RE: Scare Me !!

[andrew.c.howard () exxon com]

I am sure the list will be forthcoming soon enough, but I recommend that, instead of targeting one after another of 
exec, tech, etc, you target the top decision maker.  That is, the executive sponsor of the company security policy.  It 
sounds like you don't have a policy.  If you don't have a policy, then maybe a risk assessment hasn't been done.

Until management understands or at least sees how and by how much the bottom line can be affected (results of a risk 
assessment), then they won't see a need for a policy (a map of the controls for the risks).  Without a policy (the 
rules and consequences), then "enforcement" is a moot issue.  Good luck.  It can be a tough battle!!!!
---------Andy Howard   :-)
*      andrew.c.howard () exxon com <mailto:andrew.c.howard () exxon com> 

        -----Original Message-----
        From:   Ken Hardy [SMTP:ken () bridge com]
        Sent:   Thursday, June 10, 1999 12:01 PM
        To:     firewall-wizards () nfr net
        Subject:        Scare Me !!

        I need to induce a healthy respect for Internet dangers into
        some folks around here.  I know the dangers, or enough of them,
        but it's wearing to try to educate one after another exec,
        network tech, etc.