Who stay focused? (was: [Fwd: Question])

View: New views
19 Messages — Rating Filter:   Alert me  

Who stay focused? (was: [Fwd: Question])

by Jean-Denis Gorin :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi Paul

> From: Paul D. Robertson
> Sent: Tuesday, April 14, 2009 5:34 PM
>
[...]
> Once again, I'd like to publicly state that if you want to see
> interesting threads on the list, you have to de-lurk and
> start some.  If nothing else, it'd change the Pix/Interesting
> ratio...

So, I'll start a new one ;)

Why am I now a long time lurker? Mainly because I have quit the infosec field!

After 10 years in the infosec field, 5 years ago I decided to quit infosec and
came back to infosys architecture, my original field.
>From early 90's to begin of 00's [0], I lived the raise of firewalls and DMZs...
and their doom: the eBusiness application model where Internet application where
only a front-end to internal infosys!

In those years, I concluded that there was no way to achieve a good security
awareness because people (IT people or users [1]) didn't (or didn't want to)
have a global view of IT or infosys.
And the marketing buzz words of that time were enought to convince people to
stay singleminded (and buy a 'lucky stone' firewall to protect themselves).

So, my question is: among all of you, old timer firewall wizards, how many stay
focused to infosec (and had kept a global view [2] of infosys) ?


For them willing to know why I'm still lurking FW-wiz as I have quit the field,
I'm just trying to assess how fast the IT world will collapse in case of a major
security threat... (I already know who will survive this, and how ;) ).


JDG

[0] Not Y2K compliant, so what?!?
[1] Or 'lusers' for the BOFH fans ;)
[2] Global, but not unfocused!
--
Reality is that which, when you stop believing in it, doesn't go away.
Philipp K. Dick
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Paul D. Robertson :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Tue, 14 Apr 2009, Jean-Denis Gorin wrote:

> So, my question is: among all of you, old timer firewall wizards, how
> many stay focused to infosec (and had kept a global view [2] of infosys)
> ?

I still do a great deal of infosec work.  I think my focus has been as
broad as ever, as I'm doing computer forensics, incident response, general
secrity, general IT, VoIP switches, RFID, IR training, Web hosting, a
small amount of development, CRM, networking and nature photography.


Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
paul@...       which may have no basis whatsoever in fact."
           Moderator: Firewall-Wizards mailing list
           Art: http://PaulDRobertson.imagekind.com/

_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by R. DuFresne :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 14 Apr 2009, Jean-Denis Gorin wrote:

  [SNIP]

>
> For them willing to know why I'm still lurking FW-wiz as I have quit the field,
> I'm just trying to assess how fast the IT world will collapse in case of a major
> security threat... (I already know who will survive this, and how ;) ).
>

I'm not sure it requires a security threat to being down vast areas of
the Internet, and for vast periods of time.  If either coast was hit with
a tsunami, or huge quake, or even a large storm like that which
devastated New Orleans <which still has not recovered how many years
after?>, the affects of which will be technically devastating as well.


Main question is, if the Internet is devastated, to a point it can be
'rebuilt' would the mistakes of the past be redone in the new?

Thanks,

Ron DuFresne
- --
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         admin & senior security consultant:  sysinfo.com
                         http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

These things happened. They were glorious and they changed the world...,
and then we fucked up the endgame.    --Charlie Wilson
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFJ5OSFst+vzJSwZikRAmPqAKCf9+MuXiA4zWTt3Y5DA+b4X8I89QCfQLHO
mG67d348bTLs3Tm+iCUolPA=
=2dqt
-----END PGP SIGNATURE-----
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Behm, Jeff :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Tuesday, April 14, 2009 1:22 PM, Jean-Denis Gorin so spoke:
> So, my question is: among all of you, old timer firewall wizards,
> how many stay focused to infosec

</quasi-lurker>

Don't know that I'm really a true "old-timer[1]," but...I have lived
through the waning days of Gauntlet, getting replaced by the *more*
secure (yeah, whatever) Checkpoint, getting replaced by the more
advanced (ok, cheaper) PIX/ASA. Trying to explain the benefits of App
Proxy vs. Packet Filter proxy to layer 8 is obviously futile (at least
it was in my case).

In this economy, it seems to me that unless one is in a large-to-huge
enterprise, I'd bet not many are able to focus *strictly* on only
infosec. While that's still my primary function (and has been for over a
decade), I'm not able to focus solely on that. Now, along with "infosec"
there's Windows server implementation (on VMWare, on standalone
hardware, etc.), Unix admin, infrastructure architecture, and managing a
variety of security "appliances" that, while not necessarily perfect,
are much better than before we had them.

And yes, there's always the "do the best you can with what you have to
work with" mantra, that, like it or not, does exist blah, blah, blah[2].

> and had kept a global view of infosys) ?
Global view of infosys? How can one *not* have a global view. Maybe I
take that for granted (but shouldn't), because if I had a nickel for
every time a developer/implementer could have made things better if they
would have had the "big picture" view...

Jeff

[1] Definition of "old timer", please? (or perhaps maybe I shouldn't
want to know that answer)
[2] Not trying to resurrect a previous thread of "you're either secure
or your not vs. how much security do you want to buy?"

<quasi-lurker>
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Chris Blask :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message


Jean-Denis Gorin <jdgorin@...>


> So, my question is: among all of you, old timer firewall wizards, how many stay
> focused to infosec (and had kept a global view [2] of infosys) ?


Infosec is my only focus (as much as I have any) for creeping up on twenty years.  As for keeping a global view, I like to think that is the core of my view of the field.  If it isn't about how we make things more secure *in the context of the uses that the overall systems are put to* then I'd rather spend my time talking about really weird cheeses or landscaping.

> For them willing to know why I'm still lurking FW-wiz as I have quit the field,
> I'm just trying to assess how fast the IT world will collapse in case of a major
> security threat... (I already know who will survive this, and how ;) ).


Oh, I may be proven wrong in the end, but I don't see the IT world collapsing, ever.  That may depend on the definition of "collapsing", I suppose - lots of regrettable/foolish/avoidable/nasty things happening at any given moment are always within the realm of possibility - but The Whole Thing Coming Down for any appreciable period of time is not something I expect to live to see.

> "Reality is that which, when you stop believing in it, doesn't go away.
> Philipp K. Dick"


Classic quote! :~)

-chris



     
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Skip Carter :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Tue, 14 Apr 2009 15:01:36 -0400 (EDT)
"Paul D. Robertson" <paul@...> wrote:

> On Tue, 14 Apr 2009, Jean-Denis Gorin wrote:
>
> > So, my question is: among all of you, old timer firewall wizards, how
> > many stay focused to infosec (and had kept a global view [2] of infosys)
> > ?
>
> I still do a great deal of infosec work.  I think my focus has been as
> broad as ever, as I'm doing computer forensics, incident response, general
> secrity, general IT, VoIP switches, RFID, IR training, Web hosting, a
> small amount of development, CRM, networking and nature photography.
.... what about long walks on the beach ? puppies ?


--
 Dr. Everett (Skip) Carter      Phone: 831-641-0645 FAX:  831-641-0647
 Taygeta Scientific Inc.        INTERNET: skip@...
 1340 Munras Ave., Suite 314    WWW: http://www.taygeta.com
 Monterey, CA. 93940            









_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by ArkanoiD :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message


If the final technical decision is being made by non-technical and
obviously clueless person, you seem to just work in a wrong place.
I'd quit immediately.

On Tue, Apr 14, 2009 at 02:37:59PM -0500, Behm, Jeff wrote:

> On Tuesday, April 14, 2009 1:22 PM, Jean-Denis Gorin so spoke:
> > So, my question is: among all of you, old timer firewall wizards,
> > how many stay focused to infosec
>
> </quasi-lurker>
>
> Don't know that I'm really a true "old-timer[1]," but...I have lived
> through the waning days of Gauntlet, getting replaced by the *more*
> secure (yeah, whatever) Checkpoint, getting replaced by the more
> advanced (ok, cheaper) PIX/ASA. Trying to explain the benefits of App
> Proxy vs. Packet Filter proxy to layer 8 is obviously futile (at least
> it was in my case).

_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Anton Chuvakin :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

>> > So, my question is: among all of you, old timer firewall wizards, how
>> > many stay focused to infosec (and had kept a global view [2] of infosys)

I am NOT an old-timer (heck, I use Twitter which bans me for life [of
twitter] from the ranks of old-timers...), but I want to answer it
too.

Many people get bitter and negative after doing security for a few
years - and then they BURN OUT and go do something else [1] However,
the trick is to do what [supposedly] spies [2] are trained to do when
tortured: you get to like it! Negative? Sure, I'll give you negative
:-) Cynical? Let's make Diogenes proud!

[1]  ... what about long walks on the beach ? puppies ? CRM? :-)
[2]  "Inside the Aquarium: The Making of a Top Soviet Spy" by Viktor Suvorov
--
    Anton Chuvakin, Ph.D
   http://www.chuvakin.org
http://chuvakin.blogspot.com
  http://www.info-secure.org
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Brian Loe-2 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Tue, Apr 14, 2009 at 5:10 PM, ArkanoiD <ark@...> wrote:
>
> If the final technical decision is being made by non-technical and
> obviously clueless person, you seem to just work in a wrong place.
> I'd quit immediately.
>


NO!!!!!!!!!!!!!

DO NOT QUIT!!!!!!!!!!! Have you not been paying attention to the economy?!!!!

Instead use your change management policy to request the changes you
want to make or the access a user wants. Then if bad decisions are
made by other people they are documented as to who is responsible for
the resulting evil!

I could care less what my employer wants to do, so long as I have
informed them of my opinion and accountability for their stupidity has
been assigned to someone else.
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Behm, Jeff :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Tuesday, April 14, 2009 5:10 PM, ArkanoiD said:
> I'd quit immediately.

It wasn't immediately, but I am now in a different place than I was
then. Thankfully!
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Devdas Bhagat-2 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Tue, Apr 14, 2009 at 08:22:25PM +0200, Jean-Denis Gorin wrote:
>
> So, my question is: among all of you, old timer firewall wizards, how
> many stay focused to infosec (and had kept a global view [2] of infosys) ?

I am not really an infosec person. I am more of a sysadmin who dealt
with infosec issues (and still does). My current role is dealing with
malicious registrars, spam, fixing bugs in code, database problems,
random Windows issues, crypto, DNS, security and data integrity vs
application performance, version control, system configuration management,
user problems, logging (and lack thereof), ...

I am a fairly young un here too.

Focussed? I prefer to be a generalist and let the specialists deal with
the smaller problems.

Devdas Bhagat
--
Slumdog sysadmin
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by ArkanoiD :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Well, i am one of the old-timers (yes, if you started as security professional
in mid-90s this counts as old-timer now) and i am still here.

I was too young and too idealistic those days and lost all opportunities to
get rich (there were plenty of those), so now i am still forced to work for living,
not for fun. And even that is not so easy - as i there is quite strange new breed
who do that really better.

Have you noticed those? Those guys who started in early 2000s and who are
*experienced professionals* now? They are not visionaries, nor scientists (not am
i, though), they are not bright minds either. You do not see them on any
security conferences (well, actually there *are* conferences they attend, they are
just different ones we consider boring), they do not show up on any workgroups or
technical commetees, they do not invent and more, they do not really have a clue
to stay on the leading edge (how ridiculously does it sound when applied to our
pretty conservative field, but there *is* something like that). They just do their
*carreer*. And they do it quite well, even more: they do not give a shit about who
you are and what can you do - there are other things that count, like "did you have
a senoir management job at company we do respect" (no one even cares if you performed
there good enough, the signle fact that you were there is what that counts)
and they are always welcome in the corporate world.

So i am just a loser who did not get into that pack in time and now it is too late.
I did not care about money much and i did not care about the carreer much, i just
tried to do something to make this crazy world a little bit sane. And i failed
epically. There are some positive changes like all that DLP stuff is something
we talked about for 20 years before and i guess it is something that people with clue
was talking about several other decades before. But there is nothing in those positive
changes i can count as personal achievement - that's not because the world finally
learned to leasten, that's just because everything other fails too obviously
even for this insane world.

On Tue, Apr 14, 2009 at 08:22:25PM +0200, Jean-Denis Gorin wrote:

> Hi Paul
>
> > From: Paul D. Robertson
> > Sent: Tuesday, April 14, 2009 5:34 PM
> >
> [...]
> > Once again, I'd like to publicly state that if you want to see
> > interesting threads on the list, you have to de-lurk and
> > start some.  If nothing else, it'd change the Pix/Interesting
> > ratio...
>
> So, I'll start a new one ;)
>
> Why am I now a long time lurker? Mainly because I have quit the infosec field!
>
> After 10 years in the infosec field, 5 years ago I decided to quit infosec and
> came back to infosys architecture, my original field.
> >From early 90's to begin of 00's [0], I lived the raise of firewalls and DMZs...
> and their doom: the eBusiness application model where Internet application where
> only a front-end to internal infosys!
>
> In those years, I concluded that there was no way to achieve a good security
> awareness because people (IT people or users [1]) didn't (or didn't want to)
> have a global view of IT or infosys.
> And the marketing buzz words of that time were enought to convince people to
> stay singleminded (and buy a 'lucky stone' firewall to protect themselves).
>
> So, my question is: among all of you, old timer firewall wizards, how many stay
> focused to infosec (and had kept a global view [2] of infosys) ?
>
>
> For them willing to know why I'm still lurking FW-wiz as I have quit the field,
> I'm just trying to assess how fast the IT world will collapse in case of a major
> security threat... (I already know who will survive this, and how ;) ).
>
>
> JDG
>
> [0] Not Y2K compliant, so what?!?
> [1] Or 'lusers' for the BOFH fans ;)
> [2] Global, but not unfocused!
> --
> Reality is that which, when you stop believing in it, doesn't go away.
> Philipp K. Dick
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@...
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>
> email protected and scanned by AdvascanTM - keeping email useful - www.advascan.com
>
>

_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Parent Message unknown Re: Who stay focused? (was: [Fwd: Question])

by Jean-Denis Gorin :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message


> Jeff, April 14 2009 9:38 PM

> Global view of infosys? How can one *not* have a global view.

Very easily: stuck to the graphical management interface for of
your firewalls and anti-virus solution.
That the "classical" view of infosys (sadly). If you got a
firewalls and an AV, then you are safe! (the "lucky stone"
syndrom).

> Maybe I take that for granted (but shouldn't), because if I
> had a nickel for every time a developer/implementer could have
> made things better if they would have had the "big picture"
> view...

You will be rich, and a lot of us too! :(

> [1] Definition of "old timer", please? (or perhaps maybe
> I shouldn't want to know that answer)

An "old timer" is someone who enter the field before the second
half of 90's
A "very old timer" is someone who, before mid-90's, know what
SEAL was ;)

JDG

"Reality is that which, when you stop believing in it, doesn't
go away." Philipp K. Dick.
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Devdas Bhagat-2 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Thu, Apr 16, 2009 at 08:09:05PM +0400, ArkanoiD wrote:
<snip>
>
> Have you noticed those? Those guys who started in early 2000s and who are
> *experienced professionals* now? They are not visionaries, nor scientists

Hey, I resemble that remark.

> (not am i, though), they are not bright minds either. You do not see them
> on any security conferences (well, actually there *are* conferences they
> attend, they are just different ones we consider boring), they do not show

Honestly, if I could afford to travel to a security conference (or two), I
would. At this point, all conference funding comes out of my pocket and
my personal budget is highly limited.

> up on any workgroups or technical commetees, they do not invent and more,
> they do not really have a clue to stay on the leading edge (how
> ridiculously does it sound when applied to our pretty conservative field,

That depends on what bits of infosec you consider bleeding edge. For
most applications, the security rules are fairly well known and attacks
don't change all that often.

If you can't fix the holes, and bandages don't work very well, you have
to give up and work on where you can make a change. My current areas of
focus are on outbound filtering (rather than inbound) and education.
Applying Postel's law to networks and networked applications is useful.

The nicest thing about the stock market collapse is that it is a glaring
example of bad things happening. "It would never happen to us" does not
apply in the real world.

Don't try and sell things because they are the right thing to do. That
doesn't work. Pointing out how their lack of security will impact operations
helps (You will be infected by a virus, it will try to propagate and consume
expensive internet bandwidth. You will be blocked for spamming.) Management
doesn't understand security, but they understand reputation.

Most people don't think in terms of worst case scenarios. That's what I
learnt from The Black Swan. We are exceptions to that rule. We think
almost solely in terms of rare, worst case scenarios. I have moved to
waiting for disaster to strike, and then recovering the pieces. Take
my advice and don't blow up, don't take my advice and blow up
spectacularly. If you are lucky, you will be too big to fail.

> but there *is* something like that). They just do their *carreer*. And
> they do it quite well, even more: they do not give a shit about who you
> are and what can you do - there are other things that count, like "did
> you have a senoir management job at company we do respect"
> (no one even cares if you performed there good enough, the signle fact
> that you were there is what that counts) and they are always welcome in
> the corporate world.
>
> So i am just a loser who did not get into that pack in time and now it
> is too late. I did not care about money much and i did not care about
> the carreer much, i just tried to do something to make this crazy world
> a little bit sane. And i failed epically. There are some positive changes

Meh. Epic failure is better than not trying at all. You never know when
success will happen. Or why. Or how.

Devdas Bhagat
--
Slumdog sysadmin
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by ArkanoiD :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Well, i guess role-based data control and entitlement management is something
that can (applying necessary frameworks like WS-* and embedding security
tokens into all data flow both in- and intersystem) change the security
landscape. If it ever will be applied properly. I doubt so.

On Mon, Apr 20, 2009 at 04:53:02PM +0530, Devdas Bhagat wrote:

>
> > up on any workgroups or technical commetees, they do not invent and more,
> > they do not really have a clue to stay on the leading edge (how
> > ridiculously does it sound when applied to our pretty conservative field,
>
> That depends on what bits of infosec you consider bleeding edge. For
> most applications, the security rules are fairly well known and attacks
> don't change all that often.
>
> If you can't fix the holes, and bandages don't work very well, you have
> to give up and work on where you can make a change. My current areas of
> focus are on outbound filtering (rather than inbound) and education.
> Applying Postel's law to networks and networked applications is useful.
>
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by R. DuFresne :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 15 Apr 2009, Brian Loe wrote:

>
> Instead use your change management policy to request the changes you
> want to make or the access a user wants. Then if bad decisions are
> made by other people they are documented as to who is responsible for
> the resulting evil!
>
> I could care less what my employer wants to do, so long as I have
> informed them of my opinion and accountability for their stupidity has
> been assigned to someone else.


This assumes two poiots though, that the BIG guys up there have integrity
and have taken responsiblity for their decisions.  I seldom find either f
those to be the case and have seen cases whence the "stupidity" still
rests on the techies shoulders as "they failed to properly inform me of
the error of my ways".



Thanks,

Ron DuFresne
- --
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         admin & senior security consultant:  sysinfo.com
                         http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

These things happened. They were glorious and they changed the world...,
and then we fucked up the endgame.    --Charlie Wilson
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFJ8NT2st+vzJSwZikRAoykAKDWimA7PIbs24RiAmzsF02XvxXrfQCgnrPh
idbeb9eDqgQz5WYiKjqhwDY=
=ORUK
-----END PGP SIGNATURE-----
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Parent Message unknown Re: Who stay focused? (was: [Fwd: Question])

by hermit921 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message


> From: R. DuFresne <dufresne@...>
> Subject: Re: [fw-wiz] Who stay focused? (was: [Fwd: Question])
> To: "Brian Loe" <knobdy@...>
> Cc: "Firewall Wizards Security Mailing List" <firewall-wizards@...>
> Date: Thursday, April 23, 2009, 1:52 PM
>
> On Wed, 15 Apr 2009, Brian Loe wrote:
>
> >
> > Instead use your change management policy to request
> the changes you
> > want to make or the access a user wants. Then if bad
> decisions are
> > made by other people they are documented as to who is
> responsible for
> > the resulting evil!
> >
> > I could care less what my employer wants to do, so
> long as I have
> > informed them of my opinion and accountability for
> their stupidity has
> > been assigned to someone else.
>
>
> This assumes two poiots though, that the BIG guys up there
> have integrity and have taken responsiblity for their
> decisions.  I seldom find either f those to be the case
> and have seen cases whence the "stupidity" still rests on
> the techies shoulders as "they failed to properly inform me
> of the error of my ways".
>
> Thanks,
> Ron DuFresne

I really have to agree with Ron on this.  I see this all too often:
Tech:  "If you do that, this important functionality will break."
Manager does that.  Functionality breaks.
Manager: "It is all your fault."
Tech: "I warned you that would happen."
Manager: "You didn't persuade me to not do it, so it is your fault."
Manager spreads his version of fault around the company.

hermit921


     
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by Brian Loe-2 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Fri, Apr 24, 2009 at 10:19 AM, hermit <hermit921@...> wrote:

> I really have to agree with Ron on this.  I see this all too often:
> Tech:  "If you do that, this important functionality will break."
> Manager does that.  Functionality breaks.
> Manager: "It is all your fault."
> Tech: "I warned you that would happen."
> Manager: "You didn't persuade me to not do it, so it is your fault."
> Manager spreads his version of fault around the company.
>
> hermit921

Sounds like you guys need to learn to use the email tool a little more
effectively.

I have never just advised against something verbally. I will ALWAYS
follow up a verbal comment with an email. I will copy anyone who might
be helpful or interested on that email, brief history of the
discussion thus far (i.e. "as we discussed earlier in our meeting,
after such and such was realized and such and such suggested, I
respectfully...") and, if necessary, provide evidence in support of my
argument.
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Re: Who stay focused? (was: [Fwd: Question])

by hugh.fraser :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Ultimately, though, most of us work in a business environment that's generally governed by business decisions. One of the lessons I learned long ago as a software developer is that the customer only wants good enough, not perfection, even though as a software developer I always knew I could make the product better with a bit more time.

Security's no different. There's a sweet spot somewhere between wide-open and ratcheted down so tight nobody can use it. That sweet spot is always different, and as a security professional, my job is to identify the exposures, the technology and processes to address them, and to work with management to measure the risk. Ultimately, though, I have to sell it, knowing the business climate (a tough sell these days). Sometimes the customer doesn't want to pay for the perfect solution, and I will be held partially accountable for the fallout. But if you've done the front-end work correctly, you will have identified the potential for problems up front. Hopefully, with your credibility still intact, you'll be able to use the opportunity to move closer to the ideal solution.

> On Wed, 15 Apr 2009, Brian Loe wrote:
>
> >
> > Instead use your change management policy to request
> the changes you
> > want to make or the access a user wants. Then if bad
> decisions are
> > made by other people they are documented as to who is
> responsible for
> > the resulting evil!
> >
> > I could care less what my employer wants to do, so
> long as I have
> > informed them of my opinion and accountability for
> their stupidity has
> > been assigned to someone else.
>
>
> This assumes two poiots though, that the BIG guys up there have
> integrity and have taken responsiblity for their decisions.  I seldom
> find either f those to be the case and have seen cases whence the
> "stupidity" still rests on the techies shoulders as "they failed to
> properly inform me of the error of my ways".
>
> Thanks,
> Ron DuFresne

I really have to agree with Ron on this.  I see this all too often:
Tech:  "If you do that, this important functionality will break."
Manager does that.  Functionality breaks.
Manager: "It is all your fault."
Tech: "I warned you that would happen."
Manager: "You didn't persuade me to not do it, so it is your fault."
Manager spreads his version of fault around the company.

hermit921


     
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards


_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards