RE: Security Simplification

["David Gillett" <gillettdavid () fhda edu>]

  Security is a trade-off, money/effort against risk.  Reading
between the lines, your VP is saying that *his perception of* 
the current stance is that the money/effort is too great and 
he believes that it can be reduced without increasing risk 
past acceptable levels.
  All of your current security measures SHOULD be aimed at
mitigating some risk to the business.  (Obviously, the first 
place to look for cuts is any measures that are not having 
this effect....)  So you need to identify places where the
mitigation being achieved is small, and confirm with him that
the risk associated with discontinuing those measures is 
acceptable.
  If you're lucky, you may find cases where some single measure 
can provide equivalent mitigation to what two or three measures
are currently achieving.  But it won't be an exact trade-off,
because such gains in *efficiency* usually sacrifice *depth*.

  It would help to know what part of the current security
arrangements he finds too complex.  There may be opportunities 
to shift some of the complexity between different constituencies,
such as between users and sysadmins.  What part of the picture
is he most focussed on?

David Gillett



> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of 
> oligarchicalrule () gmail com
> Sent: Wednesday, February 21, 2007 11:51 AM
> To: security-basics () securityfocus com
> Subject: Security Simplification
>
> If you were told by a VP to simplify security for your 
> organization, what you think would be a starting point?  It's 
> seems vague.  We run Windows servers/desktops that are built 
> on the same images.  We use Cisco switches/routers/etc.  I'm 
> not really sure where to start.


---------------------------------------------------------------------------
This list is sponsored by: BigFix

If your IT fails, you're out of business - or worse.  Arm your 
enterprise with BigFix, the single converged IT security and operations 
engine. BigFix enables continuous discovery, assessment, remediation, 
and enforcement for complex and distributed IT environments in real-time 
from a single console.
Think what's next. Think BigFix. 

http://ad.doubleclick.net/clk;82309979;15562032;o?http://www.bigfix.com/ITNext/
---------------------------------------------------------------------------