Computerworld
Ouch! Security pros' worst mistakes
We've all done regrettable things on the job, but does any valuable wisdom come of it? Four security pros candidly explain their biggest blunders and what they learned in the process
Bill Brenner (CSO (US))  04 September, 2008 08:05

"I didn't go to sleep that night and went to work early, around 4am, to work on what I was going to say. My boss called me when he got to the office around 5.30am. We decided to see if we could recall the e-mail. We kept sending each other e-mails and trying to erase them and/or recall them, to no avail. So I decided to face the music. My boss did a good job in reassuring me that I still had a job.

"At 7:45am my boss called and said that the guy at the university had sent out a very reactive e-mail to everyone involved saying that he would not be flying to the manufacturer at that time nor anytime in the future. It had not popped up in my PDA yet due to the delay (there is usually a two-minute delay in e-mails reaching the PDA), so I assumed he was on campus, too, and I began to search out the IT building. I saw two guys walking together who looked like they worked there so I asked them where the IT building was, which they pointed out to me. One of the guys peeled off to go to another building, but the remaining guy said he was going to the IT building so I followed him. Upon entering, he said he could help me find the guy I was looking for as he worked in the IT building. I told him the name as we walked up the stairs -- to which he replied 'That's me.'

"I followed him down the hallway -- it felt like I was going to the principal's office -- and sat in his office. I apologized profusely. Then he started to defend his actions over the past couple weeks and I cut him off saying that he was right and that I was completely wrong. That calmed him down. I also offered to excuse myself from the deal. At the end of the conversation, he did say that it took a lot of guts to come and meet in person with someone who was so angry with me. We ended up getting the deal, which I found out about two weeks later."

THE LESSON

"I learned that I really needed to work, on a regular basis, to maintain a healthy detachment. I also learned to pick up the phone. Rather than sending out those e-mails late at night, I should have waited until the morning to call everyone and deal with it on the phone. E-mails are a cold way of communicating, anyway, so I have become much more reliant on the phone now. Also, it was difficult to go meet with him in person that morning, but I have learned that you reduce the damage if you are willing to accept responsibility and meet the mistake head-on."

2. TRIAL BY FIRE (AND FLOOD)

  • Mistake maker: Jennifer Jabbusch (and colleagues)

  • Position: CISO at Carolina Advanced Digital, security blogger

  • Location: North Carolina, US

  • The incident: Found out the hard way that one shouldn't neglect business continuity planning

"I would have to say the biggest mistake has been the sin of 'priority pass-over.' When we sat down to review and revise policies for our data security and business continuity, we updated our procedures for discovery, data classification, retention, backups and continuity. We had each of these items in place, but wanted to structure them a bit more and come up with a more definitive schedule for verification.

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Enter the fully qualified URL, eg. http://www.example.com/
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

Discussions on Security
Zones
Zone logoZones provide focussed content from Computerworld and leading technology partners.
Newsletter Subscription
Newsletter Subscription
Sign up for our Computerworld newsletters!
Syndicate content Syndicate content
 

Computerworld Webinar

Thursday, June 11th, 2009
10:30am EST (Sydney, Australia)
Screening at your PC

Computerworld is hosting a 30 minute live webinar to help you to learn how unified communications can save you money, foster innovation and business agility by making it easier for people to find, reach and collaborate with one another.

Register Now

Computerworld Community Comments
Whitepaper

Customer Relationship Success Demands Insight

The goal of over 85% of companies implementing CRM is to increase revenue by better understanding their customers. Unfortunately the insight is often buried deep in a database. This paper discusses how analytics can help businesses understand the appropriate actions by sales, customer service and marketing to support the creation of relationships that yield maximum customer value.

Enterprise IT Buyer's Guide
Find Technology Vendors Fast
 
Find vendors by name | Find by category
Sponsored Links
 
Send Us E-mail | Privacy Policy
Features List | Media Kit | Advertising | Contact Us

Copyright 2009 IDG Communications. ABN 14 001 592 650. All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.