RE: [fw-wiz] Re: Flawed Surveys [was: VPN endpoints]

MHawkins_at_TULLIB.COM
Date: 09/03/04

  • Next message: Devdas Bhagat: "Re: [fw-wiz] Re: Flawed Surveys [was: VPN endpoints] (Paul D. Robertson)" 
    To: paul@compuwar.net, Mike.Stailey@henryschein.com
Date: Fri, 3 Sep 2004 13:50:13 -0400

    Mike,

    > Mike - In CA all public companies must disclose any security breaches.

    This is not true. Security breaches WHERE CUSTOMER INFORMATION was
    compromised must be reported.

    My point is that, for an accurate picture of costs and risks to be
    developed, ALL security breaches need to be detailed and tabulated then
    analyzed by actuaries and statisticians to build up a risk matrix.

    Even CA's legislation does not do, nor was it intended, to do that.

    CA's legislation primarily is intended to indirectly protect privacy. There
    is no DIRECT incentive. It's indirect. This is same problem I was referring
    to. Hackers provide a direct incentive to organizations to protect their
    networks. Surprize, surprize, enterprizes are fairly good at protecting
    themselves from hackers. On the hand, enterprizes are AWFUL at protecting
    themselves from disgruntled employees and other internal risks.

    Until we measure ALL such risks, we shall never know where to spend our
    money.

    CA legislation is very wide of that mark.

    Mike H

    -----Original Message-----
    From: Paul D. Robertson [mailto:paul@compuwar.net]
    Sent: Friday, September 03, 2004 1:43 PM
    To: Stailey, Mike
    Cc: Hawkins, Michael; mjr@ranum.com; firewall-wizards@honor.icsalabs.com
    Subject: RE: [fw-wiz] Re: Flawed Surveys [was: VPN endpoints]

    On Wed, 1 Sep 2004, Stailey, Mike wrote:

    > Mike - In CA all public companies must disclose any security breaches.
    > Also, we now have the Sarbanes/Oxley act for publicly held companies.
    > Yes, it's got a long way to go but like in Paul's prior posts - it
    > definitely a start in the right direction.
    >
    > Anyway, that's my story and I'm sticking to it...

    Isnt' it bad though, that these regulations are coming from outside of our
    field? Shouldn't we be the ones lobbying and drafting and providing
    guidance?

    Maybe the costs will make businesses shy away from practicioners who would
    advocate more regulation, but maybe that's the revolution we need in this
    field to gain the next level of effectiveness?

    Paul
    ----------------------------------------------------------------------------
    -
    Paul D. Robertson "My statements in this message are personal opinions
    paul@compuwar.net which may have no basis whatsoever in fact."
    probertson@trusecure.com Director of Risk Assessment TruSecure Corporation
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Devdas Bhagat: "Re: [fw-wiz] Re: Flawed Surveys [was: VPN endpoints] (Paul D. Robertson)"

    Relevant Pages

    • Re: Anti-Gun Hysteria!
      ... to protect the individual - even when they know that a crime is in ... or a gun either. ... costs (and risks) outweigh the advantages TO YOU, ...
      (talk.politics.guns)
    • Re: how many obfuscate?
      ... In our case there are several things that we have to protect (database ... passwords, proprietary algorithms...) ... ASP.NET projects do not have the risks of code being decompiled like ...
      (microsoft.public.dotnet.framework.windowsforms)
    • Re: Any problem with Hi altitude driving in T?
      ... opposing law firms. ... If you do not insure around risks - then ... to protect the owners are typically closely held and ...
      (alt.autos.toyota)
    • Re: Indy Star Gun Poll
      ... # are the risks? ... Sudden Death. ... Win a Henry Lever Action .44 and protect your 2nd Amendment Rights too! ...
      (rec.guns)
    • Re: Unisaws...Are the Old Ones "Better" than the New Ones?
      ... For some folks, the costs, and risks, of buying used are not equal. ... And some, many, live in old tool hell, or so they like to imagine. ...
      (rec.woodworking)