Re: security not a big priority?

[Nathaniel Hall <lists () spider-security net>]

Francois Yang wrote:
> So I have a problem and like to know what you guys think. I'm a
> Security Analyst at an Education institute. A community college to be
> more precise.  So I was brought on board to address security issues
> and work on making this place a better place.  Now the problem is.
> 1. I'm in the network operation team.  no security group.
> 2. My boss doesn't seem to know much about security.
> 3. My boss doesn't seem to think highly of security since all my
> projects seems to be of low priority.
> 4. I have a long list of things that needs to be done and they are all
> waiting for the engineers to work on it. But again they have better
> things to do.
> So what am I suppose to do? look for another job? :) anyone run into
> this problem before? I'm at the point where I'm not sure what to do.
I have been in the same boat for years.  I have worked at a community
college for 3 years (3 yrs tomorrow to be exact) and I have always had
the same issues.  My bosses "understand" security, but they don't seem
to take things as seriously as I do.  Originally I started with somebody
to help me.  I began taking over the security portions of his job, and
then he left.  I have been doing 100% security for about the past 1 1/2
years.  I am the only one.

I was recently moved to another group because my immediate supervisor
decided to leave.  My new boss has said that he couldn't do security
because all security people are paranoid and don't trust anybody.  I
have tried to tell him that it isn't that we don't trust people, it is
more along the lines that we prepare for what they could do.

-- 
Nathaniel Hall, GSEC GCFW GCIA GCIH GCFA
Spider Security