🚀 go-pugleaf

In article <1992Dec14.211255.15839@lambda.msfc.nasa.gov> palmer@Trade_Zone.msfc.nasa.gov writes:
 ^^^^^^^^
You see that the following applies largely to government/military only?

>>The main job of security is to stop the user from getting his work
>>done.
>
>I disagree, security is not a win/lose scenario...granted when the
>security officer takes the easy way out when fixing a problem, the end
 ^^^^^^^^^^^^^^^^

I really don't know about installations where the security people are
officers...

>user usually loses functionality or useability.  But when the careful
>security officer carefully considers the situation, there is almost
>always a win/win solution.

...but here (academic) every "security" effort has always been
inevitably a lose/lose situation. More hassle to deal with on one
side, less usability on the other.

You run into this as soon as you start thinking, "the less I allow to
the users the less damage can/will they do", which is wrong, imho.

>It is especially important to inform the users of changes mandated by
>security requirements and to provide them with methods to perform their
>duties that are not impacted by the change.  Often the changes that are
>necessary do not impact the user at all (like activating auditing, or
>applying the NIS patch to implement "securenets").

I'm not sure about audits (at least they give the system management
more control over the users, which *can* by itself be bad, depending
on the admin people). But if the changes involve (e.g.) hiding an
entire subnetwork behind a firewall, this *does* affect the users. And
if you argue, "these particular users have all data they ever have to
deal with on their local machines and may not do anything else", well,
you're talking government, I'm talking academic. But we (academic)
have to live with people and OSs who confuse security and unusability,
too.

>System security is one of the toughest jobs I have ever performed, which
>consequently makes it one of the easiest to perform badly.

Agreed.

Olaf
-- 
| Olaf Titz - comp.sc.student  |   o     | uknf@dkauni2.bitnet | old address |
| univ. of karlsruhe - germany |  _>\ _  | s_titz@ira.uka.de   | is still    |
| +49-721-60439                | (_)<(_) | praetorius@irc      | valid       |
  "My heart is human - my blood is boiling - my brain IBM" - Mr. Roboto