An Information Security Place

Commentary on the State of Information Security
Filed under Rant, Security, Sheesh

I had a client call me right before Thanksgiving in emergency mode (one of the Dallas clients that I am starting to work with).  Looks like he has a remote office that uses the local cable company as their ISP and connects back to corporate via a site-to-site VPN.  I found out that they have never setup a persistent IP address for their firewall / router.  Basically, they had been depending on the DHCP lease renewing rather than spending the money for a persistent IP (bad choice).   

This client is new to me, so I had no idea what their network is like.  My counterpart in Dallas (this has been his account for a while) was out for the week, and it was proving very hard to get in touch with him since his wife had just had a baby on that Sunday.  The client was understanding, but he was also starting to freak because the remote site had a few VPN tunnels terminated there because of a server at the location that was used for processing orders.  Anyway, to shorten this down so I can get to the point, I finally got in touch with the SE in Dallas and got it all straightened out (I will be fixing it again for him tonight since he finally decided to get a persistent IP), and the guy was happy.

So I talked to the account manager and the Dallas SE, and I learned a few things about the account.  First of all, this guy was running (obviously) a mish-mash of ISP’s at his sites, so management of that sucked when a site went down or had other issues since he had to keep all those ISP’s info.  Also, he used to have a couple of people on staff to work on their IT issues, but he let them go a while back, even though the company is in growth mode and doing well.  And I learned that the AM and the Dallas SE had tried to get this guy to buy Netscreen Security Manager (he has Netscreen 5gt’s in his remote sites and a NS25 at corporate) to make his network manageable.

So essentially, even though this guy was growing and was adding sites, he wanted to run everything on the cheap.  And he was depending on us to fix his problems when he had them, even though Accuvant is not a break / fix type of company.  We do everything project based - the only real flexible assets we have are our SE’s like me, and we are supposed to be pre-sales only, so we were basically helping the guy out on the hopes of new business.

So I went up to meet the guy after we got everything straightened out in the hopes of getting the guy to bite off on some enterprise-level networking.  Of course, I should have known better.  I have known guys like this all my IT career.  They will do everything in their power to get something for free, and they won’t quit until you realize you are getting screwed by doing a bunch of free work.  And though I can’t say I blame the guy, it also aggravates me that this guy could not recognize that he was becoming too large an organization to manage in this kind of piss-poor manner.  I understand making business decisions, but at some point the term “cheap” starts coming into play.

If you want to be an enterprise, act like one in all respects.

Vet

Posted by Michael Farnum on Monday, December 3rd, 2007