I was reminded about this in "Better Security For Not Quite All" which appeared in ComputerWorld on November 2, 2009. The article isn't about a huge security breach but does discuss the difficulties and findings of just trying to enforce "screen locking" at the company in question:
We found that more than 70% of our approximately 6,000 users had disabled both the password requirement and the screen saver.Clearly, these 6,000 users feel that their own convenience is more important than the company's security posture. This is, however, not too surprising is it? What was a bit more interesting were the results of the author's survey related to what other companies were doing:
When I proposed the change in our lockout policy to the CIO, he asked me to determine what other companies in our industry are doing. I have a pretty decent network of peers in this industry, so I asked them whether they enforce a screen lock -- and if so, what the timeout value is, and if not, what their policy regarding screen locks is. I was surprised by the results: Only one of the 20 companies in my survey enforces the screen lock. That wasn't the response I had anticipated, and it certainly wasn't what I wanted to report to the CIO. In the end, though, he agreed with me that this is one area where it's worth bucking the industry norm.One in twenty? That's only 5%! I congratulate the author and his company for their choice to turn on the screen lock. I can only imagine that so many other firms haven't bothered to turn on such a basic security feature. It's cheaper than a smoke detector: If you're running Active Directory all you have to do is use Group Policy to turn this capability on.
Do you have a smoke detector installed? Is the battery still good? Have you tested it recently?
Technorati Tags:
security, identity management, QSFT, Quest Software
No comments:
Post a Comment