資訊安全是個非常廣大的領域,有日新月異的技術領域,有最難防的社交工程,上班十幾年了,看起來很古意的好爸爸好同事偷完商業機密之後就不知去向,水災火災你都得有應變計畫,地震颱風你都得想辦法讓單位存活。做完的事情不計其數,還沒做完的事更多如牛毛。因為,每一片雪花都認為這次的雪崩跟他無關,所以,我們只好走在每一片雪花前面,發現雪崩的可能因素,找出預防方式,避免雪崩發生。即使那雪,真的給崩了,也要在雪崩的狀況下讓自己跟公司還存活著。 現在的世界,全世界前五大的會計師事務所可以一瞬間倒閉,一間能源公司可以操控加州甚至全美的電價,一個颶風可以毀掉爵士樂天堂,不到十幾個人可以讓雙子星大樓整個倒塌,一場大雨可以讓一整個村莊滅亡,一場地震可以幾乎毀了東日本,這幾年下來我已經慢慢接受「天,真的會塌下來」...... 不錯,擔心也可以是一份工作。

2009年2月27日 星期五

Prudential on the go

This story appeared on Network World at
http://www.networkworld.com/allstar/2007/112607-prudential-mobility.html

Prudential on the go

VoIP and enterprise mobility initiatives expected to benefit traders on the floor
By Jon Brodkin , Network World , 11/26/2007

When Prudential Financial of Newark, N.J., strategizes about enterprise mobility, nobody gets left out -- whether that person is a call-center agent or a trader on the floor.












Just about any of its 40,000 employees across the globe, the company reasons, should be able to work from home or on the road just as if they were sitting in an office chair. After all, they need "to be able to respond to customers, access information, get to critical data and communicate with people, and not necessarily from the fixed position they've always been sitting at," says Jim White, a Prudential vice president and IT project leader.

To meet the company's "anytime, anywhere, anyway" goals, IT over the past year upgraded IP PBX systems and deployed new IP phones, Power-over-Ethernet switches, wireless gear and software. Doing so necessitated only a slight increase to the Prudential's IT leaders$4 million budgeted for a voice and data technology refresh to replace end-of-life products. The company wins a 2007 Enterprise All-Star Award for pushing the boundaries on convergence and mobilization for all employees.

The business units have been highly receptive, says Chuck Pagano, vice president of network design and engineering. "We're starting to integrate most of our businesses into the pilots." And, "from a recruiting and retention perspective, mobility has become a big plus in going after employees dispersed throughout the country," he says.

Increased mobility

A few thousand users across 14 U.S. sites and five international locations are benefiting from this year's upgrades, which will be rolled out across the company in three to five years. For example, since tests began in June 2006, more than 1,000 users have received IP softphones, one of the project's major components.

This lets them manage their office telephones remotely with the capabilities of a desk phone. They no longer must dial repeatedly into the system to retrieve voice mail or change voice mail greetings or pager settings because they've switched locations, for example.

Another 800 call center agents -- nearly one-third of the company's call-center operation -- use comparable agent software on their desktops. (Prudential executives wouldn't discuss which vendors they use, but IP softphone technology is available from Cisco and Avaya, among others.)

This year's work follows from Prudential's initial VoIP deployment in 2004. VoIP now extends to the company's 13 largest offices, representing most of its voice traffic. Prudential's savings, largely because of this year's PBX upgrades, have reached $60,000 per month over the cost of previous calling plans. That number is expected to grow, but it doesn't take into account other ROI factors, such as increased productivity because of rapid deployment of new customer service representatives, and cost avoidance from not having to build new call centers.

The impacts are being felt abroad, too. Prudential employees in Letterkenny, Ireland, log on to the Newark call center, letting agents make and receive calls over the IP infrastructure while controlling call-center phone features on their PCs. "All we had to do was make sure they had the appropriate software," says Dennis Marine, vice president of IS.

In addition to IP agent software and softphones, Prudential has extended IP telephony to 1,600 users and plans to expand that number to 3,000 by year-end. For example, the company has equipped its trading floors in the United States and abroad with IP trading turrets. Now traders have the flexibility of moving from one site to another. Upon logon, they get consistent functions at any floor.

Prudential also has installed 100 wireless access points for 2,000 users and is giving wireless Internet access to guests at Prudential buildings.

Beyond technology

All these technologies have been deployed at other companies. What makes the project distinctive to Prudential is the way it combined these products to give business users substantial benefits while making sure they received the training necessary for a smooth transition. Managers at Prudential weren't used to overseeing remote workers, so IT had to spend a lot of time on internal training and working with human resources departments to develop policies and procedures.

"From a technology perspective, I don't want to say it was easy, but it was simpler than the challenges that were presented when we tried to get management, as well as some of the associates, familiar with managing a virtual team," Pagano says. "That was a little intimidating for some of our managers because it's never been done before [here]."

If technology was the easy part, maybe that's why IT managers decided to give themselves a few extra challenges. Prudential made the strategic decision to make it as easy as possible for employees to use the new systems, and that meant letting users access Prudential networks with their own machines. "We were forced to support [Windows] Vista from a remote-access perspective before we were ready to support it in our enterprise," Pagano says. "That's kind of innovative. A lot of [companies] just do not allow it because of the time required for support."

CISSP是paper security?


原本是要多找cpe的來源,卻找到一個blog
http://taosecurity.blogspot.com/2005/06/cissp-any-value-few-of-you-wrote-me.html
討論,是否cissp是paper security
其中的討論相當的精采
blog作者本身也相當資深,是hacking exposed的專題作者之一,還出過其他書。

其中的重點在於,作者認為,cissp不該被認為是security的代名詞,唯一認證。另外,isc square 的認證方式有點問題,甚至2002年有個十七歲少年也獲得cissp(是誰endorse,又是誰audit的?)
在回文中有一位自稱是網路主管的認為只要是履歷上說他有cissp的人,他一概認為是菜鳥。菜鳥才需要透過考認證來獲得人事單位的青睞
其實這些人說的都是事實,但是也都是部分事實,cissp不該被過度擴大,但是他有沒有變成paper那麼嚴重?

其中有個dana就說了,technical的事情,沒有人能夠全cover,但是cissp至少能夠找到這方面的專家,他自己不見得要是專家。沒有人能 專到天荒地老的。不能因為因為一個technical上的事情一個cissp不懂,就說這些cissp都是paper。不能因為一件事否定一整個人,不能 因為一個人就否定所有通過cissp的人


當然,一個考試,一定有人想辦法tweak,盡量少花點力氣,最算沒那麼多實際經驗,也要花最少的力氣去給他pass。這方面,isc square 要多釘緊一點,錢要賺,新認證要推,audit也要做。

我自己念cissp的感想則是,這不只是個technician的view,這是個leader的view,甚至有時候是企業主的view。以前總以technician的想法在告訴企業主我們的想法,難怪沒有說服力。老闆是technician嗎?
比如說,以前會告訴企業主,該換新伺服器了,機器舊了,零件可能出問題,伺服器也被入侵裝了sniffer,一定要有另外一台新的機器來代替。

企業主說,這很嚴重嗎?


現在我就知道,我說的不是企業主的語言。我必須告訴他,我們的伺服器的風險有多大,金額有多高,停機一天的結果是多少,停機三天的結果是多少。然後,解決的方式有多少種,每一種可以降低風險多少,換算成多少錢。由於被sniffer了,玩本公司遊戲的客戶資料全被竊取,客戶若求償,有那些法條對我們不利,對本公司商譽有多少損失,以上請核示。

現在我也知道,change management是多麼重要。以前只是從實務上知道,直接在production的機器上做變更,冒的風險有多大。可是,不做,風險更大,左右是一 刀,先切比較好。但是,當人家怪罪於你的時候,講不出個道理來。人家可以罵你為什麼這麼做,也可以罵你為什麼知道問題又不做,疲於奔命,沒有個中心思想在 那裡,就是沒有說服力。於是人家打了你左臉,只能把又臉送上去,其他的全交給上帝。考了cissp把我多年來的問題都提出來了,而且給了個系統的整體概念,有了架構,說服力就有了。