RE: PC5250 Telnet - security and setup

Security officer and security auditor do not necessarily have to be technition. 
 Most auditors are not.  The goal is to have two trusted people one that 
changes security for the business needs and one who audits the security 
officer.  They do have to be technical enough to know how to secure your 
systems and how to audit the activities on your system.
 
Christopher Bipes
Information Services Director
CrossCheck, Inc.
 
707.586.0551, ext. 1102
707.585.5700 FAX
 
Chris.Bipes@xxxxxxxxxxxxxxx
www.Cross-Check.com <http://www.Cross-Check.com> 
 
Notice of Confidentiality: This e-mail, and any attachments thereto, is 
intended only for use by the addressee(s) named herein and may contain legally 
privileged and/or confidential information. If you are not the intended 
recipient of this e-mail, you are hereby notified that any dissemination, 
distribution or copying of this e-mail, and any attachments thereto, is 
strictly prohibited. If you have received this e-mail in error, please 
immediately notify me by e-mail (by replying to this message) or telephone 
(noted above) and permanently delete the original and any copy of any e-mail 
and any printout thereof. Thank you for your cooperation with respect to this 
matter.
 

________________________________

From: midrange-l-bounces@xxxxxxxxxxxx on behalf of Al Mac
Sent: Sun 12/11/2005 5:14 PM
To: Midrange Systems Technical Discussion
Subject: RE: PC5250 Telnet - security and setup



Is it SOX compliant to trust people?

I thought the goal was to remove technicians from the equation, which is
probably impossible, since new technologies constantly come along that need
people to understand how to do protection when using them.

>Not so much on the network but on the servers.  SSL setup is very CPU
>intensive.  What it boils down to is you have to trust people in my
>position to keep your network and data secure.  Some one has to have the
>keys to the Kingdom, hopefully someone else has the key to the journals.
>
>
>Christopher Bipes
>Information Services Director
>CrossCheck, Inc.
>
>707.586.0551, ext. 1102
>707.585.5700 FAX
>
>Chris.Bipes@xxxxxxxxxxxxxxx
>www.Cross-Check.com
>
>-----Original Message-----
>From: Colin Williams
>
>Chris,
>
>fair enough, makes sense.
>
>Just never seen SSL used on an internal network. From what you say from
>a
>security point of view, that would mean that all network traffic would
>have
>to be encrypted, to protect the CEOs password, now how much additional
>load
>is that on a network?


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.