Think your security staffers are trustworthy? Competent? Knowledgeable? Listen to a security professional's horror stories, and you might think again.
Here's one from Kevin McDonald, executive vice president at managed services provider Alvaka Networks, author of several books on cybersecurity and a member of the AeA technology trade association:
A construction company client of his had a senior IT person who was also in charge of security. Somehow, this head of security convinced the firm's owner that it would be cheaper to store various company databases at his own home, where he already had fiber-optic lines installed, rather than elsewhere off-site.
You can see this one coming a mile away: A conflict arose between the employee and his employer. Before you could say "internal threat," the security worker was sending threatening e-mails to the construction firm's customers, telling them that he had their private information.
The action "fundamentally put this guy out of business," McDonald says. It took six months to shut down the rogue employee, since -- of course -- he was an authorized user. Only when the employee publicly threatened, online, to use the data in an illicit manner was the FBI able to enter his home and end the standoff.
This is a worst-case scenario, but the security sector is plagued with problems, from bad guys to bad buys, weak budgets to weak workers. Here are some common trouble spots, along with tactics for dealing with them.
Bundled Badness
At this moment, somewhere in corporate America, security staffers are cursing their C-level execs for foisting bundled junk on them. Here's how it works: Salespeople from the big security vendors convince the execs that it makes sense to buy a package that does desktop antivirus, e-mail security, intrusion detection and Web filtering, all for $38 per seat.
What's wrong with that picture? "You've commoditized those critical parts of the security infrastructure," says the head of a security software vendor who requested anonymity. "The problem is, the perception of C-level execs is that security is a commodity -- one [application] is the same as the other."
But no vendor is good at everything. Organizations whose executives buy bundles do save money. Unfortunately, they often get "really subpar security, sometimes dangerously so," says the head of security.