RE: Remote Access (Again)

Booth,

Yes, everything has risks.   Yes, everyone needs to assess the risks for
themselves, and decide which risks are worth taking.

However:

    1)  Setting up SSL isn't difficult, and the software is free of
          charge.  Once it's set up, it works EXACTLY the same as
          regular telnet from the user's perspective.  There are no
          drawbacks to using it instead of TELNET.

    2)  One of the key things in deciding whether a risk is worth it
          is understanding the risk.   That's why I took the time
          to explain what the problem is, so that people can judge
          for themselves.

A disgruntled employee in Accounting at my company wouldn't be able to
hurt me with Excel and Client Access.  But they WOULD be able to sniff
my LAN and get passwords for my iSeries.   Your shop may be different.
The POINT is to understand the risks, and decide for yourself rather
than make blanket statements about what you should and shouldn't be
concerned about.


On Wed, 4 Dec 2002, Booth Martin wrote:
>
>  I will not argue any of these comments.  It isn't worth it.  I would say
> this:  using this same logic in the non-internet world would result in
> companies passing policies disallowing their vehicles to use secondary roads
>  requiring employees to wear both belt and suspenders, and disallowing
> buttons (zippers would be required).  At home, you'd put steel over your
> screen doors and bars on your windows.
>
> Of course there are risks, life has risks.  We learn to use balance and
> moderation.  The real risk in the AS/400 security world isn't terrorists
> from the mideast, its disguntled employees in Accounting with Client Access
> and Excel.
>