Re: Fix Security (was: Paging file)

["Patrick Botz" <botz@xxxxxxxxxx>]

If you follow the "rules and recommendations" then you can protect yourself
from others that do not follow the rules.

Nothing in the real or virtual world can be 100% secure and still useful.

The issue is not how much better or worse "security is."  This is a red
herring because the relative "goodness" of security cannot be measured.
Security is not right or wrong. It is a business decision.

The real issue is how much does it cost you to implement and maintain your
security policy from one system to another. I'll stack OS/400 up against
any other OS in this argument. So, as an example, I'd argue that OS/400
cost less to implement and maintain a security policy than Windoze because
it doesn't require an entire department of people to install and test
patches. I'd also argue that the tools we provide on the system (should you
decide to use them) cost less to use and manage than similar tools on
Windoze. Some of the tools mentioned by Ed Fishel in a previous note cannot
even be contemplated by other  commercially available OSes. Sure you have
to use them, but using them is relatively painless and cheap should you
decide to.

It is much more productive, security wise, to worry about what your
security policy is, whether your current system configuration enforces it,
and what it costs to enforce it, than it is to worry whether or not one
system has better security than another. I believe 100% OS/400 comes out on
top when security is viewed in the proper context.

Patrick Botz




                      James Rich
                      <james@eaerich.com        To:       
midrange-l@midrange.com
                      >                         cc:
                      Sent by:                  Subject:  Re: Fix Security 
(was: Paging file)
                      midrange-l-admin@m
                      idrange.com


                      10/29/2002 11:26
                      AM
                      Please respond to
                      midrange-l





On Tue, 29 Oct 2002, Steve Landess wrote:

> But if you follow the rules, you are secure!  (sorry---I had to say it!)

Yes, *you* are secure, but neither your data nor your machine is.  I'm not
too worried about what I'm going to do, I worry about what others are
doing.  And chances are they aren't following the rules.

James Rich

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.