>
> Only against those that are too stupid to know how to circumvent it.
Absolutely. There will be people who will be able to circumvent your
monitoring techniques. Stenography (ascii art), encryption, etc. However,
this is true for all monitoring, so should we eliminate all computer
security techniques, because they can be circumvented. No. You would be
surprised how much internal computer crime goes on by employees that make no
attempt to conceal what they're doing.
>
> You have to ask, Why do they _need_ to monitor if employees are
> trustworthy.
The question then becomes, how do you verify an employees trustworthinees?
Give him a security clearance. That doesn't work, just look at the Wen Ho
Lee case from the US DOE.
>
> The best security is trust and nothing else even comes close.
This last line was a joke, right???!! Please tell me it was, because the
last time I looked something like 75-80% of computer crimes are internal
security breaches, meaning they were done by current or former employees.
I think unless you have some experience in monitoring and dealing with
internal computer crime, that it's hard to make a fair statement about its
applicability.
Having said that I am not one in favor of internal monitoring, at least in
the traditional way that it is implemented. However, with the proper
"Acceptable Use" policy and a strict set of guidlines, I am in favor of a
limited amount of internal monitoring, something that will catch the most
major of offences.
>
> I'm sure some sort of contract could be created that makes
> the employee
> culpable if they abuse the trust, even in the US.
Yeah, they're called laws.
>
> How do you prove someone _deliberately_ did it. There are too many
> defences to list.
You're not trying to prove anything. The goal of internal monitoring is not
so much trying to catch and prosecute offenders as much as it is trying to
mitigate their potentially damaging behavior.
> So you're suggesting, no advocating that someone should be employed to
> read all the mail and search for anything offensive or illegal.
> This is impossible for any other company with any volume of mail as
> internet censorship will thankfully always will be.
Huh? Simple string searching on mail can be done by most IDS systems, and a
lot of firewalls provide the same service, so the implementation is not
difficult. In addition, monitoring of mail has NOTHING to do with
cencorship. It doesn't work like the letters in "Catch 22". You don't
have some guy in a room somewhere reading all e-mail and blacking out the
bad words. Be practical about it. If a company wanted to do this (NOTE: I
don't agree with this), they can do a simple string search on all outgoing
e-mails for a list of keywords.
>
> Missed the point again. Hey, if the guy is good I will buy him his own
> modem. If he's not, he's out the door.
I can see that you don't have much, if any, experience in management.
Everything in a company comes down to cost.
>
> God I'm glad I don't live in the US.
So are we...:-)
Adam H. Pendleton
Manager
Security Management Center
Corbett Technologies, Inc.
Alexandria, VA
http://www.corbett-tech.com
Si hoc legere scis nimium eruditionis habes
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
