A Buyer's Guide: The six worst security mistakes, and how to avoid making them.

Not having a security architecture
It seems like we read about an IT security infraction just about every day. This ought to be somewhat surprising, given the large amounts of emphasis placed on security over the past 25 years as measured by industry research, investments, resources, equipment, training, courses, certifications and books dedicated to the topic.

Not investing in training
Security isn’t a thing you buy and install, such as a database package or a file server. Security comes when you build a policy, then choose products and configure them to meet specific goals and counteract specific risks.

Neglecting identity management
Many midsized companies won’t consider identity management, because they think it is too difficult to deploy, too expensive to purchase and implement, and too complicated to administer and maintain.

Ignoring the insider threat
As any auditor knows, internal fraud is as old as business itself. The classic case involves the secretary who is responsible for accounts payable as well as procurement. This person generates bogus invoices and pays them to bogus companies.

Not protecting Web appliances
One of the most common and biggest mistakes that companies make is not taking the steps necessary to properly protect their Web site and Web applications.

Buying products with the most bells and whistles
The market for information-security products is huge today, with vendors competing hard for your IT dollars. The problem is that amid all the hype and all the competing products, customers frequently lose sight of the real goal: managing risk and protecting data.