At 12:29 PM 3/29/94, Ian Dunkin wrote:
>Actually, it occurs that in this second scenario -- a confederate of the
>baddies, perhaps a disaffected employee inside your network -- even
>authentication of outbound connections wouldn't help you: if this
>insider is `trusted' -- allowed to make outbound connections through
>(say) your telnet application gateway -- then she can if so determined
>misuse this channel anyway (eg:
No firewall can help you against a disaffected employee in all situations.
The only recourse in this case is to have a well thought out and well
spelled out security policy. This way at least the disaffected employee
knows what the consequences of their actions will be. People are always the
security problem, and sooner or later any security problem is going to turn
into a "people problem".
Ian
-----
Ian Poynter ian @
world .
std .
com
Home: (617) 338-9639 Work: (617) 621-0820
I can also be reached as ian @
dataware .
com
<Insert your favorite standard disclaimer here>
|
|
