Malpractice in Information Security?