Don't ignore internal security concerns

It is the responsibility of a company's Information Technology department to apply all available resources necessary to protect the security of a company's data and information. It the responsibility of senior management to ensure the IT department has the financial means to accomplish this task and the support of the upper-level management.

As a network administrator for our local Sheriff's Office, one of my primary tasks was to ensure the security of our data and protect that data from unauthorized access.

Unfortunately, politics being what it is, I often run into those "exceptions to the rule". These are persons that are allowed by the administration to deviate from security precautions because they "hinder their performance" or they are "above the rules".

On several occassions, we have had to completely shut down our network infrastructure to deal with a virus that got into our network because some person in management decided to dial into their personal email account on a company networked computer and download their email, even though there are numerous policies against this.

No matter how much time and energy the IT department puts into security measures, it is ultimately the responsibility of the upper management to ensure security is in place and all policies are enforced.

Our job is to tell them how to secure their network and to provide the technical expertise to accomplish that.

The rest is up to them.

I work for a Regional Government in southern Ontario. Quite often computer security is not only ignored but openly despised and flouted by supervisors in our Social Services area on a routine basis! Users go for lunch logged in. People think nothing of sharing their passwords. Supervisors forget to plan for incoming and temporary staff on a regular basis and expect other users to "loan" them their passwords or use old accounts. People stick their passwords on their monitors! These people have three (3) passwords to remember - network login, e-mail and the main application (SDMT). Until the managers and supervisors believe in security and enforce the rules nothing will change. These systems contain highly confidential and personal information protected by legislation!

Who else has the power to inforce anything? This is the same as asking why we didn't have stronger doors on airplane cockpits before 9-11. We didn't see a need. It takes a disaster to make people realize why us techs worry about security. I read these TechRepublic articles about security all the time, so I hear all the horror stories. Management doesn't. The 2 main reasons we perform backups of data are:
1) Accidental deletion of data.
2) Intentional deletion of data.
That should sum it up right there.