Francois
I'm assuming the long list of things to do are security problems that you have
found or enhancements you would like to put in.
One way of approaching this is to, create a policy for the desired state, so
that things don't occur rather than retro fit everything you got listed. Sure
create that list but put it in a risk register and make sure your manager
accepts the risk. That way he would think twice before passing it. It'll keep
if you can quantify the risk from a business point of view as management would
be more receptive to this than just technicals.
At least this way you can set guiding principals in which the network guys
could work and prevent the same problems happening everytime.
Sick at it, and if something happens and you've captured it you'll be the one
saying i told you so :)
Nhon
-----Original Message-----
From: listbounce@securityfocus.com
[mailto:listbounce@securityfocus.com]On Behalf Of Francois Yang
Sent: Thursday, 15 February 2007 8:33 AM
To: security-basics@securityfocus.com
Subject: security not a big priority?
So I have a problem and like to know what you guys think.
I'm a Security Analyst at an Education institute. A community college
to be more precise.
So I was brought on board to address security issues and work on
making this place a better place. Now the problem is.
1. I'm in the network operation team. no security group.
2. My boss doesn't seem to know much about security.
3. My boss doesn't seem to think highly of security since all my
projects seems to be of low priority.
4. I have a long list of things that needs to be done and they are all
waiting for the engineers to work on it. But again they have better
things to do.
So what am I suppose to do? look for another job? :)
anyone run into this problem before?
I'm at the point where I'm not sure what to do.
Thanks.
--
If you think technology can solve your security problems, then you
don't understand the problems and you don't understand the technology.
Bruce Schneier
Any views expressed in this message are those of the individual sender, except
where the sender specifically states them to be the views of Crane Group
