Feb

5

Security as a Chore

Posted by Keith McMillan

February 5, 2008 | 1 Comment

This article from CompuWorld is on it’s surface about how the French bank Société Générale lost $7.3 Billion due to unauthorized and fradulent trades by a junior trader. It’s more than that, however, as the article does a good job talking about the conflicting interests inside a large organization.

There are those people in large businesses that, either because of temperament,  lack of understanding, or lack of time, simply don’t want to deal with computer security.  It’s easier to grant all access rather than figure out the right permissions for the job, to not remember to revoke the right permissions when someone moves from one area to another, and this results in a gradual, and inappropriate, accretion of permissions. Making sure people have the right permissions, that those permissions are kept up to date, and that they’re appropriately terminated is difficult, but the consequences of not doing so are , however, clear in this case.

I can understand, and even sympathize with these overwhelmed folks. They have lots to do, and worrying about security shouldn’t keep them from getting their “day job” done. It’s the reason we need to have a strong centralized authentication and authorization mechanism in place for enterprises like this, and to have policies and procedures in place to make it as easy as possible to get these things updated on a timely basis. Without them, your business stands to lose plenty.


Comments

RSS feed | Trackback URI

1 Comment »

Pingback by Centralized Identity Management is a Good Thing | Adept Technologies
2008-02-11 09:43:09

[…] wrote before about security as a chore, and discussed that there’s a historical tendency of some organizations to view security as […]

Reply to this comment
 
Name (required)
E-mail (required - never shown publicly)
URI
Your Comment (smaller size | larger size)
You may use <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> in your comment.

Blogroll