How to Suck at Security

Sometimes checklists are helpful. For small business IT professional who cover a lot of different technologies (such as those encountered with securing Microsoft's Small Business Server 2003 or 2008) lists of what NOT to do can be especially helpful.

Lenny Zeltser, noted security researcher and reverse engineering specialist, shared his thoughts on how to suck at security. Lenny put together his cheat sheet of common information security mistakes or practices that he regularly sees by "security experts", so you can avoid making them.

[The idea is that you should do the opposite of what it says below.]

What do you think of this revised list as a starting point for the SMB IT professional?

The List: You might suck at Internet security if you......

1. Assume you don't have to worry about security, because your company or client is too small or insignificant.
2. Assume you're secure because you haven’t been compromised recently.
3. Expect end-users to forgo convenience in place of security.
4. Have no DMZ for Internet-accessible servers.
5. Assume your patch management process is working, without checking on it.
6. Delete logs because they get too big to read.
7. Hire somebody just because he or she has a lot of certifications.
8. Expect users to remember passwords without writing them down.
9. Assume users will read security policy.
10. Create security policies you cannot enforce.
11. Assume that being compliant means you're secure.
12. Assume that policies don't apply to owners or executives.
13. Deploy a security product out of the box without tuning it.
14. Buy security products without considering maintenance and implementation costs.
15. Rely on anti-virus & firewall products without additional user controls.
    
    P.S. Lenny's list is MUCH longer!