Well. There is much to reply to in this posting, and I know that few
agree with my ideas in security. I compare good security to the walls,
windows, and doors of a building. Give me everything I need, and hide
everything else from me, so it looks to me as if the computer is all
mine. And I've only seen this once, at the early stages of an
installation, and then one consultant insisted that they had to be a tin
god to do their job. Goodbye system commands and productivity tools.

But. I just took a course on ethics, and chose Information ethics as my
course paper topic. I would suggest that we have the same ethical
obligations as a doctor or other knowledge professional. They almost
never let you write your own prescriptions. And I don't tell people
passwords for the system manager, or for accounts that they don't use,
or for other users, or other SECURITY / 3000 session names.

I have read about consultants taking work that they knew to be
ill-advised at best, or that they really couldn't perform. I worked for
a consulting firm that provided not only IT expertise, but business
expertise as well. One engineer told our client that he would give them
the latest hot and sexy business practice that Walmart was using, if
they could give him a single business reason for having it. They were
not happy, but they realized that he was right. Sometimes we have a
professional obligation to protect the user from themselves, in addition
to listening to and understanding what they want, or they may make the
move to the out of business camp. The contractors who coded the Colorado
airport baggage-handling system told them that they couldn't do it in
two years, but still took the two-year contract. They were right that
they couldn't do to job. Taking the job was just wrong. The hard part is
knowing how to determine who is right.

>----------
>From:  Jeff Kell
>Sent:  Thursday, February 20, 1997 10:02 AM
>To:    [log in to unmask]
>Subject:       Re: [HP3000-L] More on MS "Security"
>
>Forwarded for Steve Dirickson (sent to owner-hp3000-l) [JK]
>-----------------------------------------------------------------------
>Companies that say "yes, we know what you want, but we won't give
>it to you because it isn't what we think you need; we'll give you this
>instead" seem to me to be much more in the "don't get it" camp-as well
>as
>having a tendency to move fairly rapidly to the "out of business" camp.
>
>