Re: CRIME Computers vulnerable at Oregon department

From: Steve Layman (slayman@private)
Date: Wed Sep 25 2002 - 11:16:50 PDT

  • Next message: Mark Morrissey: "Re: CRIME Oregon Cyber Security Awareness Program for Youth Covered in Oregonian, SANS NewsBites"

    "T. Kenji Sugahara" wrote:
    
    > Steve:  "IMHO you get what you pay for. What usually happens to go one
    > step further is
    > that contracting companies with connections in Salem and usually with
    > the lowest
    > bid get the job."
    >
    > Can you think of any ideas to prevent this from happening?  This seems
    > to be one big bugaboo.  Is there a fair way to conduct RFP's?  I mean,
    > as discussed in an earlier thread, the state uses consultants when
    > acquiring technology.  Oftentimes, these consultants have a preexisting
    > relationship with a vendor, and they usually have an interest in moving
    > (through customized RFP's) business to those vendors.
    
    This is a tough issue to address and no easy solutions I can see. One first
    step might to be to get away from using consultants and hire internal so
    that the developers have the best interest of the state in mind. A way to
    control your own destiny so to speak. Clear and binding contracts are also
    a huge help. There are no easy answers and to get change implemented I
    think would be nearly impossible.
    
    >
    >
    > "As to milking the state dry... the project manager needs to have the
    > knowledge
    > to know what he/she exactly needs and to realize when they are getting
    > milked."
    >
    > Agreed.  The scope of projects need to be clearly and concretely set
    > out at the beginning.  Otherwise you end up with a lot of "feature
    > creep" and cost overruns.
    
    The project manager ideally is a state employee who agains has the best
    interest of the state in mind. The project manager needs to be technically
    savy to know exactly what he/she needs to satisfy end user requirements.
    
    >
    >
    > I do agree that there are applications where using open source would
    > unpracticable.  However, I do think that there are some applications
    > where open source could be quite useful, especially with custom
    > solutions.
    
    In the way I do business I almost always give the source code to my
    customer. Just the way I like to proceed. If I develop custom controls or
    IP the contract will clearly address this IP. But in general my customers
    get the source. I am working on a job right now where my customer did not
    get the source for a hugely buggy application and thus I am developing from
    scratch. It was a situation where he was trying to milk my customer to fix
    issues that were his for more $$$. That is just wrong. I have confidence in
    myself and my employees to say we are confident in ourselves and our
    customer service that my customer will feel comfortable coming to me to
    address any issues. She will have the source if she wants to go somewhere
    else but I have such a relationship with her that I am her only supplier.
    Alot of it comes down to customer service.
    
    >
    >
    > "The key really is to set some PRACTICAL standards, audit them
    > regularly, and force people into compliance. The only way to do this is
    > a top-down buy in  from the governor, legislature, and the various
    > turf-lords. Which means somebody has to tell these people - now is the
    > time. "
    >
    > Andrew, what sort of standards would you suggest?
    >
    > Greg:  "The open source community is unlikely to produce massive and
    > specialized software systems such as what the IRS or FAA or State of
    > Oregon need."
    >
    > But would companies that were historically non-open source produce open
    > source material to obtain a contract?
    >
    > Rob:    "You know, that wireless stuff is neat! I got one at home. We
    > could
    > really save a lot if we didn't have to run cable around the building."
    > Aghh!
    



    This archive was generated by hypermail 2b30 : Wed Sep 25 2002 - 12:07:55 PDT