Demanding that users not write down their passwords is a quarterly opportunity to send the message that security policy is a useless bureaucratic exercise.
Category: Cloud IT Governance risk management security Tags: passwords, policy
Entries Tagged as 'policy'
The Peril of Parallel Passwords
by Jay Heiser | December 23, 2011 | 2 Comments
All employees must obey the law!
by Jay Heiser | December 14, 2011 | Comments Off
Even worse is a policy statement such as “all employees must obey all applicable laws.” What reasonable person would disagree with that requirement? For a start, I would.
Comments Off
Category: IT Governance risk management security Tags: law, policy, security
Counterproductive Policies
by Jay Heiser | February 18, 2011 | 1 Comment
I do a lot of policy review for Gartner clients, and I see many of the same counterproductive practices over and over again. Requirements to ‘do what is appropriate’ or ‘obey the law’ are tantamount to saying “we won’t tell you specifically what to do, but if you don’t do it, we will punish you.” [...]
Category: IT Governance risk management security Tags: policy
Dogs, pocket knives, and laptops
by Jay Heiser | February 9, 2011 | 1 Comment
I’ve lost a string of pocket knives over my lifetime, some of them very nice, but I’ve got no idea who, if anybody, is finding them. I did find a pocket knife once, but it was a cheap Swiss Army knockoff, and I didn’t keep it. My turnover ratio is barely -6. Dogs are not [...]
Category: IT Governance security Tags: data leakage, encryption, laptops, policy
Will your successors throw away your policy?
by Jay Heiser | January 24, 2011 | 1 Comment
I spend a lot of my time doing policy reviews. Sometimes the review request comes from the policy author, looking for some feedback. Usually, the request comes from someone else. One of the first things that many new infosec managers do is start on a policy rewrite. While this is sometimes a political gesture, meant [...]
Category: IT Governance risk management security Tags: policy, risk management, security, security program management
