Perfect Security Training

[jamesb]

Something occurred to me this morning, over my nice relaxed coffee break, about why I find all of this corporate security stuff so easy and obvious. I realised it's all down to a few years spent managing school networks.

 

See in corporate security, you're meant to assume that most of your users are loyal employees who might occasionally click on a wrong link, or on rare occasions get disgruntled and do something bad. So the general mindset is that you investigate incidents when they occur, and put in what prevention you can.

 

The prevention put in, in every company I have worked for, is pretty minimal. I've yet to see a company security system I would consider to protect against a dedicated 14 year old. And that's the point - in a school you are constantly learning how to defend against and protect users, by limiting rights, closing holes, enforcing password security (ha!) and so on. In a company you just aren't - your users aren't hostile so mostly company defenses are set up to protect against an outside threat.

 

Really the thought process was that anyone wanting to go into corporate security should spend a year or two managing a school network. It amazes me that it's not a more common path.

[elsiegee40]

I couldn't agree more. A background in defending your network against the wildest imaginations of a several hundred teenagers is very useful experience. Even universities don't get half the 'issues' of your average secondary school! Edited February 27, 2015 by elsiegee40

[jamesb]

There should be some sort of certification program for it, honestly. It's particularly odd sitting in meetings with people who've specialised in security for decades, and miss some of the obvious holes that a 12 year old spots in about five minutes. Different perspectives I guess.