Steve Berry

UK

Infrastructure Architect

I could be wrong, but I think BP are playing "politics" and "accountability" here. Seems to me they're having trouble finding the right security "types" and rather than take internal responsibility for their own security they're effectively "passing the buck" to the providers of the products they're using. i.e. If our network is compromised because of your products we'll hold you responsible.

Why don't they consider spending a part of their considerably large financial resources to set up IDS/"honeypots/nets" (as
MS have done) if they're that concerned about security and employ proper "security types" to look after their network/create a "forward thinking" strategy that has a more reasonable chance of standing the test of time than this "effort ???" does ?

I'd really like to see the evidence of exactly how they came to this conclusion.

"BP believes it can "harden them" to the dangers of the web" does it ???

The only feasible way you're going to be able to do that is to unplug the network cards !