Stop blaming the admins!

We (the security community) all know, and make fun of “Users”, and “Admins”. They are derogatory terms in our community. So much so, that they could almost be classified at curse words. (I can see the XKCD now: Security stick figure talking to IT stick figure. “You stupid A****“). While I neither discount their “contribution” to making my day fun, I feel that a lot of people miss an even bigger threat: Policies and Procedures, or SOP (Standard Operating Procedures).