What questions would the Joel test for Infosec professionals consist of?

Question

See Server Fault and the original test. In other words what are some good questions that an information security professional should ask of a prospective employer? These questions might also lend themselves to helping to improve an existing work environment and enable an employer to attract the best and brightest in information security.

Answer 1

• Do you perform regular backups to more than one physical location?
• Do you regularly test restoring from backup?
• Do you have a risk management strategy for security issues?
• Do you regularly educate your employees about security issues that pertain to them?
• Do you have a security budget?
• Are there controls, both technical and managerial, in place for sensitive data?
• Do you stay current on security issues?
• Do you store passwords in plain text?
• What software do you use to protect your computers, servers, and data?
• Do you regularly update critical software to newer versions?
• Are password changes for all employees mandatory?

Answer 2

In addition to those from VirtuosiMedia:

• What is the security team accountable for and how many people are on it?
• When were your security policies last updated?
• Who does the security team report to?
• What is the oldest application running in your environment?
• Is the security team part of the compliance program? If so what types of audits are performed annually?

Answer 3

A few to add:

• Do you use automated log management and analysis tools?
• Do you segment your network?
• Do IT Security personnel maintain any production systems? (Is there segregation of duties)
• Do normal users have administrator rights?

Answer 4

One which seems to impact security teams significantly would be:

• Do you have a CISO or equivalent sponsoring security at board level and development of security skills and expertise

Without it, teams very rapidly become disillusioned at their lack of influence and will move to organisations with a more mature outlook on security.

Also, in order to attract individuals who are looking to secure their long term career

• Do you have a security competency framework, such as the one developed by the Institute of Information Security Professionals covering the whole career from graduate entry to retirement?

Answer 5

• Do you have a seperate Application Security team? (as opposed to just network sec running the show)
• Is the CISO / head of security / whatever you call him - both technical enough to understand the threats, and business-savvy enough to translate to risk
• Is there a holistic SDL in place, with executive-, managerial-, and developer-buyin?
• Do all employees must have relevant security training, relevant to their area of work?
• Does any product/system/application/etc have to get security signoff before deployment, and can security stop it?
• If/when security does stop a system from going live because of severe vulnerabilities, are they thanked or cursed by the business?
• Are Board directors bound by corporate security policy? :)
• Is the security department seen as a technical roadblock, or as an executive aid to managing business risk?