RE: Firewalls and IS Network bodies

[Mark Curley <mcurley () baf com>]

Actually, it should not matter which group handles it, as long
as they are willing and able to implement the security policy
of the company.  Even if they don't have the security mindset 
or know-how, it might work OK if the policy is set by people
who do and operations does the "administration" work.

However, I do realize that in some organizations there are turf
battles around this (I've seen it in a friend of mine's company).
Perhaps one way around this is to choose a firewall solution which
looks (physically and interface) more like a server and less like a
router.

Or you can argue it's an access control device and it should be
controlled by the department which handles remote access.
Or is it a productivity protection tool and it should be handled 
by HR?   
Or is it designed to protect the company from legal suits from download
of 
unauthorized software.  It should then be controlled by the Legal
Department
or the physical security guards or Procurement who handles contract?

You see what I'm getting at?  Companies have different organizational
structures and a firewall has multiple functions and affects the entire
organization.  What to do?  Some companies have a separate Firewall 
department.   Maybe you can get yourself transferred to the network
department
as the firewall administrator.

Mark Curley

> ----------
> From:         Mike van der Walt[SMTP:mvdwalt () fnb co za]
> Reply To:     Mike van der Walt
> Sent:         Thursday, December 11, 1997 7:37 AM
> To:   firewall-wizards () nfr net
> Subject:      Firewalls and IS Network bodies
>
> <<File: smime.p7s>>
> I am trying to convince my management why a security environment
> should
> retain the firewall administration.  They believe that the function
> should be handed to the networking department.
>
> What are your reasons/feelings either way?  Should I agree with them
> or
> should I continue to fight the good fight?
>
>
> Thanks,
>
> Mike