<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: jobs]]></title>
    <link>http://securityratty.com/tag/jobs</link>
    <description></description>
    <pubDate>Wed, 18 Jun 2008 03:01:44 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Laptop containing personal information is stolen from U.S. Foodservice]]></title>
      <link>http://securityratty.com/article/75e76f13934090aa771da66fbd1be73c</link>
      <guid>http://securityratty.com/article/75e76f13934090aa771da66fbd1be73c</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/13/08

Organization
U.S. Foodservice, Inc

Contractor/Consultant/Branch
None

Victims
Present and former employees, &quot;and in a few instances, their...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/usfoodservice.jpg" width="146" align="right" height="71"><font size="2"><b>Date Reported: </b><br>6/13/08<br><br><b>Organization: </b><br><a href="http://www.usfoodservice.com/usf/html/index1.html">U.S. Foodservice, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Present and former employees, "and in a few instances, their dependents and applicants for jobs at USF"<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, social security numbers, home addresses, and/or dates of birth"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"We were informed recently of the theft of a U.S. Foodservice, Inc. ("USF") laptop computer, which contained sensitive personnel information."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/us_foodservice.pdf">New Hampshire State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>We were informed recently of the theft of a U.S. Foodservice, Inc. ("USF") laptop computer, which contained sensitive personnel information.<br><span style="font-style: italic;">[Evan] We now add U.S. Foodservice to the ever-growing list of organizations that refuse to encrypt laptops, yet allow confidential information to be stored on them.</span><br><br>Local authorities were immediately notified and we conducted an internal investigation.<br><br>the laptop contained certain old data files<br><span style="font-style: italic;">[Evan] I wonder how old these data files were.&nbsp; I also wonder if these files were supposed to have been removed and/or destroyed, but were missed.</span><br><br>In the course of our investigation, we determined that the laptop computer contained the names, social security numbers, home addresses, and/or dates of birth of some present and former USF employees, and in a few instances, their dependents and applicants for jobs at USF.<br><br>We are sending a notification letter to individuals impacted by this incident.<br><br>We expect to begin mailing the notification letters on June 13, 2008.<br><br>we have no indication that any of the information is being misused<br><span style="font-style: italic;">[Evan] A breach notification is almost not a real breach notification without this mention.</span><br><br>Please note that several years ago, the Company stopped using social security numbers to identify employees for internal reporting or other purposes.<br><span style="font-style: italic;">[Evan] A good move by the Company.&nbsp; USF is still required to collect Social Security numbers however.</span><br><br>Pursuant to USF policies, the laptop was protected by a unique user ID and password, but the individual files containing personal information were not encrypted or password protected.<br><span style="font-style: italic;">[Evan] I am interested in reading the USF policies.&nbsp; Do the policies only require a user ID and password to protect (or access) confidential information?&nbsp; Probably not sufficient.</span><br><br>U.S. Foodservice takes the security of your personal information seriously and apologizes for any inconvenience or worry this incident may cause you.<br><br>As a precautionary measure, we are making several services available at the Company's expense, free of charge to you, to assist you in protecting your identity.<br><span style="font-style: italic;">[Evan] A true "precautionary measure" might have been restricting confidential information storage on laptops (and other mobile media) or encryption.</span><br><br>Although at this point we have no indication that your information has been compromised<br><span style="font-style: italic;">[Evan] My definition of "compromised" obviously differs.&nbsp; In my opinion, if the confidentiality, integrity or availability of information cannot be reasonable assured, then the information IS compromised.&nbsp; If you believe that password-protection provides reasonable assurance, then you and I disagree.</span><br><br>Call the Toll Free Help Line at 1-866-584-9681 to get answer [sic] to your questions.<br></font><ul><li><font size="2">Staffed by a team of professionals</font></li><li>Monday through Friday from 6:00 a.m. to 6:00 p.m. (Pacific Daylight Time)</li><li>Saturday and Sunday from 8:00 a.m. to 5:00 p.m. (Pacific Daylight Time)<br></li></ul><font size="2"><br>Please know that while we have information security policies in place, we are reviewing those practices and procedures to see what changes need to be made.<br><span style="font-style: italic;">[Evan] Its good the USF has information security policies in place, but it doesn't mean that they are effective or that they are well enforced.&nbsp; A poorly enforced policy isn't worth the paper its written on.</span><br style="font-style: italic;"><br><span style="font-weight: bold;">Commentary:</span><br>U.S. Foodservice is also offering one year of free credit monitoring and identity theft insurance.&nbsp; This would be fine minus the fact that a Social Security number has an effective lifespan that far exceeds one year.<br><br>If only there were other controls available to protect information stored on a laptop.&nbsp; Wait, we do!<br>&nbsp;<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/05/usfoodservice.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 19:35:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/protect information">protect information</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <category domain="http://securityratty.com/tag/usf">usf</category>
      <category domain="http://securityratty.com/tag/usf policies">usf policies</category>
      <category domain="http://securityratty.com/tag/policies">policies</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://breachblog.com/2008/07/07/usfoodservice.aspx">Laptop containing personal information is stolen from U.S. Foodservice</source>
    </item>
    <item>
      <title><![CDATA[Cyber Criminals Extract Personal Details From CVs Posted Onto Job Sites]]></title>
      <link>http://securityratty.com/article/164ab2bcc5ea67793a07155ed70b759a</link>
      <guid>http://securityratty.com/article/164ab2bcc5ea67793a07155ed70b759a</guid>
      <description><![CDATA[Hackers have turned the harvesting of personal information from Monster.com and other large US jobsites into a profitable black market business. A Russian gang called Phreak has created an online tool...]]></description>
      <content:encoded><![CDATA[Hackers have turned the harvesting of personal information from Monster.com and other large US jobsites into a profitable black market business. A Russian gang called Phreak has created an online tool that extracts personal details from CVs posted onto sites including Monster.com, AOL Jobs, Ajcjobs.com, Careerbuilder.com, Careermag.com, Computerjobs.com, Hotjobs.com, Jobcontrolcenter.com, Jobvertise.com and Militaryhire.com. As a [...]]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 17:15:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/extracts personal details">extracts personal details</category>
      <category domain="http://securityratty.com/tag/russian gang">russian gang</category>
      <category domain="http://securityratty.com/tag/aol jobs">aol jobs</category>
      <category domain="http://securityratty.com/tag/cvs">cvs</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/online tool">online tool</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/monster">monster</category>
      <category domain="http://securityratty.com/tag/militaryhire">militaryhire</category>
      <source url="http://cyberinsecure.com/cyber-criminals-extract-personal-details-from-cvs-posted-onto-job-sites/">Cyber Criminals Extract Personal Details From CVs Posted Onto Job Sites</source>
    </item>
    <item>
      <title><![CDATA[The Risks of Outdated Situational Awareness]]></title>
      <link>http://securityratty.com/article/688e5a6ce78f874f822adbce407b43c9</link>
      <guid>http://securityratty.com/article/688e5a6ce78f874f822adbce407b43c9</guid>
      <description><![CDATA[It's been two months since I analyzed the proprietary email and personal information harvesting tool targeting major career web sites - &quot; Major career web sites hit by spammers attack &quot;, received...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp2.blogger.com/_wICHhTiQmrA/SHH4Ra7GKTI/AAAAAAAAB4M/5YZs0-V_YYw/s1600-h/job_sites_under_attack_1.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp2.blogger.com/_wICHhTiQmrA/SHH4Ra7GKTI/AAAAAAAAB4M/IE9cJCmdEMU/s200-R/job_sites_under_attack_1.JPG" style="border: 0pt none ;" /></a>It's been two months since I <a href="http://ddanchev.blogspot.com/2008/05/major-career-web-sites-hit-by-spammers.html">analyzed the proprietary email and personal information harvesting tool</a> targeting major career web sites - "<a href="http://blogs.zdnet.com/security/?p=1085">Major career web sites hit by spammers attack</a>", received <a href="http://www.builderau.com.au/news/soa/Seek-com-au-targeted-by-e-mail-harvesting-tool-/0,339028227,339288957,00.htm">comments from Seek.com.au</a> and Careerbuilder.com, communicated all the actionable intelligence in terms of the bogus accounts used and the related IPs to the career web sites that bothered to show interest in the attack, to come across a ghost story today - <a href="http://www.theregister.co.uk/2008/07/07/jobsite_data_hackharvesting_hack/">Jobsite hack used to market identity harvesting services</a> :<br />
<br />
"<i>A Russian gang called Phreak has created an online tool that extracts personal details from CVs posted onto sites including Monster.com, AOL Jobs, Ajcjobs.com, Careerbuilder.com, Careermag.com, Computerjobs.com, Hotjobs.com, Jobcontrolcenter.com, Jobvertise.com and Militaryhire.com. As a result the personal information (names, email addresses, home addresses and current employers) on hundreds of thousands of jobseakers has been placed at risk, according to net security firm PrevX.</i>"<br />
<br />
All your CV are <b>NOT</b> belong to us, All your CV are <b>ALREADY</b> belong to us.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Wq5OpJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Wq5OpJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=OlvJCJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=OlvJCJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Z2meJj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Z2meJj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=dAu6Uj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=dAu6Uj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NRhl7J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NRhl7J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=EsEIkJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=EsEIkJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=H1yhOj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=H1yhOj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/328887150" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 04:46:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/career web sites">career web sites</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/tool">tool</category>
      <category domain="http://securityratty.com/tag/extracts personal details">extracts personal details</category>
      <category domain="http://securityratty.com/tag/attack">attack</category>
      <category domain="http://securityratty.com/tag/online tool">online tool</category>
      <category domain="http://securityratty.com/tag/spammers attack">spammers attack</category>
      <category domain="http://securityratty.com/tag/current employers">current employers</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/328887150/risks-of-outdated-situational-awareness.html">The Risks of Outdated Situational Awareness</source>
    </item>
    <item>
      <title><![CDATA[Virtualisation - Welcome Back to the 90s.]]></title>
      <link>http://securityratty.com/article/91a97db541c7009ccb12c514e3cee018</link>
      <guid>http://securityratty.com/article/91a97db541c7009ccb12c514e3cee018</guid>
      <description><![CDATA[I've been thinking about this for a while but this blog post by Pascal Meunier pretty much sums up my feelings about Virtualisation

Back in the 90s when the Internet was new-ish and just becoming...]]></description>
      <content:encoded><![CDATA[I've been thinking about this for a while but <a href="http://www.cerias.purdue.edu/site/blog/post/virtualization-is-successful-because-operating-systems-are-weak/">this blog post by Pascal Meunier</a> pretty much sums up my feelings about Virtualisation.<br /><br />Back in the 90s when the Internet was new-ish and just becoming important all the machines running it were Unix boxes. (Maybe not all, but most). And a 386 would typically run DNS, sendmail, telnet (shell accounts), ftp and apache. All on the same box.<br /><br />Security wasn't so tight in those days but it was usually good enough and the box could happily do what it needed to do.<br /><br />Along came Microsoft and produced the idea of "one box - one service". You can't seriously consider running your domain controller as a file server. What are you thinking? And to put mail on the same box? No way. In fact, your SQL server is running under significant load, chain a few together.<br /><br />And companies would buy into this concept. Microsoft were happy - more licenses. All the PC guys were happy too - more money. More complexity - more jobs.<br /><br />Essentially what has happened now is that Moores Law has kicked in and has caught up with the complexity of Microsoft's software to the point where one server box can run multiple applications on it. Imagine that.  But Microsoft has planted the one-service-one-box concept so well that it is now part of IT law. File server and mail server on one box? But wait...whats this button over here....? Vir-vir-virtualisation.<br /><br />And now we have the tools to allow us to once again run multiple applications on one server without having to admit that one-application-one-server never made sense.<br /><br />To be fair - Virtualisation does have other advantages - running multiple Operating Systems for example, being able to easily move a virtual machine from one box to another (without configuration issues), being able to make a snapshot backup of a system.<br /><br />But running multiple applications on one box is not a huge win.<img src="http://feeds.feedburner.com/~r/SecurityThoughts/~4/325572539" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 02:37:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/server">server</category>
      <category domain="http://securityratty.com/tag/file server">file server</category>
      <category domain="http://securityratty.com/tag/server box">server box</category>
      <category domain="http://securityratty.com/tag/box">box</category>
      <category domain="http://securityratty.com/tag/mail server">mail server</category>
      <category domain="http://securityratty.com/tag/mail">mail</category>
      <category domain="http://securityratty.com/tag/multiple applications">multiple applications</category>
      <category domain="http://securityratty.com/tag/multiple">multiple</category>
      <category domain="http://securityratty.com/tag/sql server">sql server</category>
      <source url="http://feeds.feedburner.com/~r/SecurityThoughts/~3/325572539/virtualisation-welcome-back-to-90s.html">Virtualisation - Welcome Back to the 90s.</source>
    </item>
    <item>
      <title><![CDATA[SQL Server high availability when upgrading to SQL Server 2005]]></title>
      <link>http://securityratty.com/article/3ea1f41fe568a9ea63e795c330def035</link>
      <guid>http://securityratty.com/article/3ea1f41fe568a9ea63e795c330def035</guid>
      <description><![CDATA[The pursuit of minimal downtime is complex when upgrading an Active/Active cluster to SQL Server 2005/Windows Server 2003. In part three of this series, SQL Server expert Matthew Schroeder outlines...]]></description>
      <content:encoded><![CDATA[The pursuit of minimal downtime is complex when upgrading an Active/Active cluster to SQL Server 2005/Windows Server 2003. In part three of this series, SQL Server expert Matthew Schroeder outlines the stages for migrating a database to a transition server, and then the new source system. Areas covered in this tip include configuring logins, assigning permissions, transferring SQL Server jobs.<img src="http://feeds.feedburner.com/~r/WhatisEnterpriseItTipsAndExpertAdvice/~4/324219837" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 09:28:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql server jobs">sql server jobs</category>
      <category domain="http://securityratty.com/tag/source system">source system</category>
      <category domain="http://securityratty.com/tag/transition server">transition server</category>
      <category domain="http://securityratty.com/tag/activeactive cluster">activeactive cluster</category>
      <category domain="http://securityratty.com/tag/minimal downtime">minimal downtime</category>
      <category domain="http://securityratty.com/tag/tip include">tip include</category>
      <category domain="http://securityratty.com/tag/permissions">permissions</category>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/stages">stages</category>
      <source url="http://feeds.feedburner.com/~r/WhatisEnterpriseItTipsAndExpertAdvice/~3/324219837/0,289483,sid87_gci1319556,00.html">SQL Server high availability when upgrading to SQL Server 2005</source>
    </item>
    <item>
      <title><![CDATA[Googles Culture of Yes]]></title>
      <link>http://securityratty.com/article/e615947c2baeb07b85af246f8d822bd5</link>
      <guid>http://securityratty.com/article/e615947c2baeb07b85af246f8d822bd5</guid>
      <description><![CDATA[Recently, Eric Schmidt gave quite an inspirational speech at the Economic Club of Washington . It was so interesting; I wanted to share this with you in case you missed it. The entire speech is rather...]]></description>
      <content:encoded><![CDATA[<p>Recently, Eric Schmidt gave quite an inspirational speech at the <a href="http://www.economicclub.org/" onclick="javascript:pageTracker._trackPageview('/outbound/article/www.economicclub.org');" target="_blank">Economic Club of Washington</a>.  It was so interesting; I wanted to share this with you in case you missed it. The entire speech is rather long but here’s the <a href="http://fora.tv/2008/06/09/Eric_Schmidt_Explains_Google_s_Culture_of_Yes" onclick="javascript:pageTracker._trackPageview('/outbound/article/fora.tv');" target="_blank">section on Google’s Culture of Yes</a>.</p>
<p>After hearing his speech, I thought about how Eric and Google are impacting the digital revolution after so many others have tried unsuccessfully over the last 25 years. He has led the company through a period of explosive growth from $1 Billion to over $16 Billion in the past year, while keeping the young, fun, irreverent culture intact. Considering the meteoric rise of Google’s popularity in a reasonably short period of time, to the point that the company name is now actually a verb!</p>
<p>The point that I found enlightening was his summary, which you can scroll to at the 26 - 30 minutes timeframe in the presentation, where he shared an interesting glimpse into the culture of Google. “Creating more luck, giving yourself more at bats, being out there… to think big and inspire a culture of YES.” The culture of Yes inspires people to aim higher and be ambitious in their reach and goals.</p>
<p>That is a very interesting point in which I really believe. If there is one thing that all companies and especially small companies struggle with because of natural resource constraints, it is building a strong culture of Yes. We have tried to do this from the very inception of ScienceLogic, but it continues to get harder and harder the larger the business grows. To consistently inspire a principle of Yes, without agreeing to every idea that flows across my desk is amongst the most challenging parts of our daily jobs. However if I could create the perfect scenario, we would intuitively strive for a principle of Yes and inspire our associates and our ecosystem of partners and customers to use this simple concept to confidently go forward.</p>
<p>Eric says, “It is possible to build a culture around innovation. It is possible to build a culture around leadership, and it is possible to build a culture around optimism.” Google is a great example, but by no means the only example. I agree with Eric’s summary and hope to lead ScienceLogic according to these very basic but essential principles. “Let’s be revolutionaries. Let’s take this opportunity, this huge change that is before us with technology and let’s change our businesses, our communication and the way we interact on some new principles that reflect the very best in America.”</p>
<p><a href="http://sharethis.com/item?&wp=2.5.1&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Google%26%238217%3Bs+Culture+of+Yes&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fgoogles-culture-of-yes%2F06%2F2008" onclick="javascript:pageTracker._trackPageview('/outbound/article/sharethis.com');">ShareThis</a></p>]]></content:encoded>
      <pubDate>Mon, 23 Jun 2008 11:21:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/culture">culture</category>
      <category domain="http://securityratty.com/tag/googles culture">googles culture</category>
      <category domain="http://securityratty.com/tag/strong culture">strong culture</category>
      <category domain="http://securityratty.com/tag/irreverent culture intact">irreverent culture intact</category>
      <category domain="http://securityratty.com/tag/inspirational speech">inspirational speech</category>
      <category domain="http://securityratty.com/tag/speech">speech</category>
      <category domain="http://securityratty.com/tag/inspire">inspire</category>
      <category domain="http://securityratty.com/tag/consistently inspire">consistently inspire</category>
      <category domain="http://securityratty.com/tag/eric">eric</category>
      <source url="http://blog.sciencelogic.com/googles-culture-of-yes/06/2008">Googles Culture of Yes</source>
    </item>
    <item>
      <title><![CDATA[CISSP is here to stay! Sorry, Dre.]]></title>
      <link>http://securityratty.com/article/9607b0cffd1cc62c6c5a23140dc11d9a</link>
      <guid>http://securityratty.com/article/9607b0cffd1cc62c6c5a23140dc11d9a</guid>
      <description><![CDATA[Dre wrote an article in which he put the argument down that the CISSP is on its way out . What he really argues is that a &quot;generalist&quot; Information Security position is no longer very important,...]]></description>
      <content:encoded><![CDATA[Dre wrote an article in which he put the argument down  that the <a href="http://www.tssci-security.com/archives/2008/06/19/rip-cissp/">CISSP is on its way out</a>. What he really argues is that a "generalist" Information Security position is no longer very important, specialisation is the only way to go.<br /><br />I disagree. I am a CISSP and an InfoSec "generalist' but that is not why I disagree.<br /><br />I love it when I read a blog and then read another about a totally different topic but that in some way relates to the first blog. And the second blog I read today is Mr Andy, IT guy's blog. In his blog entry he complains rather tongue in cheek about <a href="http://feeds.feedburner.com/%7Er/AndyItguy/%7E3/313504123/hello-my-name-is-andy-and-i-attend.html">how many meetings he attends</a>.<br /><br />While Andy and I are many miles apart it amazes me just how similar our lives are and, yes, I also spend ages in meetings. On average I spend about 2 hours of my day <span style="font-weight: bold;">not</span> in meetings. And I love it. Every meeting that I attend makes me more educated by how the business I work for - works. I also give my input and hopefully touch on all the people just how important protecting information is.<br /><br />Just like Andy, I was a techno geek until recently. I was a Firewall specialist. A Check Point Firewall specialist. I could read the pseudocode it would chuck out. I could edit the configuration with a text editor. I could read log files. I knew the system backwards. I am now employed in a company that doesn't even have a Check Point Firewall. I have moved onto something totally different.<br /><br />There is a need for people who can configure security devices, perform active directory  magic etc, etc. Even guys who are experts in logs. But you certainly don't want these guys tied up in meetings the whole day. You want them working on the systems that they know well.<br /><br />You also want someone who can go to meetings and interface with business. Someone who can make a risk decision or at least know who to speak to. This person must be technical but also able to chat formally and informally to business and must always be thinking security. He must understand that meetings are not a waste of time but time spent educating business about security.<br /><br />It is my belief that this person is not just important for a large organisation like the one I work for but even a one person shop should have one. Obviously, in that case a consultant should be used rather than a permanent employee but it is important.<br /><br />The person does not have to be a CISSP but it is a good way to show that they are interested in an InfoSec career.<br /><br />On a related note - I, like Andy, miss the technical side of InfoSec. But I also enjoy the ability to see my larger ideas implemented. I also enjoy selling InfoSec, something I am passionate about. In short, I enjoy my job and am happy I moved from being a techie to being an analyst. They are very, very different jobs. There are some people who may not be as happy as me. I know some, they are techies and are really good at what they do and they have no want to move to anything else. They want to specialise. In South Africa, these people are not rewarded for their knowledge and that is a problem because there is a need for the specialists. Hopefully, as demand increases and there are some techies that shine, they will be rewarded.<img src="http://feeds.feedburner.com/~r/SecurityThoughts/~4/316167014" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 20 Jun 2008 07:14:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security position">information security position</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/meetings">meetings</category>
      <category domain="http://securityratty.com/tag/blog entry">blog entry</category>
      <category domain="http://securityratty.com/tag/cissp">cissp</category>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <category domain="http://securityratty.com/tag/infosec career">infosec career</category>
      <category domain="http://securityratty.com/tag/firewall specialist">firewall specialist</category>
      <source url="http://feeds.feedburner.com/~r/SecurityThoughts/~3/316167014/cissp-is-here-to-stay-sorry-dre.html">CISSP is here to stay! Sorry, Dre.</source>
    </item>
    <item>
      <title><![CDATA[Windows Enterprise Data Protection with Symantec Backup Exec]]></title>
      <link>http://securityratty.com/article/5d54ca30034a6749b87374162f39306c</link>
      <guid>http://securityratty.com/article/5d54ca30034a6749b87374162f39306c</guid>
      <description><![CDATA[Source: Symantec) With data protection becoming more distributed and IT resources increasingly constrained, businesses need a centralized data protection strategy that can manage multiple backup and...]]></description>
      <content:encoded><![CDATA[<b>(Source: Symantec)</b>  With data protection becoming more distributed and IT resources increasingly constrained, businesses need a centralized data protection strategy that can manage multiple backup and recovery jobs. Learn how to address these critical enterprise challenges with dynamic disk-based data protection.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=jnuoeB"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=jnuoeB" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/314864550" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data protection">data protection</category>
      <category domain="http://securityratty.com/tag/data protection strategy">data protection strategy</category>
      <category domain="http://securityratty.com/tag/manage multiple backup">manage multiple backup</category>
      <category domain="http://securityratty.com/tag/critical enterprise challenges">critical enterprise challenges</category>
      <category domain="http://securityratty.com/tag/symantec">symantec</category>
      <category domain="http://securityratty.com/tag/recovery jobs">recovery jobs</category>
      <category domain="http://securityratty.com/tag/resources increasingly">resources increasingly</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/businesses">businesses</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/314864550/whitepapers.do">Windows Enterprise Data Protection with Symantec Backup Exec</source>
    </item>
    <item>
      <title><![CDATA[The security sales conundrum]]></title>
      <link>http://securityratty.com/article/31f0eb835cc2663f0bb0abb53a85d23e</link>
      <guid>http://securityratty.com/article/31f0eb835cc2663f0bb0abb53a85d23e</guid>
      <description><![CDATA[I spent this week on a tour of StillSecure customers speaking to them about security, their jobs and what would make their lives easier. One thing that I heard consistently from them was that they are...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>I spent this week on a tour of StillSecure customers speaking to them about security, their jobs and what would make their lives easier.&nbsp; One thing that I heard consistently from them was that they are overwhelmed with security vendors barraging them.&nbsp; Be email, phone or postal mail it just doesn't stop.&nbsp; They don't answer their phones and don't even know where these vendors get their names. Mr Bump in a <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/06/the-used-car-sa.html#reply">recent comment on my blog about the used car salesman of NAC</a> says this is another example of why he is just fed up with sales people.</p>

<p>I hear all of this loud and clear and will be sure to pass this along to our on sales and marketing teams.&nbsp; However, it begs the question of how are security vendors supposed to contact and sell their products? Should security vendors just sit their and wait for the phone to ring with questions or orders?&nbsp; Would you prefer that all sales people are highly technical and just talk bits and bytes with you?&nbsp; How will you find out about new products and services?&nbsp; For all of the bellyaching and moaning about sales and marketing overload, it would seem that if it was not successful, vendors would not do it.</p>

<p>I would like to hear from you.&nbsp; How would you like to see vendors contact you?&nbsp; What do you think the sales process should look like? I don't think sales people want to be a pain in the butt and for the most part don't want to blow smoke up anyones butt.&nbsp; What do you think?&nbsp; Leave a comment and be heard.&nbsp; The time you save dealing with annoying sales tactics may be your own. </p>

<div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/527c4f09-f6b0-45b0-b6f7-d5b377916139/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_a.png?x-id=527c4f09-f6b0-45b0-b6f7-d5b377916139" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>
]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 04:01:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sales">sales</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/sales people">sales people</category>
      <category domain="http://securityratty.com/tag/contact">contact</category>
      <category domain="http://securityratty.com/tag/vendors contact">vendors contact</category>
      <category domain="http://securityratty.com/tag/vendors">vendors</category>
      <category domain="http://securityratty.com/tag/security vendors">security vendors</category>
      <category domain="http://securityratty.com/tag/sales tactics">sales tactics</category>
      <category domain="http://securityratty.com/tag/sales process">sales process</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/06/the-security-sa.html">The security sales conundrum</source>
    </item>
    <item>
      <title><![CDATA[The security sales conundrum]]></title>
      <link>http://securityratty.com/article/4cd96df50a1c73c0f02a6d21829ff6aa</link>
      <guid>http://securityratty.com/article/4cd96df50a1c73c0f02a6d21829ff6aa</guid>
      <description><![CDATA[I spent this week on a tour of StillSecure customers speaking to them about security, their jobs and what would make their lives easier. One thing that I heard consistently from them was that they are...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>I spent this week on a tour of StillSecure customers speaking to them about security, their jobs and what would make their lives easier.&nbsp; One thing that I heard consistently from them was that they are overwhelmed with security vendors barraging them.&nbsp; Be email, phone or postal mail it just doesn't stop.&nbsp; They don't answer their phones and don't even know where these vendors get their names. Mr Bump in a <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/06/the-used-car-sa.html#reply">recent comment on my blog about the used car salesman of NAC</a> says this is another example of why he is just fed up with sales people.</p>

<p>I hear all of this loud and clear and will be sure to pass this along to our on sales and marketing teams.&nbsp; However, it begs the question of how are security vendors supposed to contact and sell their products? Should security vendors just sit their and wait for the phone to ring with questions or orders?&nbsp; Would you prefer that all sales people are highly technical and just talk bits and bytes with you?&nbsp; How will you find out about new products and services?&nbsp; For all of the bellyaching and moaning about sales and marketing overload, it would seem that if it was not successful, vendors would not do it.</p>

<p>I would like to hear from you.&nbsp; How would you like to see vendors contact you?&nbsp; What do you think the sales process should look like? I don't think sales people want to be a pain in the butt and for the most part don't want to blow smoke up anyones butt.&nbsp; What do you think?&nbsp; Leave a comment and be heard.&nbsp; The time you save dealing with annoying sales tactics may be your own. </p>

<div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/527c4f09-f6b0-45b0-b6f7-d5b377916139/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_a.png?x-id=527c4f09-f6b0-45b0-b6f7-d5b377916139" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=6ZBu71"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=6ZBu71" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=9mKO0I"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=9mKO0I" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=KGl6LI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=KGl6LI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=5whLYI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=5whLYI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=nsunEI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=nsunEI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=k4rEsi"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=k4rEsi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=6EK4Ki"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=6EK4Ki" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/314566925" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 03:01:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sales">sales</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/sales people">sales people</category>
      <category domain="http://securityratty.com/tag/contact">contact</category>
      <category domain="http://securityratty.com/tag/vendors contact">vendors contact</category>
      <category domain="http://securityratty.com/tag/vendors">vendors</category>
      <category domain="http://securityratty.com/tag/security vendors">security vendors</category>
      <category domain="http://securityratty.com/tag/sales tactics">sales tactics</category>
      <category domain="http://securityratty.com/tag/sales process">sales process</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/314566925/the-security-sa.html">The security sales conundrum</source>
    </item>
  </channel>
</rss>
