Re: How do you become an security auditor?

["Jim Franz" <franz400@xxxxxxxxxxxx>]

>Are these people really IT people or do they follow a book of rules
>(like some support people seem to use)?

Like any profession, there are those that know what they are doing, and
those that know just enough to snow management and get paid. Security
has become the hot topic, big bucks for consulting. Anyone who can
spell "security" can call themselves a consultant. There are estasblished
methadologies, certifications, etc. The certifications tend to be general,
not
platform or hardware specific. IBM does not yet have any iSeries related
security certifications. Like Disaster Recovery, security is more than just
a single box or application. It requires a tremendous amount of planning.
A good security professional may not be able to config a Cisco firewall,
but should know how to review & determine it and your network are secure.
see the certifications at www.sans.org
my 2 cents
jim franz

----- Original Message -----
From: "Wills, Mike N. (TC)" <MNWills@taylorcorp.com>
To: "Midrange - Midrange-L (E-mail)" <MIDRANGE-L@midrange.com>
Sent: Thursday, October 24, 2002 6:48 PM
Subject: How do you become an security auditor?


> Okay, since we are on this subject (sorry, should this be on another
list?).
> Since I am only a two-year veteran in this field, I really don't
understand
> how these people can be so, ummm.... technology dumb (or is it common
> sense). Everyone on here has the tone where these people don't look at the
> basics just the complicated stuff. I don't see how anyone who knows the
> technology could ever forget that. I see passwords as the weakest link in
> security (which it is). If these auditors are really concerned. Why don't
> they educate the users? They are the ones who are the problems. Are these
> people really IT people or do they follow a book of rules (like some
support
> people seem to use)?
>
> Mike Wills
> IT Corporate Support
> Taylor Corporation
> mnwills@taylorcorp.com
> Phone: (507) 386-3187
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>