On Thursday 10 March 2005 10:43 am, Scot L. Harris wrote:
> On Thu, 2005-03-10 at 08:40, James Wilkinson wrote:
> > Scot L. Harris wrote:
snip
> True, you have to balance the costs and convenience factors to the level
> of security you need to achieve. This normally means figuring out what
> the cost of losing your data or business means to the users. Just like
> getting users to spend money and time on backups is left as an after
> thought. Until a harddrive crashes and someones work is lost, then
> backups become a major issue, for awhile. Security falls into this same
> category when it should not.
> --
> Scot L. Harris
> webid@xxxxxxxxxx
>
> Flat tire on station wagon with tapes. ("Never underestimate the bandwidth
> of a station wagon full of tapes hurling down the highway" Andrew S.
> Tanenbaum)
IMHO
The cost of loss from malicious damage is rarely or never considered.
Along with this there is rarely a attack/crash recovery procedure in place
when it does happen.
This has (at least) a four fold effect;
1) Rarely it seems that the true culprit/source of the attack is found.
2) If they are, the evidence is so damaged so as not to allow any 'legal
recovery' of losses.
3) Usually more data is lost in recovery than should be lost.
4) An effective procedure control is found to remedy the security breach.
I have found that the average user will scream at the Sys Ad for the system
being too secure and the same user will scream at the same Sys Ad for lax
security when their data is compromised.
For my money there are two types of systems - - - those that have been 'hit'
and those that haven't been 'hit' yet.
Too few Sys Ads and I.T.'s don't deal with reality until after the fact.
Also by requireing passwords/MACS for users/machines to access servers also
helps lower any threat.
John L
