Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

The 10 Worst Security Practices

Security specialists are constantly on the lookout for proven methods we can replicate to keep our networks and data safe. Independent consultants provide an outsider's perspective and carry with them the aggregate experience of helping hundreds of clients. But not every practice consultants see in the field is a good one--in fact, they encounter some stunningly bad ideas. Because sometimes one whopper of a mistake can be more instructive than a binder's worth of best practices, we interviewed more than a dozen security consultants to arrive at our 10 worst practices list. See which ones apply to you, then check our links for advice on how to do things better.

If you find a security hole, buy a product to fix it. There's a prevailing, and dangerous, belief among information security pros that for every problem, there is a tool. As long as we have the right technologies in place--antivirus, antispam, firewall, patch manager, VPN, PKI, IPS, IDS--we feel safe.

Trouble is, products are only as good as the person who configures and monitors them. "A tool is there to assist, not do the job for you," says John Pironti, a security consultant at Unisys. "Always remember that you are at least 50 percent smarter than computers. Computers know 'yes' and 'no,' but we know 'maybe.' We can evaluate more variables because there are only so many you can put into a tool."

Latest Issue of Secure Enterprise Magazine


Consider intrusion-detection and intrusion-prevention systems. They don't work well out of the box. You must teach them what to look for, and once they're running, you must monitor their logs and look for attack patterns. Even some IT shops that do a great job configuring IDS and IPS products stumble because they don't adequately monitor the voluminous log reports generated by these tools.

  • 1