For every worldwide virus or high profile Denial of Service attack, the industry is strengthened by new knowledge. Attacks also increase the resolve of Internet-dependent organizations to overcome what are, admittedly, difficult problems. The lessons have come in various areas of endeavor and have been learned on all sides. You bug hit, it stirred up enough of a frenzy among the company s many customers that our site went down even though the virus itself was not the cause. The lesson, of course, is that collateral damage must be considered as part of an organization s incident response plan, he advised.
Security can also generate a plethora of unintended consequences.
Lehfeldt recalled that a beefing up of security in one federal agency was planned around the change of user accounts from 8-character passwords to 12. But because people had such a hard time remembering 12 characters, they had a tendency to start writing their passwords on yellow stickies that they just put out in plain sight on or near their desktop computers, he said. Thus was the entire purpose of this policy change defeated. FSI s Hirsch but many agencies might already have enough money to significantly meet baseline IT security requirements. What they lack is the staff expertise and the priority.