Re: Point of order re: Internet Security Guidelines I-D

[[e-mail]]

	 Steve Crocker wrote:
	 Let's move further discussion of the merits and specifics of the
	 Internet Security Guidelines I-D back to the SPWG mailing list
	 ([e-mail]).  It's evident that the IAB has not accepted
	 the document in its current form and that additional work is needed.
	 The authors will make the necessary changes as soon as possible and it
	 will be resubmitted as an I-D.


I have only printed the extensive document so far and taken a very
quick glance at it. I have a feeling that the missing part to it, is
a cover explaining what "one" should do with it.

Some suggestions:

- Promote Security Knowledge trough seminars and lectures for users in general,
  special cources for sysadms and security resp persons, and industry!
- Recommend each networked organsation to establish a security policy
  with a minimi recommended checklist on what it should contain
- Suggest to implement a security service description to be part of a contract
  between a service provider and a customer. Preferably with a checklist
  on what such a contract could contain (responsibilities for each party,
  contact info for key personell, rules when an organisation may be cut
  off from the WAN (e g repeated cracking attempts from users at site)
  and rules to establish connectivity again (need for customer site to 
  document what actions they have taken...)

--mats