In some email I received from Bennett Todd, sie wrote: > > 1998-04-29-12:59:54 Darren: > > > If your boss walked in tomorrow and asked you how you knew your > > firewall was protecting you, what would you use as evidence? > > I'd point to our security policy. [...] So what ? Who's verified that your security policy is any good ? Anyone ? Maybe it's just full of mumbo jumbo that looks impressive but is full of loop holes ? The need for 3rd party review simply cannot be ignored. > > Sure, there's a handful of people running around who can do this, but > > what assurance do you have that you're getting the right people? > > The same assurance you have when getting any kind of people. If you have > the expertise in house to grill the candidate, then you do; if you don't > have that expertise then evaluate candidates based on how well you like > them and the extent and relevance of their claimed experience, then > check their references carefully. This is an old problem with an old and > well-trusted solution. I don't trust the interview method. I've come across one person who was employed on the basis that they did well in cross examination but when put in the field...well...they failed mine :-) > > Do you look for ISO qualifiactions for their reporting or CISSP exams > > passed [...] > > I sure wouldn't, any more than I'd look for certificates when picking a > systems administrator, or a programmer, or anybody else. Certificates > demonstrate a desire to get certificates and a skill at getting > certificates; I've never had any use for that desire and ability. Do they ? What about cases where there's a need to get certificates in order to get business ? If you wanted to get in on a Government Contract but in order to do so you needed ISO 9000, would you decide to turn it down based on that ? In my mind, it is reasonable to expect that some certificates are there because they don't represent just a desire to get the certificates, but a desire to do the work required to get them too and a desire to meet a client's needs. Darren
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 12:57:34 PDT