What topics can I ask about here?
IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities. Topics include, but are not limited to:
- web app hardening
- network security
- social engineering, including phishing
- risk management
- penetration testing
- security tools
- using cryptography
- incident response
- physically securing the office, datacentre, information assets etc.
What background should I give in my question? Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, and vice versa. Are you trying to protect something of global value against Advanced Persistent Threats? Or are you looking for a cost-effective approach for a low-profile small business? To get the most helpful answers you should tell us:
- what assets you are trying to protect
- who uses the asset you're trying to protect, and who you think might want to abuse it (and why)
- what steps you've already taken to protect that asset
- what risks you think you still need to mitigate
Be Specific - A question that is too open may fail to get the answers you want. Further specific information on the context helps:
- Web app or desktop?
- Employees or general public?
- Windows/Linux, Python/Java, Europe/Singapore, etc?
- a summary of your threat model, or risk profile, if you've already created one?
The best answer may be wildly different depending on the above. Providing this information will also help you organize your own thoughts about your security issues.
Chat in the DMZ - some questions will inspire discussion - these are best asked in the DMZ.
Laws - Answers on laws, regulations and licencing should not be taken as legally binding - we're security professionals so deal with legal issues, but this site is not a law site.
Mistakes - Sometimes an answer may be voted up highly despite being wrong. Downvote and comment as usual, but if it doesn't get resolved through voting, you can flag it.
For more help, see "What types of questions should I avoid asking?"
If your question is not specifically on-topic for Information Security Stack Exchange, it may be on topic for another Stack Exchange site. If no site currently exists that will accept your question, you may commit to or propose a new site at Area51, the place where new Stack Exchange communities are democratically created.