Re: Firewall administration.

[Bennett Todd <bet () rahul net>]

On Tue, Oct 07, 1997 at 07:09:58AM -0400, Adam Shostack wrote:
> So what should a small company do?

It's an interesting question. I've been talking with a couple of small
companies lately, about this exact topic.

> They don't have the skill in house; probably can't find someone good to
> bring in as a consultant or staff member, since the big players pay more.

I don't agree with either half of that estimate.

If they don't have anyone who can read Cheswick and Bellovin then they also
don't have the expertise required to hook up to the internet, and so the
problem gets removed, or at least moved. If they're hooking themselves up,
they can do a little reading and do the security part as well as the data
comms and the routing. If they're paying someone else to do the hookup, that
someone else should be handling the security setup right along with the telco
setup and the IP routing setup and so on. It's part of the job.

If they don't have the skill in-house and can't cultivate it, _and_ they can't
find a half-way competant connectivity provider who'll handle the security as
part of the package, then, they're gonna need to go outside. I know quite a
few people who will happily do such setup for real cheap; it's not like it's
hard or takes a long time or anything.

-Bennett