Different cultures, different attitudes towards these things.
I was recently in Aschaffenburg (Germany) doing interoperability tests with some of our networking equipment and a large SCADA vendor. About two hours into the tests, we ran into some problems, which we quickly identified as being related to the firewall on one of the test laptops in their lab having a very restrictive firewall rule (wouldn't allow ping). We had to wait for the better part of two hours while they got approval to adjust the firewall rules to allow ping from another device in the same lab. Note that this was a lab laptop, and these were technically sophisticated people - they understood the implication of allowing ping - it's just that their policy/procedures with regards to security were very, very strict.
I can guarantee you, in any interop tests I've done in Silicon Valley - there would be zero friction (even with the utility companies, enterprise software vendors, scada vendors) around opening up icmp on a lab laptop firewall.
I cite this as an example where Americans (at least those in Norcal) are more lax regarding security than another culture (in this case, whatever was prevalent in the part of Germany Aschaffenburg is located in)
You can guarantee that? I dont think so, Im not a sysop but if I was, you would need to explain why ICMP needs to be open.
Whether Im in Norcal or not. Most sane organizations are going to turn off ping, its not a cultural thing and it doesnt seem like you faced any friction since you got it opened in 2 hours.
Ive been working here in norcal my whole life and I dont see a culture of lax security in shops that have actual security requirements. Its not the country is the quality of the network administration team.
I've been a network engineer for 15+ years, and I'm saying that 95% of all employees I deal with in the Bay Area would not think twice about opening up a firewall rule and allowing you to ping a lab machine, particularly when the purpose of your engagement was to verify end-end network connectivity. They would make the call, themselves, on the spot.
The reason I bring this up, is that I've been told by a number of my colleagues that german culture, in particular, has a tendency to be more rule structured than in the United States, so, if there was a security policy in place, it had a greater chance of being adhered to in Germany, than in the Norcal.
And the entire point of my little anecdote was to make it clear, that there is broad diversity of attitudes towards rules, policy - and that the "United States" doesn't have a lock on following rules/policy.
I was recently in Aschaffenburg (Germany) doing interoperability tests with some of our networking equipment and a large SCADA vendor. About two hours into the tests, we ran into some problems, which we quickly identified as being related to the firewall on one of the test laptops in their lab having a very restrictive firewall rule (wouldn't allow ping). We had to wait for the better part of two hours while they got approval to adjust the firewall rules to allow ping from another device in the same lab. Note that this was a lab laptop, and these were technically sophisticated people - they understood the implication of allowing ping - it's just that their policy/procedures with regards to security were very, very strict.
I can guarantee you, in any interop tests I've done in Silicon Valley - there would be zero friction (even with the utility companies, enterprise software vendors, scada vendors) around opening up icmp on a lab laptop firewall.
I cite this as an example where Americans (at least those in Norcal) are more lax regarding security than another culture (in this case, whatever was prevalent in the part of Germany Aschaffenburg is located in)