Ultimately, though, most of us work in a business environment that's generally governed by business decisions. One of the lessons I learned long ago as a software developer is that the customer only wants good enough, not perfection, even though as a software developer I always knew I could make the product better with a bit more time.
Security's no different. There's a sweet spot somewhere between wide-open and ratcheted down so tight nobody can use it. That sweet spot is always different, and as a security professional, my job is to identify the exposures, the technology and processes to address them, and to work with management to measure the risk. Ultimately, though, I have to sell it, knowing the business climate (a tough sell these days). Sometimes the customer doesn't want to pay for the perfect solution, and I will be held partially accountable for the fallout. But if you've done the front-end work correctly, you will have identified the potential for problems up front. Hopefully, with your credibility still intact, you'll be able to use the opportunity to move closer to the ideal solution.
> On Wed, 15 Apr 2009, Brian Loe wrote:
>
> >
> > Instead use your change management policy to request
> the changes you
> > want to make or the access a user wants. Then if bad
> decisions are
> > made by other people they are documented as to who is
> responsible for
> > the resulting evil!
> >
> > I could care less what my employer wants to do, so
> long as I have
> > informed them of my opinion and accountability for
> their stupidity has
> > been assigned to someone else.
>
>
> This assumes two poiots though, that the BIG guys up there have
> integrity and have taken responsiblity for their decisions. I seldom
> find either f those to be the case and have seen cases whence the
> "stupidity" still rests on the techies shoulders as "they failed to
> properly inform me of the error of my ways".
>
> Thanks,
> Ron DuFresne
I really have to agree with Ron on this. I see this all too often:
Tech: "If you do that, this important functionality will break."
Manager does that. Functionality breaks.
Manager: "It is all your fault."
Tech: "I warned you that would happen."
Manager: "You didn't persuade me to not do it, so it is your fault."
Manager spreads his version of fault around the company.
hermit921
_______________________________________________
firewall-wizards mailing list
[email protected]
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.