🚀 go-pugleaf

Greetings, fellow data security professionals.

I have been tasked by my management to investigate network security
practices & policies, and to document these findings/concerns/issues
in order to develop an appropriate security structure for my company.
Please note that these are the words of management, not me, although
I agree with their intent.

In this last year, our MIS department has opened up to connection to
"WorldNet" philosophy, that being the ability to retrieve information
from any platform to any workstation. Since the Main MIS people are IBM
Big Blue MVS-oriented, the world of Unix is new (and quite possibly scary)
to them. Thus my task, to establish what other shops are doing in order
to protect themselves and their informational assets.

I, too, am from the MVS background, with four years in as RACF administrator
(IBM's security package for mainframes). I am reading like a mad fiend
about the Unix world (sometimes surreptitiously because management wants
me to concentrate on the Big Issues :-)), and have read the FAQ. (Side note
to Alec: with your permission, I'd like to use a majority of the points
you brought up, with relevant commentary in regards to how these items
fit in with our corporate structure and thinking -- the FAQ has been a
great help, so far...)

What I need is this:

1/  What is your site doing, both overall and any specifics, towards  
    keeping your network (Unix and/or VMS) secure?

2/  How does this stack up against any "Industry Standards" that you are
    aware of?

3/  What is your corporate policy statement regarding data security?

4/  What is your greatest concern as a Data Security Administration-type?

5/  WHat other questions should I be looking into? (Please feel free to
    send me your miscellaneous ramblings on this area... I like to listen
    to ideas and open exchanges about this, that way I learn more :-))

6/  Any other informational tidbits and/or anecdotes that you'd care to
    share. No flames please.

Thank you for your answers in advance. To keep down on the posting level
in the newsgroup, these can be eMailed to me at the address in my .sig
line. If you want to chat in person, my phone number at work is (408)
749-5192.

Looking forward to hearing your input....

Brad D. Clark
Data Security Person (not official title, because company doesn't have
                      official title for this...)
Advanced Micro Devices
Sunnyvale, CA


*****************************************************************************
* PACKET - NP4AI@N0ARY.#NOCAL.CA.USA.NA *  "Go ahead, you're strong! Kill   *
*  UUCP  - clark@brahms.amd.com         *    me if you can!!"               *
*****************************************  "It'll hurt...."                 *
* The opinions experessed are solely    *         - scene from 'Yojimbo'    *
* those of the author. Honest.          *           an Akiro Kurosawa film  *
*****************************************************************************