RE: in-to-out security
- From: "Joe George" <j.george@xxxxxxxxxxxxxxxx>
- Date: Wed, 29 Mar 2006 10:54:30 -0500
Great! Thanks for all your feedback. I think I have enough information
from the security community to get something going. The risk assessment
suggestion would probably prove to be the best place to begin. I think
his managers need to know in a language they understand as to the
dangers of not having at least some policy in place. Just like Kenton
mentioned, it is a starting point toward a security plan.
Take care,
Joe
-----Original Message-----
From: Kenton Smith [mailto:listsks@xxxxxxxx]
Sent: Tuesday, March 28, 2006 6:00 PM
To: Joe George; security-basics@xxxxxxxxxxxxxxxxx
Subject: Re: in-to-out security
--- Joe George <j.george@xxxxxxxxxxxxxxxx> wrote:
<snip>
1. Was I right to suggest this rather than help myYes, I would never agree to secure someone's network without there being
colleague look
for an app/training solution?
applicable policies in place first. If there is no policy you have no
starting point from which to come up with a security plan.
2. How would you convince an obviously passive CTOCheck the law. I know you've asked this further on but this may be the
to do the right
thing?
only way to get through to this guy.
The only other thing I can think of is that if they expect their
employees to trust and respect management, then management has to do the
same thing in return. Tell them what you're doing up front. The people
who are really against it might quit, but the ones left behind are
probably the ones who are already using the company's resource properly.
3. If such an application/training exists, can youThere are many companies that offer both software and training programs
suggest
something?
in user awareness. I don't know any off-hand but Google will find a
bunch.
4. Is it legal to implement user-monitoring withoutThis would be something that he'd have to investigate.
informing the
staff? This is where I think policy
I am not a lawyer and the laws vary from state-to-state. I'd be very
surprised though if there isn't a precident saying that you at least
have to tell people you're monitoring them.
Kenton
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
- Prev by Date: RE: application for an employment
- Next by Date: SF new interview announcement: Open source security testing methodology
- Previous by thread: RE: in-to-out security
- Next by thread: Deploying SSL-based VPNs
- Index(es):
Relevant Pages
|
|
