8. Users do too much "tuning" of the product's functionality
Once they've got a new security product in place and properly configured, IT staffers should beware of doing so much "tuning" and customization of the product that they effectively limit its functionality, experts say. If you tinker too much with the tints and hues on your television, sometimes you can lose the whole picture.
"In larger companies with multiple administrators, what sometimes happens is that one administrator will write a 'deny all' policy that somehow ends up at the top of the policy rules," says Roeckl. "One bad policy can affect the rest of the rule set and effectively disable the whole system."
Lancope's Anderson agrees. "Sometimes, [administrators] make assumptions about what they'll need and don't need, and that will cause them to turn off important functions of the product," he says. "Some companies use a product for a long time before they become aware that some key functions have been disabled."
When an enterprise changes security administrators or staff, sometimes the new people don't understand how their predecessors have written the rules or policies in the product," Anderson notes. "The 16th rule of 200 may be the one that turns all the rest of them off," he says. "When you start changing rules, you need to understand the impact."
Some IT departments turn off key functions in their security products because their users complain that the functions make it too hard to log on or navigate the network," observes Griffin. "They may disable key security functions so they don't impact the convenience of accessing the network. It's up to the organization to assess the risk of disabling core functions in a [security] product."
Bottom line: Be sure you understand the potential impact of any change you make in the rules or settings of your security products. Experts say it's a good idea to have a third party check your security applications and appliances every 6-12 months, to ensure that you're using the full functionality of a security product and haven't turned off any core functions.
