A consultant* who does not KNOW, (INSIST to know, and INSIST on appropriate documentation of that knowledge) of potential security breaches by his own information access is incompetent, negligent, or both. In in potentially life-endangering task, it is that consultants' responsibility to ascertain the security risks associated with his own activity, and document the necessary steps taken to mitigate same. It is management's responsibilty equally to see that this has been done. Firing the consultant, and the person who hired him, would be an appropriate response in general, to such lack of attention to public duty. Nukes ain't cute. Treat them seriously. Sez me.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/6767/21706#21706