Penetration Testing mailing list archives
Re: Skype use obligation - Security x Productivity
From: Doug Schlachta <iccnt () yahoo ca>
Date: Tue, 17 Jul 2007 05:16:56 -0700 (PDT)
Marcio, I have also run into the same dilemma with the usage of Skype, I did find one possible solution, that is a phone based Skype appliance. The main advantage of this appliance product is that there is no vulnerability in giving Skype access to the internal network as it in utilized via the PBX or any form of telco system. Check out this link for more information. http://www.industrydynamics.ca/ In there look at the Skype for Enterprise. I found this product very interesting and not infringing upon any ISO Certifications. Regards Douglas Schlachta CISSP, SSCP, MCSE;Security, MCSE, CFOT Senior Security Professional ----- Original Message ---- From: M.B.Jr. <marcio.barbado () gmail com> To: pen-test list <pen-test () securityfocus com> Sent: Monday, July 16, 2007 5:56:12 PM Subject: Skype use obligation - Security x Productivity Gentlemen, Iam part of a Brazilian Information Security consultancy focused on the SMB market segment and we're facing sth new. We're used to see some companies offering partnership transactions through web apps but this time we're dealing with the obligation of sheltering a new service. Some backgound: one of our customers has its network pretty restricted, following ISO 27001 and ISO 17799 that is to say, all of the services within their network were carefully chosen and deployed. Their network itself was meticulously designed. Now, one big partner they have is forcing them to install Skype in order to keep'em up to receive new business opportunities. Well, Skype is against their policies. I was asked about how hazardous this could be to their network and I said: "no, Skype is not ok because it lacks transparency concerning your firewalls, bridges, proxies and etc." Not to mention its port agile features. But, did not give one final word yet... The network's stability is my team's responsibility. What to do? Risk their efforts in obtaining ISO certification? Guess we need to hear some other professionals. Thank you, any comment will be extremmely useful. -- Marcio Barbado, Jr. ============== ============== ------------------------------------------------------------------------ This List Sponsored by: Cenzic Swap Out your SPI or Watchfire app sec solution for Cenzic's robust, accurate risk assessment and management solution FREE - limited Time Offer http://www.cenzic.com/c/wf-spi ------------------------------------------------------------------------ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Swap Out your SPI or Watchfire app sec solution for Cenzic's robust, accurate risk assessment and management solution FREE - limited Time Offer http://www.cenzic.com/c/wf-spi ------------------------------------------------------------------------
Current thread:
- Re: Skype use obligation - Security x Productivity, (continued)
- Re: Skype use obligation - Security x Productivity Mister Dookie (Jul 20)
- Re: Skype use obligation - Security x Productivity Javier Reyna Padilla (Jul 17)
- RE: Skype use obligation - Security x Productivity Pradeep-Kumar . Karavadi (Jul 17)
- Re: Skype use obligation - Security x Productivity Roland Dobbins (Jul 17)
- Re: Skype use obligation - Security x Productivity Cedric Blancher (Jul 17)
- Re: Skype use obligation - Security x Productivity Roland Dobbins (Jul 17)
- Re: Skype use obligation - Security x Productivity Justin Ferguson (Jul 20)
- Re: Skype use obligation - Security x Productivity Roland Dobbins (Jul 20)
- Re: Skype use obligation - Security x Productivity Cedric Blancher (Jul 17)
- Re: Skype use obligation - Security x Productivity Cedric Blancher (Jul 17)
- RE: Skype use obligation - Security x Productivity aSEC (Jul 20)
- Re: Skype use obligation - Security x Productivity Doug Schlachta (Jul 17)