new emails. I noticed I'd get emails from her which were totally unrelated to the mail she'd hit Reply on. I warned her several times that that could be dangerous since hitting reply automatically includes the previous email(s) as a quote.
Then one day it happened. She decided to send out a mass email to all staff, and composed it by hitting Reply on one of my emails. I got into work, checked my email, and did the biggest head-desk of my life. She had replied to one of my emails where we'd been discussing employee bonuses and pay raises, including extensive deliberation over what we were going to tell certain employees in their annual performance review. That lengthy discussion was quoted and got sent to the entire staff. Fortunately the damage wasn't as severe as it could have been - the four employees we'd discussed in the email thread were all good employees so most of our comments had been positive.
On the up side, it broke her habit. She never composed a new email by hitting Reply again.
Maybe by other senior managers.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
The Sun is hot.
Water is wet.
Politicians lie.
Film at 11.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
At my last job, upper management had different password strength requirements because they couldn't handle the normal ones designed to make them use secure passwords. Instead of 8 characters minimum with at least one capital letter, number and special character, they simply got away with 8 characters. Why? Because they complained enough, couldn't remember their passwords, and had the power to exempt themselves.
Remember the Alamo, and God Bless Texas...
Nearly every single problem with a company can be attributed to the managers, especially senior managers. They're useless leeches.
Things I've seen managers request in some of my former places of employment:
1) All passwords on the network were to be "standard". There were some minor differences in the passwords depending on the user, but for the most part, they were all XXX1234. With XXX being the initials of the user and the digits being the hire date or some such. No big deal normally, except that every employee had to display an ID card that had their name and hire date.
2) "Free software" would not be allowed. Consequently, an out-of-date and broken public key encryption tool was mandated instead of GPG.
3) HR Manager demanded that a share be opened up to a particular group because his team needed to share files. Rather than creating a smaller group and allowing that small group, he demanded that the existing group be used. Consequently, the employee salary information was visible to almost everyone with a login. This one was particularly annoying because he insisted that the job of IT was not to dictate policy, but to implement policy. I.e., IT would need to transparently keep the logins secure even with open access. This was a big deal at the time because of a notion that good computer interfaces meant that the computer changed to accommodate the user and not vice versa.
4) Manager surfed porn from operations PC. This was fun. I was in support at the time. Loss Prevention called and asked for me. I was worried. While the guilty manager was there, they had me pull up the browser history and system logs. The image cache was particularly interesting. I tried to be as diplomatic as possible.. "OK.. The log shows that someone with ID xxxxxx logged into the computer at 1:30AM. At 1:35AM, Internet Explorer was opened with that account. The logs show that this ID then visited the following sites..." Etc.. etc.. Can you see what was on those pages? "I can tell you the URLs but I don't recommend visiting the site." What sort of sites? Then the list of porn sites followed.. Weird, bizarre stuff.
I'm posting this as Anonymous because I still work at one of these places...
At my workplace our IT team has a policy about using cloud services like Dropbox for security reasons. Will our IT team consider rolling cloud storage on our own servers? Nope. Their solution is to use a flash drive. While many just outright violate the policy to get work done, I have done as they suggested and use a flash drive. To date I have lost (and quickly recovered) it 3 times.
They're also the ones who can get security policy overridden so that something can be easy for them. Regardless of the problems.
That is why you develop "dashboard applications" for their computer or phone that gives them the overview that they want, it pre-empts them from asking for access to the actual data. The data can be accessed and summarized by the server side software that only send the summary info needed for graphics and labeling on the client app.
...it has also been well known for the past 25 years.
From my experience they are also the biggest violators of porn , intentional breaking of assets to get a newer one, and keeping hardware on departure. When I was a DOD sysadmin all of our spillages (accidental classified material leakage) in a 10k person command were caused by O4's and above. Like the corporate world nothing happened except some long days and nights for the sysadmins to wipe all the systems, backups, and applications that touched the data. I sure if some lower enlisted person did it they would be toasted.
No good deed goes unpunished.
tl;dr
what land is this you live in?
No, seriously upper management has ALWAYS been the bane of anything IT related. Every boneheaded request, every response of "well, why can't I do that?" or "... it would just be easier for me that way..." always comes from senior management and no matter how many times you tell them why it has to be done a certain way, they just don't get it.
Fifty watts per channel, baby cakes.
Fellow IT guy. So management can't find their butt without two interns and a conference call? Well, good to see I'm not crazy. Got any studies about what happens to technical folks who either strike out on their own or at least refuse to work with the observably incompetent? Could we just wash our hands of these people?
When that thing comes back the next Monday morning, its been totally pwned by any number of evil doers.
Have gnu, will travel.
"Top Secret. SCI. ORCON. NOFORN. Oh! Naked Asian babes!" — John Deutch.
Also most senior managers have flunkies, sidekicks and general assistants who do most of the errands for them. Some of them are not capable of doing very simple things like booking all the things needed for a vacation package over the internet.
Add to this the sense of entitlement and belief that they are really really smart because otherwise how can you explain the free markets bestowing upon them huge salaries? They must be smart there is no other explanation in their mind. So they get really really careless.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I've heard some of that near verbatim from senior management whenever a new security measure is introduced.
Fifty watts per channel, baby cakes.
How is that news? This is known for thousands of years.
Do many senior managers read slashdot or net-security? Unless it's in Times/Forbes/etc they not likely to read about it.
I see your doctors and raise you... teachers (especially older teachers). Basically the attitude is "we're here to teach, not to learn" (or pay attention to some young whipper-snapper telling them how to use *their* equipment).
Ego and arrogance got them their position at the top (all that corporate back stabbing, taking credit for other people's work and of course blaming anyone and everyone for executives own mistakes), so it is hardly surprising that the same attitude arising in the security decision making. Security if for the little people the nobodies, I pay you to make me secure, it's your fault, your fired, is senior managements normal attitude to security.
Chaos - everything, everywhere, everywhen
Yes but people not in IT often can't imagine the possible consequences so this is news to them.
It's creeping into popular culture though - a major plot point of one of the "Torchwood" mini series was a manager ignoring security and letting a temp use their login and password. Others in that office treated it as a normal situation.
Reality is just like that in far too many places.
I can introduce you to some 70+ year olds that are likely to understand computers far better than most of the readers here, but they were involved with electronics. With the general population most people in their 60s will have had a least a couple of decades of hands on exposure with computers.
It's not about experience, it's about not caring.
Have you ever stopped and wondered why? Maybe, just maybe it's you? I mean I've worked in IT a long time, I know the drill, but it's only recently I learnt how to run a business, and how to deal with company politics. In general IT people are shit at making a business case, therefore they get ignored. And this is how it should be. In short, if you can't sell an idea then don't blame the idea or the buyer.
He pays you to make him secure, yet your lack of social skills at selling the security business case caused an incident. I'd fire you too. IT people need to understand that business is more that just good ideas. Selling those ideas (whether it be the product, the HR policy, or the IT security requirements) are all skills everyone senior employee should have. If your IT manager failed to sell it then someone else deserves a chance at his job.