Anonymous

South

Consultant

What a wonderful illustration that bears on many of the "security" and "control" issues that are regularly aired here. It's the old 80/20 rule writ large. Simple and relatively none intrusive actions would reduce risk massively. The same is true in many other areas. (I'll lay a bet that a similar survey of whether systems apply, or not, simple, sensible password rules would produce very similar results!) To get risk down to acceptable levels we do not need deeply refined and heavily controlling practices - we just need to apply common sense good practice consistently.
People like Citrix (massive self interest obvious) and lots of security consultants will continue to peddle costly "solutions" that that are overkill. If the risk of harm from the loss of a locked, encrypted, laptop is, say 1 in 1,000,000 (probably rather less in fact) then implementing, let's say, Citrix as well, whilst, for prudence' sake also locking and encrypting laptops, would improve it to what? And would that improvement, be REALLY worth the effort? And cost ?? extra for ever and a day?
Let's have more applied common sense, less high-techno enthusiasm and less hysteria!