@nasimson:

I agree with your theory of relative advantage (if I may call it that). In order to remain safe in the future we will have to step up and compare ourselves to the hackers. If our standards and protocols are effective and they fend the hackers than we must continously strive to improve them. Because the hackers are continuously trying to break them. It is kind of a cat & mouse game. 

I agree with this statement. It's great to see a leader take responsibility for this, although I have a hard time believing that it was really his fault. Sure, he was the person who was in charge of things, but how much do you think that this guy actually knows about IT security? It's not his expertise. The problem here is that the person whose job it was to take care of things like this obviously dropped the ball big time. Time to clear house. 

The lessons you identify are spot on and those in responsibility must understand them.

The IT security failure you describe is a serious one, but a good lesson for others to sit up.

Make no mistake about it: the Director was the scapegoat.  Everybody else gets to keep their jobs, and he's out on the street, and with that well-publicized failure tied to his name to boot.  They should have cleaned house while they were at it, and assured that those who failed to encrypt, those who allowed single-party changes to access levels, and those who allowed inadequate training to continue were all removed (and preferably nailed to the barn door as a warning to others).  Falling on your sword is very noble, but not exactly fair.  Let's ignore the bowing and scraping, and concentrate on what's being done to fix the barn door, now that the horse has gotten out.

Do you seriously think this will teach lessons for users related to security issues ? I do not think so since if they were to learn there were so many big incidents than this in the past but still the valunerability towards security and personal data is rising daily.

And how interesting is it that every post so far reacts positively to the Gov rather than going down the all too familiar path of Deny Deny At All Costs instead takes to the great state of SC  will eat humble pie with some crow thrown in for good measure.

You would think that the main thrust of Kim's blog was the Governor's reaction to the security breach. And I thought political posturing ended a couple of wks ago.

indeed by accepting your mistakes and accepting your own flaws you make it easier for yourself and your organization to earn back its lost reputation.  The resignation of the Director, i hope, will result in some positive changes for the South Carolina's IT Security. They should recover from their flaws and do changes in their systems as soon as possible by  increasing the security and hiring  more IT professionals who are working in advance security ideas to keep their data secure. 

How often do the officials admit their mistakes in the States, I am wondering, because  in Russia, they never do this.They are extremly talented in fiding  a guilty one.

It is refreshing to see officials admit error and take responsibilty for errors and omissions. I wonder how the department heads will be affected and how many scape goats will be found to place blame upon in the situation.