Generally, a mindset change can happen if a psuedo cause & effect situation occurs. User does not comply with procedure or standards put forth by the company, resulting in said problems with the PC – leaving the user without the tool to do his job. The catch22 is, as the person who must support my users, its in my job’s best interest to get them back up and running ASAP – so that they can continue doing their job and in turn, bring money into the company. However, should the users start seeing their tools disappear for longer stints of time – directly by their own mis-doing – then perhaps the attitudes would start to change? It’s a pretty cynical approach (the stalling of problem solving), but you are 100% correct that the change has to occur in carbon.

The landscape is changing. We in security and IT oversight have long noted that “home PCs” in the workplace were a security risk. Primarily because of the familiarity to practices which their users had grown accustomed. More specifically the notion that since this is the same OS, look and feel of what people have at home they are not “on their toes” and awake when it comes to business practices. What we found to be a common tendency involved users overlooking physical security practices on their PCs.
Among the myriad of additional weakness is the precursor to all failings in the notion that “This is MY computer”. Until we convince users that they are using a tool – much akin to a mechanic going to a tool crib for a wrench – we deal with a mentality that refuses to believe that they must conform to standards, practices or principles involving common use. I fear that the security fix may involve a great deal more work in carbon than silicon.

check us out at http://www.bit9.com