Nontechnical Hurdles to Implementing Effective Security Policies

There are no secure sites on the Internet, only vigilant ones. The main hurdle to adequate security is not the lack of security technology, tools, and products, but undereducated network administrators, corporate managers, and users. While attackers constantly are coming up with new ways to defeat improved security protection, the truth is that sophisticated attacks usually are unnecessary. A large percentage of sites have only the most rudimentary security measures in place. Many companies still don't understand security risks and the importance of secure systems. Both system administrators and corporate managers need this education, because for security policies to be effective, they have to be implemented and enforced from the top down. Identifying and appreciating the reality of the lack of security at many sites around the Net is a first step in fixing the situation. The typical challenge to those of us in security is to look outside of our own network. However, we also have to be mindful of what is or is not going on right behind us, and why.