There is no excuse for a company to do this, yet it is often done by management that do no realize the implications of security. Rather than maintain proactive security, they take a reactive stance and only see fit to distribute funding after horrible security incidents. Abundance of Information. As absurd as this may sound, the vast amount of information resources available to administrators can be overwhelming. So overwhelming in fact, it becomes confusing which resources to follow and which to trust.
Some sites recommend different courses of actions, different security policies and more.
These cause confusion and conflicting advice which can lead to improper configuration of corporate resources. Poorly Trained Staff. In an effort to maintain lower costs of operation, companies are looking for the lowest possible salary for their administrators to do their job. This leads to hiring undertrained and poorly skilled administrators that become responsible for large computer networks controlling incredible resources. When several of these problems work in tandum, it becomes apparent how little security holes can be overlooked by even highly skilled administrators.