If their systems are affected by a virus, rogue code, or another person's error, both the users and network staff lose productivity. Users rarely face additional consequences, though regardless of how much and how often they ignore the security plan until they cause a major problem that affects everyone. Operations managers should have the authority and avail themselves of the opportunity to periodically test their own staff. The bottom line is that there are no secure sites on the Internet, only vigilant ones. Frequently it is this vigilance that gets the security managers in trouble.
Most techies see a straight line as the shortest distance between two points.
Sometimes in our zeal to implement the best security procedures, we lose sight of users and implement policies that users view as so Draconian they are ignored. I know of a user who placed a modem on her computer to get around the firewall and stay connected to an ISP for the entire day. Identifying and appreciating the reality of the lack of security at many sites around the Net is a first step in fixing the situation. The typical challenge to those of us in security is to look outside of our own network. However, we also have to be mindful of what is or is not going on right behind us, and why.