<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Thanks. Reading about PCI compliance
seems like it might be helpful. I see documentation about
prioritizing plans for compliance which I think implies
considering acceptable levels of risk.<br>
<br>
Starting from zero, I can imagine listing some vulnerabilities and
listing costs involved with addressing the vulnerabilities. But,
that is only one step beyond this plan:<br>
<br>
problem -> solution<br>
<br>
An example of being too conservative would be to say that people
may not attach their computers to a network. Another extreme would
be to say that authentication wastes resources that could be spent
on producing a product.<br>
<br>
Kendall<br>
<br>
On 11/20/2013 08:25 AM, Aaron Grattafiori wrote:<br>
</div>
<blockquote
cite="mid:CAFNk+g5DeZnG0ghGMiFh+qGb012sAMxzFFAXXmcygfbmR8D8aQ@mail.gmail.com"
type="cite">
<p dir="ltr">I am no standards expert, but I do work in security.</p>
<p dir="ltr">Standards can help, it varies on the starting
security level of the environment. Sometimes people need
certification and standards for reasons, other times they need.
PCI can be seen as an example. It isn't a silver bullet (as
nothing in security is) but does it help? You bet.</p>
<p dir="ltr">ISO2700, as far as I remember, is more geared toward
physical security and access vs anything technical. Someone from
Sonic could probably correct me, although I doubt they've gone
through the process for their datacenter.</p>
<p dir="ltr">Assessing risk is a complex topic, and not a
responsibly taken lightly if those decisions (or lack of) are
what provide the budget, people or time for actual security.</p>
<p dir="ltr">Hope that helps?</p>
<p dir="ltr">-Aaron</p>
<div class="gmail_quote">On Nov 20, 2013 8:13 AM, "Kendall Shaw"
<<a moz-do-not-send="true"
href="mailto:kshaw@kendallshaw.com">kshaw@kendallshaw.com</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
If this is too far off topic, sorry. It is about network
security and system administration, so it is kind of sort of
about linux...<br>
<br>
I am employed as a computer programmer. Security polices are
being developed where I work. It is not my job to deal with
the issue, but it is going to affect my ability to do work.
One major concern that I have is that it doesn't appear to me
that people understand the concept that you can never be 100%
secure.<br>
<br>
I would hope that a person tasked with establishing policies
would include a plan for assessing acceptable risks by
balancing competing factors like the need to be able to
produce a product. Do you know of any articles or books that
have concrete advice for developing a plan to assess
acceptable levels of risk within an organization? Or, do you
have any concrete advice that is general about the subject?<br>
<br>
In books about QA there are examples of the type of thing I
have been hoping to find, where it describes an outline for
designing a set of questions to apply to a given situation in
order to devise a test plan.<br>
<br>
I usually fail to convey the idea that I am asking about a
general practice, not what do I do right now about a
particular situation. For example "How do I become a pilot"
asks for advice about a practice. "How should I trap the
gopher that is in my backyard" asks for advice about a
particular situation.<br>
<br>
An example of concrete advice about a general subject is: the
ISO 27001 standard.<br>
<br>
Do you have any advice?<br>
<br>
Kendall<br>
_______________________________________________<br>
talk mailing list<br>
<a moz-do-not-send="true" href="mailto:talk@nblug.org"
target="_blank">talk@nblug.org</a><br>
<a moz-do-not-send="true"
href="http://nblug.org/cgi-bin/mailman/listinfo/talk"
target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a><br>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
talk mailing list
<a class="moz-txt-link-abbreviated" href="mailto:talk@nblug.org">talk@nblug.org</a>
<a class="moz-txt-link-freetext" href="http://nblug.org/cgi-bin/mailman/listinfo/talk">http://nblug.org/cgi-bin/mailman/listinfo/talk</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Sorry, you must accept the license.
</pre>
</body>
</html>