I’m calling bulls**t on IT security

For years people worried about technology taking over our lives. What they should have worried about was Information Technology (IT) departments. It’s time for someone to step up and call bulls**t, so I guess I’m volunteering.

“The only thing we have to fear is fear itself,” the famous line spoken by President Franklin Roosevelt, still resonates to this day. The meaning, however, has taken on a whole new scope for me and others frustrated by IT security experts who feed on fear and wield their tremendous power to eliminate productivity.

David Pogue from the New York Times recently wrote a great column about this subject. Pogue wrote:

I understand the IT person’s position: “I was hired to protect the network. If I fail, I lose my job. Convenience and productivity are really secondary.” Maybe companies need to hire a PT person as well (Productivity Technology), somebody who’s a counterweight to the IT person. Somebody whose job it is to argue: “Oh, come on. Is this really necessary?”

Finally – a voice of reason that is large enough and loud enough that someone might pay attention. You hear the stories every day of companies blocking access to social media and various websites because of “viruses, malware and hackers, oh my!” You hear about IT departments putting draconian measures into place simply to log on to a laptop computer  (or even a smartphone) because there’s the chance someone might steal it. If you’re involved in anything near the healthcare field, you get to deal with HIPAA — the federal government’s off-base and overzealous attempt to beat providers and insurance companies to a pulp if someone’s private health information is inadvertently released.

I’m not naive and I realize there are people in the world intent on wreaking havoc with computer viruses and who would like to access networked data for ill-gotten gain. But I have a colleague who has to change her computer password at work every 60 days and the new code cannot have any resemblance to the past 24 she used. Another colleague has to enter a password every time he wants to use his company-supplied smartphone. He must change the password every 60 days. If he types the code incorrectly five times, the phone self-destructs, immediately wiping out all content in its main memory and the installed memory card. And there are several people I know who cannot use the USB ports on their computers at work because they’ve been locked down.

It seems to me that the ones most successful at ill-gotten gains these days are the software companies peddling fear and their IT henchmen. Companies that produce and market blocking programs or security suites stand to gain millions of dollars if they can convince people the Internet is a dark and evil place from which companies need protection.

The Internet can be a scary place, but what’s scarier is how many businesses have given in to fear and are sacrificing employee productivity, convenience and morale by trying to stay safe from what is, for many, merely a perceived threat.

Photo courtesy of t3mujin’s Flickr photostream.)