Information Security Management, 2nd Edition

9.4 Contravention Behaviors, Theory, and Research

To circumvent the “weakest link” problem and prevent attacks from succeeding, managers have been incorporating more automated and mandatory security measures, such as automatically requiring users to periodically change their passwords and restricting acceptable passwords to a designated range of characters and numeric values, including case alterations and special ASCII characters. However, in practice security administrators have found it difficult if even possible to codify every conceivable security behavior in software, scripts, or other automated control mechanisms, and as we have discussed, there are times when people circumvent or neglect to implement automated countermeasures. In addition ...