[Paul Clark: Re: Draft Internet Security Policy ]

[Stephen D Crocker <[e-mail]>]

------- Forwarded Message

Replied: Thu, 18 Oct 90 23:34:44 -0400
Replied: "Paul Clark <[e-mail]> "
Return-Path: [e-mail]
Return-Path: <[e-mail]>
Received: from SNOW.TIS.COM by TIS.COM (4.1/SUN-5.64)
	id AA15822; Thu, 18 Oct 90 10:41:16 EDT
Message-Id: <[e-mail]>
To: Stephen D Crocker <[e-mail]>
Cc: [e-mail], [e-mail]
Subject: Re: Draft Internet Security Policy 
In-Reply-To: Your message of Wed, 17 Oct 90 17:07:23 -0400.
             <[e-mail]> 
Date: Thu, 18 Oct 90 10:41:41 -0400
From: Paul Clark <[e-mail]>

In reviewing Rich Pethia's document there appeared to be a few 
omissions. Whether these were deliberate or not I do not know.

	- Policy Section 1 part 2: It seems unclear who (users,
	  administrators, etc.) is responsible in the event
	  resources are used in an unauthorized fashion during
	  an account breakin.

	- A more general question related to the preceding is:
	  "To what extent, and under what circumstances, are 
	  operators, vendors, and users to be held accountable 
	  for breaches in security?"

	- There is no mention of penalties or enforcement
	  mechanisms within the document. As such a policy
	  statement carries very little weight. Perhaps 
	  outline of current legal remedies or other potential
	  actions would be helpful.

In general, I found the document to be properly succinct and well
organized. I would welcome responses to my criticism.

		Paul Clark

------- End of Forwarded Message