I'm VP of a company that implements security here in Brazil (SafeCore Network Solutions, if you must know), and I can say from experience that the tallest barrier found when presenting security for our clients is the fact that they don't believe that their "IT professionals" aren't fit for the job. They say they've hired "experts" that should know what they are doing. Well, they don't.
As an example, a school specialized in computing and networking in the city of Curitiba was cracked into at least 7 times, and they still believe that their IT staff "will handle the job this time."
No system is perfect, that's true, but people should do their best to keep it harder to crack (knowing that given the amount of time, resources, yadda-yadda...), not just choose the cheapest solution.
At least, companies that choose the right option go through the right way: building security from ground.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/65/10911#10911