Re: Are users right in rejecting security advice?

[Eric Case <ecase () EMAIL ARIZONA EDU>]

> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Russell Fulton
> Sent: Wednesday, March 17, 2010 1:18 AM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: Re: [SECURITY] Are users right in rejecting security advice?
<snip>
> I now cringe when I hear the phrase "Best Practice" when applied to
> security

The problem I see with "Best Practice," "Best Known Practice," "Effective
Practices," etc. is one size fits some.  Is that "Best Practice" for a
small, centralized, risk-adverse institution or a large, decentralized,
risk-accepting institution?
-Eric


Eric Case, CISSP
eric (at) ericcase (dot) com
http://www.linkedin.com/in/ericcase