Secretary of Energy: 'Security hinders productivity'

[Thorn]

http://fcw.com/articles/2009/05/11/c...ty-a-drag.aspx

By Matthew Weigelt
FCW.com
May 11, 2009

Energy secretary wants to balance information security, mission

Energy Secretary Steven Chu has said the Energy Department needs to consider whether its information security systems are worth the drag on its mission.

“We’re going to be looking at information technologies," Chu said at press briefing May 7 about the department's fiscal 2010 budget proposal.
"Do we have the right balance between keeping our IT secure from viruses to how it compromises productivity?”

In an April 29 speech at the National Renewable Energy Laboratory in Golden, Colo., Chu said “well-meaning people” in the chief information officer’s office and in the procurement and finance offices “whose job it is to protect the Department of Energy” actually hinder what the department can do.

“They forgot the Department of Energy has a job, and it’s not to protect the Department of Energy. It’s to get something done,” he said. Terrible accidents and financial waste are bad things, he said, but added, “It has to be balanced against the mission of the department and so this is something that I feel very strongly about.”

[...]

Right. I know I'm preaching to the choir here, but a good analogy is that traffic laws slow everybody down, but society deems them necessary to have them to minimize the chance of some idiot in a car smearing your kids on the street. They may chafe when you you're in a hurry, but no one really wants to repeal them because of the potential for greater harm.

I floors me that people like Sec. Chu can't see that.

[streaker69]

Re: Secretary of Energy: 'Security hinders productivity'

I'd really like to hear some examples of what security is hindering in this case. If it's keeping him from watching videos at MonkiePr0n.RU on his DoE computer, then I think it's doing a good job.

So it’s really trying to maximize our mission goals. Right now there are very well-meaning people in environmental health and safety in the CIOs office and you just go down the whole list, procurement, finance, that whose job it is to protect the Department of Energy. But they forgot the Department of Energy has a job and it’s not to protect the Department of Energy. It’s to get something done. So now all these things are very important. If we have a terrible accident, that would be terrible. If
10
we have some financial waste, that will also be terrible. But it has to be balanced against the mission of the Department and so this is something that I feel very strongly about.

The article appears to be a sorry case of paraphrasing. The way I read it, it would seem he was talking more about the people in the CIO, Procurement and finance offices that's actually hindering, and not necessarily IT security policies. Searching for 'secur' on the entire speech only turns up two instances, and it isn't referencing IT. I think we all know that bureaucracy is more of a hindrance than anything else.

[xor]

Re: Secretary of Energy: 'Security hinders productivity'

Clearly someone who leaves his password on a sticky underneath his keyboard. Anyone in DC care to check and post the results.

xor

[renderman]

Re: Secretary of Energy: 'Security hinders productivity'

My interpretation is that the DoE should be doing DoE jobs and IT security is not their job. Maybe it's some call for someone else to oversee IT security which makes some sense.

I dunno. Politicians never make much sense to me

[bjaming]

Re: Secretary of Energy: 'Security hinders productivity'

Nothing the clowns in Washington do really surprises me these days.

[b0n3z]

Re: Secretary of Energy: 'Security hinders productivity'

Clearly someone who leaves his password on a sticky underneath his keyboard. Anyone in DC care to check and post the results.

I just yelled at one of my users for that such thing last week.

[Thorn]

Re: Secretary of Energy: 'Security hinders productivity'

I just yelled at one of my users for that such thing last week.

I keep folder of photos of similar things that have been done by various client's users. The worst so far was the domain administrator's username and password on a bulletin board. The runner up was a username and password taped to the palm-rest of a laptop.

[Deviant Ollam]

Re: Secretary of Energy: 'Security hinders productivity'

The runner up was a username and password taped to the palm-rest of a laptop.

hehe... reminds me of the fourth row down on this page. speaking of, anyone else going to make it to ShakaCon this year? it's just around the corner.

[Thorn]

Re: Secretary of Energy: 'Security hinders productivity'

hehe... reminds me of the fourth row down on this page. speaking of, anyone else going to make it to ShakaCon this year? it's just around the corner.

That last picture on the right is almost identical to my runner up picture. But at least my client's user was a librarian, and not logging into a DOD computer.

[bascule]

Re: Secretary of Energy: 'Security hinders productivity'

Well, there's certainly a flipside to that argument. Does TSA requiring me to have my hair gel in 3oz containers and a 1 quart plastic bag really keep me safe?

It's really a question of whether security measures are pragmatic or simply there to give a vacuous illusion of security. Security measures can be needlessly counterproductive.

[valkyrie]

Re: Secretary of Energy: 'Security hinders productivity'

Well, there's certainly a flipside to that argument. Does TSA requiring me to have my hair gel in 3oz containers and a 1 quart plastic bag really keep me safe?

Hunh. I didn't know you used hair gel...

It's really a question of whether security measures are pragmatic or simply there to give a vacuous illusion of security. Security measures can be needlessly counterproductive.

Quite true. Often, reasonable dialog about what security measures truly are necessary doesn't happen, or the one(s) recommending them cannot sufficiently express to the business why these measures may be required. Remember, I said "reasonable" and "sufficiently."

Regards,

valkyrie
________________________________________________
sapere aude

[Thorn]

Re: Secretary of Energy: 'Security hinders productivity'

Well, there's certainly a flipside to that argument. Does TSA requiring me to have my hair gel in 3oz containers and a 1 quart plastic bag really keep me safe?

It's really a question of whether security measures are pragmatic or simply there to give a vacuous illusion of security. Security measures can be needlessly counterproductive.

I'd agree with that, no question. I'd just hope that the head of an agency would be advocating reasonable security, and not throwing the baby out with the bathwater.

[facon12]

Re: Secretary of Energy: 'Security hinders productivity'

Where I work is pretty much a perfect example of what can go wrong when people put productivity/efficiency over security too much. Our network admin sets all of the security policies and he allows users to write down their passwords and keep them at their desks because he doesn’t want the help desk analysts to have to keep resetting people's passwords. He also reasons that most users don’t even have access to anything important or sensitive so there isn’t a great risk. (he is neither very experienced or qualified) Any time someone finds a security feature inconvenient it is usually bypassed for that user. Our network also goes down 3-5 times a month from viruses and malware getting into our system and totally bogging down our network. So far nobody in the management is making the connection but perhaps someday they will see the light.