[Dad2Angels]

That is a corporate mentality issue.

The first thing that needs to happen on that front is that the folks at the top need to grow a set and lay down concrete rules about such things that carry concrete penalties if violated.

I know this sounds harsh but once you've spent 72 hours straight cleaning up the worst of the problem and weeks afterward catching the stragglers you begin to understand the financial cost of being so lax.

[Bush2000]

The first thing that needs to happen on that front is that the folks at the top need to grow a set and lay down concrete rules about such things that carry concrete penalties if violated.

Absolutely! Rationally *implemented* corporate security policy can eliminate the vast number of threats. Trouble is, many companies either don't have such policy -- or they fail to implement it. You can't blame the vendor for that. That's just poor management.