What are the most common mistakes made with regard to security policy.
Very often security policy comes down to threat avoidance only and because of that interferes with user's
work on the slide.
This problem is called user resistance when security policy implementation is carried out hastily and
users are not part of the process.
The result will be as ludicrous as the traffic lights shown in the slide
does not really help the traffic does it.
If security policy does not allow for functionality users will most certainly find a way to bypass it.
Instead of cooperating they will start to rebel.
The second mistake could be referred to as information gap a situation where users are given too little
explanation.
For example how do we convince employees that as far as security is concerned it is not really advisable
to use social networking sites.
You may know that in the last two or three years career women aged 30 to 50 have been the fastest growing
demographic on Facebook.
They didn't really use social networking before but they seem to like it now.
A short notice forbidding users to use social networking sites creates an information gap.
It provides too little explanation and is likely to be seen as a pointless annoying inconvenience.
Our security policy should never give rise to such situations
unawareness of cyber threats is yet another obstacle to effective computer security measures.
The first picture in the slide shows a company of strategic importance say a factory or a power plant
as you can see security policy in the company does not forbid connection of personally on computers.
So the company's network
when storm wreaked havoc in 2007 it showed how dangerous such behavior could be.
If we do not help others to understand these threats we cannot expect them to act in a safe way.
Security services fail also because users are not able to use them properly.
It's not really that users are completely helpless in the face of all power cyber attackers.
On the other hand software and operating systems manufacturers can't make us use their products in a
secure way.
Sometimes they even discourage it.
The second picture in the slide shows a software security setting option which is by default disabled
even though it can block dangerous file types.
There are few if any users who would intentionally find and check such an advanced option this kind
of security policy is ineffective.
By nature the next picture was taken at an airport.
It proves that even reliable security measures such as CCTV can be used ineffectively.
Maybe the point of the solution presented here was to get a really good look at the monitor.
If so it definitely serves its purpose.
In the real world such negligence is easy to spot
on the Internet.
However mistakes of the same sword may remain unnoticed.
There is simply not that conspicuous
the lack of any kind of security policy is the main reason for ineffectiveness of computer security
systems
having no security policy means that we are not able to decide which content we should protect
in the real world.
You wouldn't find a private security firm that would agree to provide protection if they didn't know
what they were to protect in the world of computers comparable situations are still relatively easy
to come across.