Re[2]: [Theory] Time for a new FWTK? (long)

[Rick_Giering_at_mpg003 () ccmailgw mcgawpark baxter com]

Author:  Bennett Todd <bet () rahul net> at Internet
Date:    12/2/97 5:45 AM
Summary: He correctly noted that a firewall is supposed to implement a company's
security policy and that some places not only have one but enforce it as well!

I'm glad to hear you are at such a place and have the support of your 
management. I just hope it stays that way as your management changes over time 
(retirements, transfers, promotions, new hires, etc.).

But, please be aware that many organizations (companies, universities, ISP's, 
etc.) aren't that way. In fact, it's my perception that most Internet connected 
organizations aren't. This is a conjecture and one I'd like to see proven wrong!

What's the general concensus out there? Are most organizations like Mr. Todd's 
(ie. have a good, detailed security policy and enforce it on users, developers, 
and 3rd party vendors) or are they more like what I described (ie. they pay lip 
service to security, and don't really understand that it's a critical business 
issue)

Rick Giering
Note: These are opinions and have nothing to do with my employer