pcAnywhere...Outbound Only.

Hi, We have a rule on our firewall that allows all employees to use pcAnywhere to connect to a host OUTSIDE of our network. It is in one direction...that is from inside our network to an outside host and not vise versa. Our firewall administrator, came to me and asks me if I had any security

Contractor Rates.

Hi, Does anyone know what the hourly contract rate is for a Sr. IT Auditor with 15+ years experience? I have had some agencies call me and ask me if I want to work as an Sr. IT Auditor for about $50 an hour on short term contracts (i.e. about 6 months). Is this a good rate or am I being low

Server Configuration Standards

Hi, How many of you have very specific configuration standards for the various flavors of Windows and UNIX production servers? We have high level 3 page standard for both the Unix and Windows platforms. This is about to change as a result of recommendation from a consultant. A private consu

TruSecure Organization

Hi, Has anyone used TruSecure Organization to supplement their security efforts? A short background is our IT Department will be using the TruSecure to help ensure that the security for servers (Unix, Win2K/Nt, Aix) and Cisco routers is proper. I was curious about how the following groups in

Self Paced Security Training

Hi, Can anybody recommend a good SELF PACED CBT on CD(s) or Web Based Training? I am interested in taking some advanced level security courses on UNIX, Win2k, firewalls, vulnerability assessments, firewalls, networks, etc. I just finished taking the SANs UNIX self paced course and my big

Telnet Security Question for a Router.

We were currently wrote up by our external auditors because we use telnet to access all of our routers. In some cases we use a filtered Telnet service...but that is not the normal practice. We are a fairly good size company with about 1000+ routers. I am charged with coordinating a response

Survey: Chat and IM

Hi, We currently are allowing web based chat and instant messaging. I know that there are lots of security issues involved with its usage. The IT folks are telling me that it is a common practice in the industry. I have a hard time believing this and this is one battle I would like to take

DMZ Security Question.

Hi, I have a generalized security question about what type of activities should be allowed on a corporate DMZ. To give you a bit of background...we have had ours in place for about 4 years now but lately we are getting a ton of requests for opening up more ports/services on the DMZ firewalls.

Best Practices - DMZ Security.

Hi, What are the best security practices for a DMZ? Or put a different way...what are things you should never allow to be done on a DMZ? To give you an example of what I am talking about we have had our DMZ set up for about 5 years. However we keep getting stranger requests for activities

Nessus Security Reporting..Inconsistent Reporting?

Hi, I started using Nessus about a month ago. The security metrics that I use is that the IT Server Staff must review/correct Nessus security findings that are rated as "High" in the severity column of the report and/or if the risk factor is "Serious" in the Description column. I know this

Re: Netuseage Monitor Tool

Take a look at Opensystems. _ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.

Getting Permission to Use Security Tools

Folks, I appreciate all of your input on the my original email (Political Challenges Using Nessus).…on the dilemma I was facing in using Nessus in the *politically correct way*. In generally, the consensus opinion was that I needed to make sure I obtained written permission and inform everyo

Political Challenges Using Nessus

Folks, I am currently experimenting with Nessus. I also have a spreadsheet of all IP addresses that our company uses (about 10,000) and it has a detailed description of each IP address. As you can appreciate a hacker would love to have this spreadsheet. My situation… I currently work in the

Unix Security Standards, books, tools...

Folks, I recently was assigned the project of developing security standards for our Unix environment. We have about 400 unix box's (HP-UX, Sun Solaris, AIX, etc)and the admins do their *own thing* with these boxes. This is not a project I exactly like...I am buried with 20 other projects...an

Firewall and Internet Reporting Software...Best One?

Folks, I am conducting research on finding a package that will create (1) management/performance reports from our Checkpoint firewall logs and (2) create reports on employee internet usage. We currently use WebSense to keep employees from going to porno and gambling sites but found it will n