RE: Remote Access (Again)

--
--
[ Picked text/plain from multipart/alternative ]
I am curious.  Who audits your auditor?  What satisfies you that he's not
just blowing smoke?

These guys are not computer people, they are numbers people.  They go to a
seminar or two and get a handout titled "How to show your clients you know
Internet Security" subtitled "Let Your Client's Fears of the Internet
Enhance your Bottom Line."  Then they talk about "Best Practices" which is a
global listing of the most restrictive practices they can find.

Sorry if i sound cynical, but I've heard the speech from an auditor.  He
couldn't boot DOS on his PC if it meant a new Volvo.


---------------------------------------------------------
Booth Martin   http://www.MartinVT.com
Booth@MartinVT.com
---------------------------------------------------------

-------Original Message-------

From: midrange-l@midrange.com
Date: Wednesday, December 04, 2002 03:48:02 PM
To: 'midrange-l@midrange.com'
Subject: RE: Remote Access (Again)

Ok - we've agreed to disagree.

I'm speaking from a corporate (audited business) perspective.

You're speaking from personal experience and architecture (never had auditor
tell you to do this stuff for "best practices" point-of-view).

As others have said, each business needs to analyze their needs - there is
no "one-size-fits-all" standard.

But having port 23 open to the internet without any protection is still
asking for it.

jch
--
[ IMSTP.gif of type image/gif deleted ]
--