Emergent Chaos

Four factors appeared to be responsible for the majority of variance in participant responses. Of those four factors, three were people-related and one was network-related:
• For factors related to IT personnel, it appears that more education and training, improved job requirements, and procedures that help prevent them from making accidental or careless mistakes are important in preventing the incidents.
• For factors related to users, it appears that more education and awareness training, more stringent requirements, and better knowledge of policies and systems prior to the use of campus networks would be helpful in preventing them from accidental or careless behaviors, thereby preventing the incidents.
• For factors related to non-IT staff, more education, more stringent job requirements relative to technology use and data protection, and having more knowledge prior to using the computer systems would prevent accidental and careless behaviors that are one of the causes of incidents.
• For factors related to networks, more resources, more and better procedures and requirements relative to configuration of software and hardware would be helpful in preventing the incidents that are occurring.

An in-depth study of computer and network problems has identified carelessness of students and staff as one of the leading causes of those problems, not malicious behavior as most assume. As much as 40% of the incidents studied, such as hacker attacks, computer viruses, loss of confidential data, and other problems, could be attributed to carelessness. Another source of problems was inadequate training to help avoid problems, and lack of policies to deal effectively with incidents. Helping students develop judgment about computer issues and training staff is important to prevent and properly mitigate incidents.

I'm hoping Morooney was quoted out of context or something, because people doing dumb stuff are a huge piece of the puzzle when it comes to .edu breaches, and it isn't a secret.

It's not like those Penn alumni can get a new alma mater. They can, however, get a new provost.

Evidence? I don't need no stinking evidence! As Pokey says:

Hmmm... Html for style only. No images. Whoops:

http://www.yellow5.com/pokey/archive/pokey484_4.gif

anyone on this blog who is a Penn State alum ought to be letting fellow alums know what the "thinking" is at the highest levels of their alma mater. Scary.

The problem is not ignoring evidence but being drowned in a sea of evidence. Morooney is right to be skeptical, he probably has at easy reach 20 other reports, all as superficial.

Indeed, we only have to skip a few posts back to discover that awareness training is good for sexual harrassment and deforestation, but does nothing for security. Any report that attributes 40% of the problem to carelessness is simply shifting the burden to somewhere else and should be treated skeptically.