IT security people should maintain a negative view of users.

• A. True
• B. False
• C. Sometimes
• D. Never

Answer: (B)

In IT security, the focus is on enabling legitimate work while reducing risk, not on sneering at users. People are the most common source of security incidents because of mistakes or social engineering, but that doesn’t mean they are inherently untrustworthy. The right mindset is to design systems that minimize harm regardless of intent—trust but verify—through strong controls and good processes.

This means applying least-privilege access, need-to-know principles, and robust authentication (like MFA), along with regular onboarding/offboarding, monitoring, and incident response. Equally important is security awareness training and phishing simulations so users can recognize risky scenarios and act appropriately. When users feel supported and trusted, security practices are more likely to be followed, and culture improves, which strengthens overall protection.

So, the statement isn’t accurate because it promotes a negative, adversarial view toward users. A balanced approach—trust users to perform their roles while implementing layered safeguards and education—yields a more effective and practical security posture.