Bad advice for good security

Bad advices comes from everywhere. One of the strugles of security is to teach management and employees alike the importance of policies and regulations, and the need to abide to them. 

Andy IT-Guy, a fellow security blogger, sent an open letter to WSJ on the background of this article. I stand behind him. I support his point of view.

In an organization, there are rules. Rules are there to be followed - like it or not. If you do not like it - or understand the reason behind the rules - then ask around internally. If you have the knowledge and the power, you may change the rules - that process should be a major part of the rules, and it is called auditing.

Review rules regularly, and be ready to change them as needed. But do not break them!  

One challenge organizations face (as do we all) is the fact that some people do not like rules. And some rules are just plain stupid. Still, if your employer have policies and rules in place, you are not only asked to follow them, you have accepted to follow them. Even if it may seem a good idea to bring work home, or leave top secret documents floating on the network. It may make you personally more efficient, but leave the organization at risk. 

When journalists do put forward tips on how to break the rules, it certainly makes our work harder. Still, it does not take journalists to make people lazy. The fact remains - security requires the management to take control, and the employees to abide the policies.