In the last couple of years, I’ve seen my share of crazy things happen. Anyone who has spent as many years in IT as I have will have accumulated a load of “stories” that become part of your base of knowledge, and eventually be transformed into IT security wisdom. Here are a few of my more recent ones.
The “Know it All Director.” Nothing is more frustrating than meeting an IT Director who thinks he knows everything. The danger here is that if they are in Stage 1 of the “4 phases of learning”, that company is in big trouble. Solution: Suck it up. Admit you don’t know everything and get some help. You can still take all the credit.
The “Office Power User” This is the guy who helps everyone and always brings in his special “Windows 98 utilities” from home. Solution: Don’t plug anything into your computer at work. No USB drives, no iPods, no Cameras, NOTHING. 99% of problems start by cross contaminating PC’s
The “Download King” This is the guy who is the local challenger to Shareware.com. He’s got just about everything in the world on his PC and knows how to use it. However he never get’s his work done. Solution: If it’s free software, you probably shouldn’t download it. Free works great for social engineering. If there is a security breach, always start at this guy’s computer first.
The “I Need a Patch Guy”. This is the IT administrator who when the network cord is too short, plugs the Windows server directly into the WAN firewall jack, “just for a minute”. The result is a compromised Windows server and an infected network. Solution: Don’t ever plug a patched or unpatched server into a WAN interface. The average time to infect an unpatched Microsoft computer is 4 minutes. With a simple firewall it’s 16 hours.
The “I Have a Firewall Guy”. This is the manager who runs his business operation with a Net Gear or Linksys firewall and complains to his ISP about performance. Solution: Don’t use a $50 firewall, not even at home. Get something good and pay someone to set it up.
The “Spam King or Queen.” This is the man or woman who gets 25 times more spam than any one else and is always complaining. A simple look at their internet activity will show they spend more time surfing than working. Solution: Never give out your email to anyone you don’t know. Treat it like your SSN. Assume the other person you are giving it to will lose it or abuse it. One time I even told a customer the best thing to do is give them a new email address and charge them for new business cards.
The “I Have the Best IT Guy in the World, Guy.” This is the manager who hires his cousin or nephew because he “builds computers” at home. Question: Would you hire a CEO just because he knows the difference between a Quarter and a Dollar Bill? Solution: Vet your network staff. You’re handing them the keys to the kingdom.
