Sys Admins are truly the ones who end up testing and verifying that the systems they manage are patched and not vulnerable. Very few companies have the luxury of their own Information Security team and don't have the budget to obtain a Managed Security service contract with an IS vendor.

With this Anti-Disclosure plan, you have effectively hog-tied the very people who need the information. And if the answer to this issue is to have every company join the organization, then you defeat the very purpose of the plan.

Just a thought.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/281/8655#8655