Anonymous shut down! Ringleaders brought to justice!

I believe too that the serious threat are the guys already inside the system - and what's more I know who they are....they are called IT "management".

I'm gutted Patrick. Every week I listen to your podcast and for many months and it has been motivated about getting into the security side of IT. Now I'm in what you could call a security role working for some big mutli-nationals and I'm totally disappointed. It's true that these big companies have notions of defence in depth model, they talk about compliance, procedures, and they have in there arsenal every security device under the sun. However, I've come to realise that all this infrastructure doesn't mean a thing, if the culture of the company in terms of thinking and apply security practices isn't mature enough.

So it's not hard to understand why the "hackers" are winning. In just a few months of my sec job I've experienced all this.., "we need to add and any, any accept rule to the firewall because our apps aren't working - open up the data flow, we'll look at closing it down later (which of course never happens)", " that proxy keeps getting in the way, lets create rules to bypass it","dont worry, we've only got a few infected machines with that botnet, it's too much of a hassle to clean them up", "that VPNSSL is time consuming to administer so lets make it easier and add an any rule then manage the data flow elsewhere", "we can't possibly change the passwords on all our firewall/proxy/server infrastructure, it will take too much time". It goes on.

What's worse, the managers and directors don't seem to care either. It's availability over all other considerations. The biggest surprise I've experienced is that a company bought a ton of firewalls to show the board of directors that IT is managing "risk" , only then to push out "any any accept" rules so that they don't impact on the company :) They should have saved there money and bought a switch instead.

For many companies, I get the impression that their IT security infrastructure is just a hollow symbolic sham. Additionally, it has amazed me that that half the people in an IT operations department don't understand their companies' IT infrastructure yet have the authority to make changes to it - for better of for worse.

I hope that with the Lulzsec group and the police actually catching real criminals that profit from this lack of security management will push an evolution of security culture.
Sadly, it seems to me that the security tools we have available to us today and the management of these tools just doesn't cut it.