Questions regarding restructuring IT Dept. for room for InfoSec group.

[RoadClosed]

OK washing my hands of company politics....

It's good that you and this team are taking steps to work out your problems. That effect you described is inherent in any company that grows quickly. Even within companies new frontiers are launched that have the same effect. Keeps ya on yer toes.

[fraggin]

It's not my intent to discuss corporate hiearchy or politcs.......

I have reviewed the guideline templates on SANS.org. This is the type of information we are looking for and I thank those of you so far that have helped me along today.

[nihil]

Fraggin.......I have been fired several times......being right.......does not make you "right" in their eyes................if there is a problem...look at what the payoff for you is...you have you & yours to look after.....DO NOT TRUST ANYTHING FROM HUMAN RESOURCES.....they are scum................been there!

Good Luck

[gunit0072003]

To answer your first question, you may find helpful a white paper by Cisco on
best security practices at http://www.cisco.com/en/US/tech/tk86...8014f945.shtml

and for your second question, Network associates SnifferPro is the best protocol analyzer (IMHO) out there..Snifferpro is the GUI version of the old and well know Network general Sniffer..

Good Luck

[fraggin]

Thanks for the link Gunit. I think that it is excellent that Cisco felt the obligation to host that document. That certainly helps analyze the risk factors of our hardware infrastructure. I've used Network Assoicates only for hosting DNS, I was not aware of their sniffer. I'll have to check that our (considering we are thinking about the same Network Associates.)

And Nihil,
I hate to hear that you have been fired several times, but on the same token, I guess you live and learn eh? I've been canned a couple of times myself in the early days of getting my career started. I know the perils of HR. Some HR depts. may as well be called the "get along dept." Some HR reps take the easiest route in solving a problem and generally hate to go against the grain. I know what you are saying there. However, this Idea has been approved and is being reviewed above these ranks (for confidential reasons within and outside the co.) so I should not have too much to worry about there. But once again, I hate to litter this post with CORPORATE POLITICS, so I'll try to tone it down from here on out. Thanks for the heads up guys.

[fraggin]

Not that I'm apt to follow up my own replys. (Such would be a direct indication of Pshcitzophrenia I would assume) However, I have found a site that list the top 50 security tools by user votes. The page can be found at http://www.insecure.org/tools2000.html

[bballad]

The major sugestion I got form my head of security (besides check SANS) was to make sure some one on security understood code. Then make sure all inhouse progrmas are run through a security minded code review before they are allowed to g ointo production