Hello,
Just as organizations require SLAs from connection providers (telecomm,
network, internet, power), one (organization) should require a Security SLA.
This should be included as part-and-parcel of privacy, non-disclosure, and
SoX (or other legislative requirements for ones only organization)
Statements of Conformity.
For example:
Because of various legislative, legal, reporting and policy requirements one
performs a process and maintains a level of security, risk, privacy,
reporting and whatnot. When this process involves an outside 3rd parity one
should require that the levels of security, risk, privacy, reporting and
whatnot are maintained even by the outside organization. Also, that one can
audit the outside 3rd parity for conformance.
It is the responsibility of the "kick-off" organization to be in conformance
regardless of who, or where part of a process takes place. A SLA or
Statements of Conformity for security should be a requirement.
-----
What is the point of being all "safe and secure" and then letting an outside
3rd party with nonexistent security perform some kind of processing or
whatnot. One should require that the "safe and secure" things that are being
done by your organization are also being done by the outside 3rd party at
the same or higher level that your organization is.
Regards,
--
Jason Muskat | GCUX - de VE3TSJ
____________________________
TechDude
e. Jason@TechDude.Ca
m. 416 .414 .9934
http://TechDude.Ca/
From: Angela and Donald <info@dna-works.com>
Date: Tue, 23 May 2006 20:31:43 -0600
To: 'Jason Muskat' <Jason@TechDude.Ca>
Cc: <security-basics@securityfocus.com>
Subject: RE: Article: "Security Absurdity: The Complete, Unquestionable, And
Total Failure of Information Security."
good record with consumer data. If your local Telco can offer
99.995% uptime why shouldn't security.
Ummm, because those aren't even remotely the same thing? Because increasing
uptime does not invariably lead customers to try to circumvent that uptime
because it's too difficult to use? Because uptime will never be sacrificed
on the altar of short-term savings?
I understand and sympathize with your point but those are not even slightly
comparable metrics and you do both yourself and your clients a disservice
thinking that they are ....
Donald Wheeler
