Re: [perpass] "Guide to intranet protection"?

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Nov 27, 2013 at 10:43 PM, Randy Bush <[e-mail]> wrote:

> >> I'm assuming that providing meaningful protection takes a statement
> >> beyond "encrypt all your links".  Perhaps it doesn't, but I thought
> >> I'd ask...
> > I'd say that'd be a fine thing if we could get someone who'd done that
> > job to help write it.
>
> may not work out as well as we might wish, as folk who have done it may
> not want to disclose details.  but i am sure there are folk who have not
> done it who will be happy to tell others how they should run their
> networks :)
>

That is less of an issue than you might imagine.

Absent an external threat, companies see each other as competitors. An
external attack changes minds very quickly.

I don't think anyone is going to be putting a network diagram of their
datacenter on the table but that isn't really the point. It is the
processes and controls that matter, not the instances. Microsoft and Google
cooperate here to write a specification but they don't usually share source
code. And even if they do as in Chromium, it does not make a great deal of
difference as competitors don't start from the same legacy.

The number of people who move companies in the valley is very large. The
chance that any of the details are really very secret is small. NDAs stop
people blabbing about it to likely attackers, but thats about all.

The business value in sharing the information is greater than the business
value in keeping it secret.


-- 
Website: http://hallambaker.com/