Re: Ok, so now we have a firewall, we're safe, right?

["Paul D. Robertson" <paul () compuwar net>]

On Tue, 31 May 2005, Fritz Ames wrote:

> Ben,
>       Along with the part that stays the same is the part about getting a
> business to change its approach to security, or, "How does the security
> zealot at the company sell their position?"  Sure it sells faster
> (somewhat, and for a little while) when there is a traumatic event, but
> then the large-scale traumatic events, as you pointed out, have been
> mere nuisances to-date.  How does our hero pitch the solution to
> preventing anihilation by the

But you almost have to use the events to sell your approach.  Done well,
that's how you get buy-in for a security program, and then you can do all
the fire prevention you can justify...

> "Code-Red-that-steals-your-data-nukes-your-hard-drive-and-then-steals-your-wife,-and-unplugs-the-fridge
> on-the-way-out" trojan?
>       It's the  same old problem.  "Here's your new fire extinguisher
> budget..."  I get the sense that *really* going after the education of

Well, you know Halon is really better than that water stuff... my
extinguisher vendor told me so!  Oh, no- what MSDS, what pregnant
employee?

> their way into our minds.)  There's got to be some kind of candy to lure
> people in to like learning it.

2 weeks- if I recall correctly, that's the average time that password
policies stick with average workers.  Education isn't going to do it.
"Breaking" functionality is the real first step, *then* deal with
education for things you can't break properly...  but get insurance.

>       So increasing security awareness isn't directly relevant to firewall
> technology ...in the hardware sense.  But if not us, who?  If not now,
> when?  Ah!  To heck with it.  I can't make it work if better minds than
> mine haven't succeeded in this area.  Please pass the fire extinguisher...

All we can do is do all we can.  But not doing all we can isn't good
enough.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
paul () compuwar net       which may have no basis whatsoever in fact."
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards