In the government’s telling, the school routinely missed compliance obligations in large part because the researchers found dealing with security protocols “burdensome.” And when the researchers complained, admins gave in.
This is a good motivator, security is important, and there will always be a spectrum between convenience and security, and it’s easy to drift too far down to the dangerously convenient side of the spectrum.
This Georgia Tech lab got dangerously convenient security policies, lied about it, got ratted out, and now is the government’s displayed example.
Now it’s either getting pwned or getting sued, instead of just risking the former. Hopefully this will motivate more people to take security more seriously, especially when hosting sensitive data, and especially when accepting federal government money.
It’s a well written article worth reading in full
This is a good motivator, security is important, and there will always be a spectrum between convenience and security, and it’s easy to drift too far down to the dangerously convenient side of the spectrum.
This Georgia Tech lab got dangerously convenient security policies, lied about it, got ratted out, and now is the government’s displayed example.
Now it’s either getting pwned or getting sued, instead of just risking the former. Hopefully this will motivate more people to take security more seriously, especially when hosting sensitive data, and especially when accepting federal government money.
Admins don’t give in though, they just do what they are told. Management gave in.