Bad passwords: there have been solutions to the "bad password" problem since at least the early '80s. But hardly anyone uses them because they're a bit inconvenient and there's no drive to implement.

Unpatched apps: admins just don't get enough time and priority for managing security, too many "bottom line" things to keep up with.

Insecure ports: it's really inconvenient to block off all those ports, and takes a lot of time and detail work to make all our stuff work through the firewall if we're too strict.

Bottom line: in 1994, most security problems were caused by management not buying into security until after they'd been screwed. In 2004, ditto.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/272/28838#28838