This editorial was originally published on Oct 20, 2015. It is being re-run as Steve is out of town.

There's a piece that calls the US Office of Personal Management (OPM) data breach the biggest government hack ever. It might be, but give us a few months and I'm sure something will be bigger. After all, we constantly acquire more data, so the next breech is likely to contain more information. I'm also not sure most of us are actually getting much better at security.

There were a few notes about this that would apply to every company I've worked in. Such as the OPM not having a comprehensive list of devices and databases. I'm not sure any company does, and having worked with people that run SCOM-type systems, it's a hard problem to solve. This doesn't even cover the problems of Excel. Access, and soon, PowerBI data being scattered across systems.

However there was one problem I think we could fundamentally improve in most companies. The article noted that OPM didn't have control over how it's systems were configured, meaning an attacker could reconfigure things. Far, far too many companies allow a (too) large group of people to deploy changes to servers. Even when larger companies limit rights for developers, I've too often seen operations staff log in and allow developers to change systems to get them working.

As an industry, we really need to solidify and build better systems for ensuring the security of our hardware and software and preventing, or detecting, unauthorized changes. Certainly there will always be social engineering and other techniques that bypass security, but we should be able to prevent malicious changes to systems with solid architectures from our vendors/FOSS developers. We should also decide upon, and be sure, that our staff learn, understand, and follow, best practices.