As you have probably gathered from some of my posts, I work as the IT resource for a small business. The wonderful (and terrible) thing about this is I have to be able to manage just about every aspect of the technologies we use. This means I rely a lot on contacts I make as well as, of course, Google and other search engines.

On that note, I found a really great post titled ‘How to Suck at Information Security‘ which is a pretty consise list of what not to do. While the list focuses on security, the lessons learned here are that nobody is above the established policy (i.e. don’t make exceptions) and don’t trust your users. The second point sounds harsh, but if you are in the IT field, you are expected to know certain things that normal users would not consider, so going back to the first lesson set a policy and go with it.

Does anyone have anything else to add to the list?