Date: Tue, 11 Aug 92 09:01:16 PDT
From: jmcarli@SRV.PACBELL.COM(Jerry M. Carlin)
Subject: File 4--Bell System Policies (Jerry's Response 2)

> From zygot!john@apple.com Mon Aug 10 17:48:25 1992
>
> jmcarli@SRV.PACBELL.COM(Jerry M. Carlin) writes:
> [Lots of stuff about how Bellcore and Pac*Bell give major lip service
> to security.]

I don't consider spending tens of millions of dollars over the past
few years as "lip service".  If you wonder what on: such things as RACF
for MVS is not cheap. SecureID cards cost quite a bit when multiplied by
10,000 people. Getting lots of shredders costs money. Could we have spent
it more wisely. Of course, but what else is new. IMHO we've done pretty well.

> But the truth of the matter is that while Bellcore may have written a
> book on the matter of security, it apparently forgot to read it. Even
> to this day, it is more or less a trivial matter for a knowledgeable
> person to get into things he shouldn't.

It's neither easy nor quick to plug all the holes in 'swiss cheese'. The
point I'm trying to make is that we've been working on it for a number
of years and are continuing to work on it and that we've made good progress.

> ... Good for you. It is about time. Why has it taken so long?

Some of the reasons are our fault and some are not.

We have been yelling at vendors to deliver operating systems with adequate
security features and bug fixes for a number of years now. I'm REALLY
tired of having stupidities like /etc/hosts.equiv "+" and initial ID's
without passwords forcing us to do work we should not have to do to clean
it up.

Some of the problems require new technology. We REALLY want Kerberos
and/or OSF DCE but they are not ready yet.  We're just getting to the
point of having secure SNMP. When the protocols are full of security holes
it makes it kind of difficult to have true security.

By the way, my personal opinion is that the biggest security problem is
people. We can have the most secure systems in the world, and they can
even be maintained in a secure state but one successful "social engineer"
can knock all of that into a cocked hat. It is a non-trivial problem to
make sure that all legitimate calls from one employee to another get
responded to without delay while at the same time catching all those
trying to talk employees out of confidential information or into opening
up some access in the name of a (bogus) emergency.

There is a public trust issue here. If someone gets the unlisted number
of a public figure and then uses that to harass the person, it's a serious
matter. If the 911 service is disrupted lives are at stake. If someone's
conversations are intercepted illegally, we've violated an expectation of
privacy if not various laws.

While I obviously believe that John is overemphasizing the negative, his
feeling that security is vital and that we need to finish the job is one
that I share. I think it is mandatory that we do so if we want to succeed
in the coming era where any customer will have a choice between several
vendors for basic dial tone. We're getting close now with cellular and
will get closer with the next generation mobile technology.  Even the
hard-wired local loop will be opened up. We can no longer be arrogant
since "we're the phone company, after all". It's not true now and it will
be less true in the future. We're "A" phone company not "THE" phone
company.

Downloaded From P-80 International Information Systems 304-744-2253