@reraises99 wrote:
Who should own firewalls? InfoSec or network?
Along the same lines:
- Who should own patching?
- Who should own employee on/off boarding?
- Who should own risk management?
- Who should own business recovery?
- Who should own backup/restore?
- Who should own malware defense?
- Who should own Active Directory?
- Who should own policy development?
Much like the CISSP is a "mile wide and an inch deep", so is a security department. The bottom line is that there is a "Security" aspect to just about everything in I.T. (and business). Security is much too big a topic for one department to manage from soup to nuts. Much better is to partner with everyone and serve in an advisory role to all.
So, when it comes to policy development, I gather up the relevant framework bits, benchmarks and other needs. Then I go to the network team and collaborate on a policy that both will pass audit and is maintainable by them. When they make firewall changes, they take the request, write it up into an action plan and then discuss it with me. Once everyone is on board, they make it so. If you want, you can think of this as a "separation of duties" control, but I prefer to think of it as "two heads are better than one".
With respect to VPN termination, I feel that either choice is equally secure, so I leave the decision up to the networking team. As it turns out, their answer is "both". VPNs with a huge access-control aspect land on firewalls whereas others need fail-over capabilities better handled by a router.
