This website requires Javascript to function properly. Please go to the setting of your web browser and enable Javascript for this website.

some comments

su27(和稀泥)

For security, it will be a top down design procedure should be followed.
NO product can protect your secure without a good security policy. And a good security policy should be in management level instead of detail product.
I think a lot of guys will think of firewall, IDS etc when we mention the security, my experience is think the security in a high level way will help you a lot. Products should in involved in implementation phase not in the very beginning.
If you are really interested in security, then try to take a CISSP or CISA will help you a lot.

(#864267@0)
Last Updated: 2002-11-19

Replies, comments and Discussions:

工作学习 / IT杂谈 / To Security(Dirction)，和你聊聊安全话题。 -ilovewind(wind); 2002-11-19 {1636} (#863307@0)
本文发表在 rolia.net 枫下论坛Security，你好，
看了你的帖子，因为我也作了几年网络和安全，并把这定为自己今后发展的目标，所以想就这个话题跟你聊聊。主要是希望能交流一下对该行业的看法，如果能得到策略上的指点，我将受益匪浅。另外，如果对坛子里的朋友有帮助的话，就更好了。

我接触的安全产品主要有Cisco PIX, IOS Firewall, CheckPoint，另外Nokia IP系列和RSA SecurID也稍稍玩过。售前售后都做过。

我的理解，网络与安全密不可分，所以肯定是要放在一块，主次的问题，由於我和我周围的朋友，都是从网络学起，所以一致认为应以网络为主，安全作为专项，在提供网络服务的同时，把安全水平体现出来，给客户满意的解决方案。就这一点，我想你会有不同的重心，很想听听你的见解。

对於工程师的工作，是不是可以分为售前和售后，或者说分为安全规划/实施与网管/维护。那么对於售前，需要的是对安全的全面深刻的理解，丰富的产品知识，开阔的视野，敏捷的思路以及高超的表达和沟通能力，因为安全问题很敏感，与客户沟通分寸要掌握的好；而对于售后，则需要精深的技术功底，耐心，细心，滴水不漏的工作作风。这些都是我从工程师的角度想象的。非常希望你能以manager的角度评价一下你眼中的安全专家的职责，技术水平与性格特点，这点对我(们)的帮助会很大。谢谢。

安全产品众多，个人认为，大致可分为防火墙，VPN，IDS，AAA，主要厂家有Cisco, CheckPoint, ISS, RSA等等。我接触的产品有限，自己又是Cisco guy，有很强的好恶偏见。就很想向你请教，从全面的技术/市场来看，哪些产品和技术是领先的，具有优势的。再次感谢。

你在帖子中提到，贵公司在扩大规模，需要安全专家。那我很想听听你对应聘者的期望。比如知识水平，在操作系统，网络，各种安全产品的经验，以及非知识技能的要求，等等等等。这样，我想我和论坛里的其他朋友，都能有个参考标准，以便为下一步目标做准备。

真心感谢你能在百忙当中抽时间和大家一起探讨，谢谢。

IloveWind敬上
Nov. 18. 2002.更多精彩文章及讨论，请光临枫下论坛 rolia.net

some comments -su27(和稀泥); 2002-11-19 {562} (#864267@0)
For security, it will be a top down design procedure should be followed.
NO product can protect your secure without a good security policy. And a good security policy should be in management level instead of detail product.
I think a lot of guys will think of firewall, IDS etc when we mention the security, my experience is think the security in a high level way will help you a lot. Products should in involved in implementation phase not in the very beginning.
If you are really interested in security, then try to take a CISSP or CISA will help you a lot.
how aout IDS. ? -baboon(baboon); 2002-11-20 (#866077@0)

I agree with 和稀泥. IDS is only a small part of your security architecture. -secfan(SecurityCat); 2002-11-20 {345} (#866358@0)
You can't depend on only one security measure. You must have in-depth protection. Firewall, IDS, VPN, LDAP, encryption, PKI, etc. Integrate all these together and you can make your system more secure. But I think the most important is people. Security specialists are important. More important is educating common users with security knowledge.

some comments

Replies, comments and Discussions:

More Topics