Re: [PEN-TEST] Testing a "rogue site"

["Meritt, Jim" <Jim.Meritt () WANG COM>]

Concur.  To have a system to secure, you need the system.

Has anyone noticed that the original question was totally non-technical?

There seems to be a belief that all that is involved is technical.  There is
more to it than that.  How do you write up what you find?  How do you "sell"
it (to management). The business aspects appear to be totally overlooked.

The "dot coms" thought that way.  Notice the business failures?

_______________________
The opinions expressed above are my own.  The facts simply are and belong to
none.
James W. Meritt, CISSP, CISA
Senior Information Systems Security and Audit Analyst, Information Assurance
Center of Excellence
Wang Government Services, Inc.


-----Original Message-----
From: Karyn Pichnarczyk [mailto:karyn () SANDSTORM NET]
Sent: Monday, September 11, 2000 12:47 PM
To: PEN-TEST () SECURITYFOCUS COM
Subject: Re: Testing a "rogue site"



[snip]

I totally disagree with the two rules stated above.  yes, You need your
company's written approval of your responsibilities.  But unless you go by
the One and Only rule, you will not last long in the security trade:

1. Business Must Continue.

If this rule is not followed, then it doesn't matter how good or bad
the security posture is: the company just won't exist!


[snip]