Headlines like this really bug me. There are many facets to this problem, but at the core of it lies upper management. They seem to be stuck on the mindset that you can either be secure or you can have a successful business. Why not both? It is possible, and with a good risk management system in place, it can be a reality too.
Sure, unplug everything and burry it 100 feet underground with a hardwired self-destruct on it for ultimate security. Or, on the other hand, use 8 character passwords so non-technical users can remember them easily. Like most things, the successful businesses realize the sweet spot is the middle ground.
I worked in operations as a security person in a 150 person company. Upper management was allowed to run wild with their decisions and there was no real check in power for them. This was a systemic issue with the old CEO and it didn't get much better with the new CEO. The operations department had an executive, and he did not get along well with the executive with another business unit. So those two executives got into a chess match. Our ops executive lost. So the other executive absorbed our group and merged our two different security teams (haha, really just 2 security people, but that is a different story).
The other security guy and I knocked heads a bit, but eventually came to respect each other and get along quite well, what you would expect from a collaborative workplace where people have open minds. In the end, I learned quite a lot from the other person.
The problem was that under the new executive, he decided to change things up... you know... "for the better." That translates to myself and the other security guy (insert comments about qualifications, education, experience, technical ability here. Lets just say we are competent "qualified" security people) being paired up to conduct interviews of key staff in different departments. While this isn’t a bad thing, the devil is always in the details.
Our instructions were explicit. The executive did not want to hear anything from us. At all. No opinions, thoughts, comments, complaints, moans or groans, especially if they were security related. We were to go out and ask other people in other departments what they thought the security problems were. Write them down. Bring them back to the “architects group,” which was full of smart people, but none of them were security people. We would sit in that meeting quietly and not speak. We were to wait for them to come to a conclusion about how to fix the problems. Write that down. Bring that solution back to the people we interviewed and help them implement it. If the architects didn’t think it was a problem, then it didn’t get fixed. If they did, then the fix was to be implemented exactly as they said with zero input from the security people. In short, we were relegated to head note takers
The problem here isn’t skilled workers, it is how they are used. They could have got an intern to do those interviews, take notes, and do the follow-up. Management doesn’t know what to do with security people, and they are largely focused on business operations anyhow. While I agree to some extent that they are not wrong, after all if your security is so tight that you cant’ get anything done, then you don’t have a business. But again middle ground. That is the key.
My suggestion to managers is to talk to your security people and find out where your problems are, and work with them for solutions. There will be discussions and agreements to be made, compromises on both sides to be had, but talk to them as they really do know how to secure things.
My suggestion to security workers is to not say “no” but instead ask yourself “how could we accomplish this securely?”
Management needs to wake up and use the tools at their disposal. We are out there, and there are plenty of us. If you want a good one, you might have to pay a bit of money for it. After all, you wanted a good CEO and you paid them millions why not pay a bit more than 30k/year for a good security person and then complain there is a skills gap that needs to be closed?