Friday | 10 July, 2009
CSO
Ouch! Security pros' worst mistakes
We've all done regrettable things on the job, but does any valuable wisdom come of it? Four security pros candidly explain their biggest blunders and what they learned in the process
Bill Brenner (CSO (US)) 04/09/2008 08:05:00

"I didn't go to sleep that night and went to work early, around 4am, to work on what I was going to say. My boss called me when he got to the office around 5.30am. We decided to see if we could recall the e-mail. We kept sending each other e-mails and trying to erase them and/or recall them, to no avail. So I decided to face the music. My boss did a good job in reassuring me that I still had a job.

"At 7:45am my boss called and said that the guy at the university had sent out a very reactive e-mail to everyone involved saying that he would not be flying to the manufacturer at that time nor anytime in the future. It had not popped up in my PDA yet due to the delay (there is usually a two-minute delay in e-mails reaching the PDA), so I assumed he was on campus, too, and I began to search out the IT building. I saw two guys walking together who looked like they worked there so I asked them where the IT building was, which they pointed out to me. One of the guys peeled off to go to another building, but the remaining guy said he was going to the IT building so I followed him. Upon entering, he said he could help me find the guy I was looking for as he worked in the IT building. I told him the name as we walked up the stairs -- to which he replied 'That's me.'

"I followed him down the hallway -- it felt like I was going to the principal's office -- and sat in his office. I apologized profusely. Then he started to defend his actions over the past couple weeks and I cut him off saying that he was right and that I was completely wrong. That calmed him down. I also offered to excuse myself from the deal. At the end of the conversation, he did say that it took a lot of guts to come and meet in person with someone who was so angry with me. We ended up getting the deal, which I found out about two weeks later."

THE LESSON

"I learned that I really needed to work, on a regular basis, to maintain a healthy detachment. I also learned to pick up the phone. Rather than sending out those e-mails late at night, I should have waited until the morning to call everyone and deal with it on the phone. E-mails are a cold way of communicating, anyway, so I have become much more reliant on the phone now. Also, it was difficult to go meet with him in person that morning, but I have learned that you reduce the damage if you are willing to accept responsibility and meet the mistake head-on."

2. TRIAL BY FIRE (AND FLOOD)

  • Mistake maker: Jennifer Jabbusch (and colleagues)

  • Position: CISO at Carolina Advanced Digital, security blogger

  • Location: North Carolina, US

  • The incident: Found out the hard way that one shouldn't neglect business continuity planning

"I would have to say the biggest mistake has been the sin of 'priority pass-over.' When we sat down to review and revise policies for our data security and business continuity, we updated our procedures for discovery, data classification, retention, backups and continuity. We had each of these items in place, but wanted to structure them a bit more and come up with a more definitive schedule for verification.

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Enter the fully qualified URL, eg. http://www.example.com/
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

Additional Resources
Newsletter Subscription
Sign up for our CSO Online newsletters!
RSS Feeds
Syndicate content
 
Whitepaper

State of Internet Security

Spyware, viruses and other malware transported via Web sites represent the most serious data threat to companies today. Read on find out how you can appropriately leverage technology and appropriate business technologies to protect your business.

Sponsored Links