Four signs your security program's gone too far

Our columnist suggests when it might be time to dial back a bit

When risk is present it calls for treatment, and security is a never-ending process... right? Yes, but as a security professional, it's easy to become focused on the hard problems (download PDF) of security -- falling into the arms race for more, more, more security controls -- and lose sight of the impact of the controls themselves.

Balance is key in the push-pull between security and business objectives, and sometimes we on the security side go too far. (After all, the most truly secure computer is one that's unplugged, boxed up and dropped down a deep well. And sometimes that's tempting.) Here are some ideas for recognizing and pulling back from the edge when security controls or processes become unreasonable.

Locked out

A friend of mine recently hired on as information security manager at a major state agency. When I met him for lunch a month after he started, he was still sporting a stick-on visitor badge that indicated he needed an escort within the secure areas of his building. Likewise, I saw an international client's new helpdesk coordinator repeatedly locked out of her shared office when co-workers departed for a smoke break. Both of these people have significant levels of access to sensitive data, but end up locked out of their own workspaces -- physically as well as virtually -- because the identification and access management methods are overwrought or out of sync with the employment process.

The lack of coordination between issuance of physical and logical access indicates both problems in the hiring process and disjointed management decisions regarding access. I haven't seen many instances where new employees in any organization are greeted on their first day with a coordinated issuance of access credentials, computer, phone, and keys. It's a challenge for most to simply get an ID badge on the first day.

A handy solution is to use the list of things that have to be done when someone is terminated. Human Resources usually has a termination checklist (download PDF) of tasks that includes obtaining the employee's ID and keys; disabling system, network and application accounts; and ensuring that computers, mobile phone and other company property are returned. If one takes this list or another <example and turns it around as a guideline for the access- and asset-granting process when a new employee is hired, it's easy to see where the delays and other problems might lie. The same people that authorize revocation of access upon termination ought to be the ones who grant it to begin with. If more than two or three peoples' authorization is required to make it all the way through the list, some streamlining is in order.

The every-time pad

The classic problem with passwords is that system and application users are overwhelmed by the required complexity, or by the password rotation frequency. They simply can't remember passwords that follow the rules for minimum complexity, or keep track of their new passwords when they have to be rotated frequently.

To compensate, people resort to repeating patterns that are easy to remember -- and predict, or write down passwords on notepads, whiteboards or even right on the case of the computer. Instead of the uber-secure one-time pad method for passwords, where a series of single-use passwords is given to a user (usually on a tear-off pad of paper) and replenished when used up, the sticky-note-by-the-monitor pad of paper is used to subvert password standards.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jon Espenschied

Computerworld
Show Comments

Essentials

Mobile

Exec

Sony WH-1000XM4 Wireless Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?