@scottaltiparmak: And the answer is usually no 😀 Although typically I prefer to find a secure middle ground #cybersecurity #infosec

SonOfUther :

A while back on my 1st year in a DoD GRC role I was downloading an AV for one of our systems, per the SoP, and noticed the AV wasn’t on the DoD approved software list. So I asked “are we authorized to use this software on that system.” The answer was “We’ve been using it since it was delivered…” That wasn’t my question though, my question was: is it authorized and if so do we have it in writing. The manager finally piped up with, that’s a good question, let’s hold off until I can get an answer from corporate. The system had been in active use for 4 years, AV updates weekly and nobody thought to ask. 😬

canned can :