Getting input (was Re: Upgrades and Security Requirements)

Hi Johnathon,

At 12:18 -0700 2004-06-23, Johnathon P Kogelman wrote:
>I have to wonder why these issues weren't raised in Jan-March of
>this year, when the sub-committee was requesting input, feedback,
>and hosted meetings at different Campus levels.

   This is a familiar question. From the perspective of someone who
has frequently both been in the position of trying to gather input on
proposed technical and policy changes, as well as a member of the
undifferentiated masses expected to provide it :-), the simple answer
seems to be this: most computing support providers are extremely
busy, and unless you make repeated, persistent efforts to gather
input, only a core of motivated people are likely to participate.

   The following may be heretical :-), and certainly reflects my opinion alone:

   If, when you are making repeated, persistent efforts to gather
input, you also highlight some of the key potential implications of
any proposed changes in the clearest, starkest and most concrete
terms possible, both positive and negative, you're likely to draw far
more input, some of it useful, than if you don't do this.

   Obviously, whether you're a politician, a campus administrator, or
even a campus computing support provider just doing your job
conscientiously, it's natural to want to avoid having to do this.
It's only human to not want to see our proposed changes scuttled at
an early stage, or to spur heated opposition on minor issues that may
be peripheral to the core goals of these proposed changes, for
instance. Nonetheless, within the campus computing support
community, there may well be merit in laying all one's cards on the
table at an early stage.

   For instance, stating outright that such a policy may bar computers
running older versions of Windows from running on the campus net, and
potentially also bar computers running older versions of the Mac OS -
along with the concomitant support and monetary costs of upgrading,
as well as a clear discussion of the ongoing benefits of such a
change - is a far more likely way to draw input than referring to a
general item in a policy statement concerning the availability of
vendor patches, or even just sending out a URL to a policy and
requesting comment.

   Similarly, stating all computers on the campus net will be expected
to run host-based firewall software and giving concrete examples of
the types of end-user problems and support issues that will likely
result, as well as concrete examples of past attacks and resultant
support nightmares that having such software in place would likely
have thwarted, as part of the process of soliciting input, is likely
a far more effective way to elicit input on this topic than simply to
refer to a general policy regarding such firewall software, or even
just to a general security policy.

Aron Roberts
Workstation Software Support Group

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.
Received on Wed Jun 23 12:49:09 2004