(Lack Of) I.T. Security In The Workplace.

[LEE929394]

I look after everyone's general I.T. needs in my company. The company probably has a better security policy for its computers than many others but it always seems to be the end-users are so poorly trained to begin with, it's impossible to give them advice as they are so set in their ways (or more likely don't give a *Fully star out swearing!*)

Things i see that scare the crap out of me.

Super weak passwords. Like password is the password or username is the password!

Sending credit card details / bank details via email.

Never keeping their computers up to date, windows updates, new software versions etc.


The scariest part is many staff show no interest or knowledge in basic security practices but all own computers at home which they use for online shopping. I imagine many of their home machines have no anti-virus or firewalls and no windows passwords set-up at all + weak passwords for other online services.

The normal attitude is 'it will never happen to me' (ID theft, bank details stolen etc)

Surely prevention is better than cure?

I always think you've got to be into computers to have a computer (and be safe)
I imagine most compromised machines on botnets contain users that all want their facebooks & twitters but have no clue and/or don't give a *Fully star out swearing!* how their technology works.

Things can only get worse with so much more malware being written these days?

 

[LEE929394]

My work (finally) enforced complex passwords, so the users started writing them down on post-it notes. A manager at our place did a sweep round a floor one evening and binned any they found, then complaints started rolling in. Start suspending accounts and they soon learn.

I always think writing down complex passwords and keeping them on a post it note under the keyboard is a much better security practice than using weak passwords that users can easily remember.

Being hacked is far more likely than the offices being broken into and passwords being stolen that way. There's always a chance your colleagues will find your passwords and meddle with them, no win situation

Should use keepass or other password encryption software but people never tend to use more than they have to.

Management are often just as bad or worse!