Privacy breaches Medical IT contractor

Darkreading has an article about Verus Inc. closing doors. There are many times when security does not seem like a priority and gets ignored. Sensitive data is sent as clear text, firewalls are configured badly and web applications are deployed without any security testing done.

In a way, it's good to see that this doesn't always go unnoticed - especially when it comes to sensitive information such as medical data.

However, in the long run, it might be more important to see why a lot of companies are still not practicing basic security. Is it lack of knowledge (competence etc), or is it simply the case that most of the times implementing security is still seen as an extra?

I personally think its a bit of both.

The solution to the first problem would probably be reputation and elimination - which is what (apparently) happened to Verus Inc. However the second problem might be more tricky. This book might be particularly interesting for those interested in the subject of security and usability. In the end of the day, security needs to be built in and be easily accessible.

And for those interested in the case, if you google around you'll find posts which shed more detail.