Although system administrators routinely manage centralized resources including fire and virus walls and routers, network administrators must negotiate between network security needs and users' and the organization's needs. Most users do not take security seriously. Users typically view security as an IT problem and some view security policies as a hindrance to getting work done. Business managers are not committed to security policies implemented by network administrators. For example, minimum password lengths, forced password expiration dates, and account lockouts are perceived as limits on user rights or privacy.
Strong security is in opposition to the culture of many organizations.
At universities, for example, learning is assumed to take place in an unfettered environment. Locking doors or limiting access to computing resources is inconsistent with openness. Even in selecting passwords, studies show that most people make inadequate choices. These technologies were designed for authentication, privacy, and data integrity not necessarily for security. Security policy is not a primary objective in business.