Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're planning to lay down a email policy for the company. With my knowledge and experience I proposed the following things:

  1. Email access should be project and role specific.
  2. Communication to the outside world should be totally banned except when the role or project demands so. For ex. When the person is in marketing department or the project deals with clients where communicating with clients is necessary.

Now about objections:

  1. One of us argued that he would want to use company ID for accessing forums because he doesn't want to use two different IDs for same purpose. I can't digest this.
  2. Someone else said, his company allowed use of personal ID at workplace for project related work. He could use his work ID at previous company to communicate with outside world. They want this flexibility.
  3. Someone can use even paper-pencil to leak the data. This is not totally wrong but efforts to leak?
  4. Start-ups are based on trust. Sure they are but confidentiality?
share|improve this question
2  
You should try to protect against mistakes and malware, but I'd consider protecting against malice hopeless. –  CodesInChaos Jan 1 at 23:47

3 Answers 3

You are violating your own policy by asking this question. You communicate with the outside world over an issue related to your startup.

The fact that you start by violating your own policy indicates that you haven't thought the issue through.

Your policy basically says that if your startup uses some open source library and that library has an issue the developers in your startup aren't allowed to write posts to the mailing list of the open source library and they aren't allowed to report bugs to the bugtracker of the open source library.

If you do an effective ban on communication with the outside world that reduces the efficiency of your programmers. There might be startups where total secrecy is important but in most startups it's probably not worthwhile.

I once did an intership in university. The academic group in which I worked didn't use any source control. The had a blanket policy of no outside data transfer. I did the sensible thing of installing source control for myself and asked whether I can backup the data to an external server. I basically got a: "Well, okay."

The basically allowed me to get around the senseless policy of no outside data transfer. They however didn't explain exactly why they didn't want outside data transfer. As a result I couldn't make sensible decisions about when I communicate which data that were in line with the company policy.

Instead of trying to ban all outside communication you should talk with your developers about which informations can safely communicated and which information can't. In most startups you shouldn't forbid your employees from communicating all information.

share|improve this answer
    
Hi Christian, thanks for the first line. I'm taking it as a lesson. But may be that's just partially true. I'm not exposing the information which would harm the start-up,not even its name. And that was my point.Also, I'm not using my "company ID" to communicate. If members are going to use the company ID for project related work they are going to transfer the data related to it. They can transfer it to their personal ID as well and then proceed. Given how big is the project and some recent happening it's become necessary to protect it. –  swap Jan 2 at 19:46
    
And if there arises any situation like you said about open source we can either find an alternative or make exception. I'd like to hear from you on this as well. Start-ups are bound to grow so we can have a policy today which will also evolve with us. Ok,if I'm to allow use of company ID for use on forums,defining what is shown to the world would be difficult. –  swap Jan 2 at 19:51
    
You are not exposing information that will put your company at harm, yet you are violating the policy of a total ban on outside communication. This suggest that your policy is too restrictive. Usually startups are places where people are productive because they don't have many burocratic rules. You are proposing a burocratic rule that makes some things harder. Whether the costs outweigh the benefits depends on the threats that your startup faces. If you have overly strict rules that you yourself break, you train your developers that security rules can be broken. –  Christian Jan 2 at 21:03

No matter how much money and time you spend, you absolutely cannot prevent an internal user from doing something malicious; just ask the NSA.

IT policies, and I've written far too many in my time, should balance security needs with a healthy dose of common sense and reality. You should try to make it to harder for internal users to do something malicious but spend the bulk of your time trying to prevent stupidity. This is reflected in most enterprise security audits, yes, certainly there is a lot of pen testing and segregation of duties, etc... But for internal systems, audits generally focus on everything being tracked. You can't 100% prevent someone from doing something malicious, but when they do, you'd better have it in a log file somewhere.

You're doing well in one regard, that is thinking about IT policy and security as an early start-up, sadly, that's pretty rare. I generally work with or talk to organizations that are transitioning from start-up phase to an established, growing small business. Many haven't spent any reasonable amount of time on the subject, almost all of them are too lax in their plan and implementation.

That being said, from your question it sounds like you're leaning to the other end of the spectrum, that too is dangerous. Start small with that size of team, make sure that you're able to justify and convey (sell) your policies to the rest of your team. As you grow, regularly revisit these policies and make them more restrictive with more segregation of duties, etc as it becomes more appropriate.

Good luck on the start-up...

share|improve this answer
    
Yes right. If someone want to leak the data they will anyhow. But that's like saying if robbery is going to happen anyways why have doors. Yes, my policy might not be correct at this time but I like to think about future as well when we'd be recruiting. My suggestions are little harsh and I do realize that but blindly trusting someone isn't good is what I think. And yes, I'm in the learning like I've always been so inputs like you are highly appreciated. –  swap Jan 2 at 19:58
    
Like I said, you're on the right track, thinking about these things earlier rather than later. To clarify a bit, when I say you can't prevent internal maliciousness, doesn't mean you hand everyone the keys. You just need to target a balanced approach. Which again, given that you are asking these questions, I'm sure you're headed in the right direction. –  Zeb Jan 2 at 21:22

I've been using Google Apps for Business; it might be what you are looking for, it has a wide range of settings for email policy. Just to name a few -

Restrict the domains that your users are allowed to exchange email with.
Content compliance
Attachment compliance
Secure transport (TLS) compliance
Enforce 2 factor authentication

I don't fully understand the objections, could you elaborate?

share|improve this answer
    
They want to use the company ID to access forums such as StackOverflow to post questions if they are related to the project. The other guy,who was working at some company previously didn't have a policy strict like this one. He was allowed communication with outside and also to use his personal ID for project related works. We are using the Google Apps right now but might shift to something better or flexible and customizable. EAS maybe? –  swap Jan 2 at 20:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.