Stories by: Vince Tuesday

It's not polite to poke fun at your vendors, but during a recent meeting with our Cisco reps, I couldn't resist. We had the reps in for a chat about some of Cisco's latest security products and our planned wireless LAN deployment. But my team and I had questions for them after reading news reports of a security problem with their Wireless LAN Solution Engine and Hosting Solution Engine products.

Whenever a new virus appears, I worry that it will be clever, elegant -- and a headline on the nightly news. That combination means that everyone in management will want to know what's going on before we know ourselves. That happened before with SQL Slammer. But with the recent Mydoom virus outbreak, our own protective systems became the publicity machine that created a companywide panic.

It's unprofessional to break down and sob during a meeting, but I came pretty close a few times last week as I finally began to understand the details of the IT security systems and processes my new company uses to protect itself.

I recently changed positions and have been trying to understand the many projects already under way here. The most vital of these is a planned virtual private network (VPN) rollout. My company has many staffers who travel, as well as those who want to work from home.

At 10 a.m., the boss called the entire IT security team into a meeting room, but without the line manager. He said that the line manager had been sacked.

We were pushing for a speedy move to the supposedly more secure Windows Server 2003 -- until we ran into the vulnerability in remote procedure call (RPC) services that use the Distributed Component Object Model. Every version of Windows, including Server 2003, is vulnerable to this latest buffer-overflow flaw. So we're rethinking our plans.

Last week, my team and I discovered a vulnerability in the Cisco Systems Inc. equipment we use in our global network. There are 253 possible IP-based protocols in IP Version 4, and the majority of Cisco routers and switches have a serious problem with four of them. The flaw leaves unpatched equipment open to denial-of-service attacks.

My company deals with large electronic financial transactions on a regular basis, and I worry that this makes us the perfect target for a focused attack on our networks. This issue had been a theoretical one for me, however, until last week.

"How much money do you have in your budget? You have to be aware that this is very expensive software."

Five years ago, before I was hired, my company rolled out a financial services application to 20,000 users at 900 companies in 18 countries. The company knew it needed something better than just user names and passwords for authentication, so it built a public-key infrastructure (PKI).

Every so often I meet with a group of my peers to trade war stories about life in the security trenches. Mostly we swap technical hints and tips about what works when trying to sell security to management. Recently, the topic was manager and staff issues.