Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do not manage such redirection, another company is tasked to manage the network. Every seat has a laptop running W7 with no restriction at all, that's it, admin user by default. External people can't access the building, we have ID and fingerprint scanners.

I'm trying to "create" a security specific role. I'm new in this company but I'm the only one interested in security here.

So far I've analyzed passwords (every basic password principle is violated lol!), accounts management on servers (disable LDAP accounts when someone leaves, set expirity of temp accounts), privacy issues (webcam, logged sessions when leaving), clean desk policy (although as external people can't access, I'm not sure whether this is going to have any effect) and least privilege (limit access to some resources, admin and user accounts on laptops, prohibit the use of USB sticks).

According to all the stated above, what other security controls could I implement?

share|improve this question

1 Answer 1

ISO/IEC 27002 lists 114 security controls they feel everyone should at least consider, but I wouldn't recommend starting there; you need to do a risk assessment first so you know what you have to control.

Don't start with a list of controls, otherwise you'll make a horrible mistake like assuming fingerprints readers mean external people can't access your building.

(Who cleans the kitchen? Who fixes the toilet when it breaks? Who delivers parcels? Who checks your smoke alarms? Who would your lowest paid employee let in if I gave them $5,000? Who would your highest paid employee let in if I threatened to tell his wife?)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.