A UK school IT staffer faced significant resistance when attempting to implement basic security measures, including a strong password policy, following a devastating ransomware attack. The incident highlights the challenges of enforcing cybersecurity best practices within organizations, as first reported by The Register.
A ransomware attack crippled a UK school's network for three months, forcing a rebuild from outdated backups. The subsequent IT manager, Daniel, discovered a critical vulnerability: the password policy required only six letters with no complexity or expiry. Users had not changed passwords since before the attack, and one data manager openly admitted to using the same password since 1998, writing it on a piece of paper taped to her desk. Despite Daniel's efforts to enforce a stronger policy, including immediate password changes, he faced backlash from staff and ultimately the principal, who ordered him to revert the changes. The principal later left, and the new management reinstated Daniel's policy, leading the data manager to take early retirement rather than comply.
Source: The Register
