Date: Tue, 11 Aug 92 09:01:16 PDT From: jmcarli@SRV.PACBELL.COM(Jerry M. Carlin) Subject: File 4--Bell System Policies (Jerry's Response 2) > From zygot!john@apple.com Mon Aug 10 17:48:25 1992 > > jmcarli@SRV.PACBELL.COM(Jerry M. Carlin) writes: > [Lots of stuff about how Bellcore and Pac*Bell give major lip service > to security.] I don't consider spending tens of millions of dollars over the past few years as "lip service". If you wonder what on: such things as RACF for MVS is not cheap. SecureID cards cost quite a bit when multiplied by 10,000 people. Getting lots of shredders costs money. Could we have spent it more wisely. Of course, but what else is new. IMHO we've done pretty well. > But the truth of the matter is that while Bellcore may have written a > book on the matter of security, it apparently forgot to read it. Even > to this day, it is more or less a trivial matter for a knowledgeable > person to get into things he shouldn't. It's neither easy nor quick to plug all the holes in 'swiss cheese'. The point I'm trying to make is that we've been working on it for a number of years and are continuing to work on it and that we've made good progress. > ... Good for you. It is about time. Why has it taken so long? Some of the reasons are our fault and some are not. We have been yelling at vendors to deliver operating systems with adequate security features and bug fixes for a number of years now. I'm REALLY tired of having stupidities like /etc/hosts.equiv "+" and initial ID's without passwords forcing us to do work we should not have to do to clean it up. Some of the problems require new technology. We REALLY want Kerberos and/or OSF DCE but they are not ready yet. We're just getting to the point of having secure SNMP. When the protocols are full of security holes it makes it kind of difficult to have true security. By the way, my personal opinion is that the biggest security problem is people. We can have the most secure systems in the world, and they can even be maintained in a secure state but one successful "social engineer" can knock all of that into a cocked hat. It is a non-trivial problem to make sure that all legitimate calls from one employee to another get responded to without delay while at the same time catching all those trying to talk employees out of confidential information or into opening up some access in the name of a (bogus) emergency. There is a public trust issue here. If someone gets the unlisted number of a public figure and then uses that to harass the person, it's a serious matter. If the 911 service is disrupted lives are at stake. If someone's conversations are intercepted illegally, we've violated an expectation of privacy if not various laws. While I obviously believe that John is overemphasizing the negative, his feeling that security is vital and that we need to finish the job is one that I share. I think it is mandatory that we do so if we want to succeed in the coming era where any customer will have a choice between several vendors for basic dial tone. We're getting close now with cellular and will get closer with the next generation mobile technology. Even the hard-wired local loop will be opened up. We can no longer be arrogant since "we're the phone company, after all". It's not true now and it will be less true in the future. We're "A" phone company not "THE" phone company. Downloaded From P-80 International Information Systems 304-744-2253