A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

-4
votes
3answers
44 views

Malware detection system [on hold]

I want to build a malware detection system for the local network, depend on extracting features from the inspection of files, like API or Opcode, then use statistical models to detect unwanted ...
1
vote
1answer
46 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
0
votes
1answer
32 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
1
vote
0answers
34 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
0
votes
2answers
24 views

The difference of Security Policy and Acceptable Use Policy ?

Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet. Information Security ...
1
vote
1answer
41 views

How to protect against portable applications

There are many portable apps around that could be downloaded and run on local PCs. Usually running of exe could be blocked by using UAC. however, in this case of portable applications, how do I ...
0
votes
2answers
60 views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
1
vote
1answer
53 views

Information Security Policy and Information Security Plan

I have a question about the guidance in NIST 800-53. The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information ...
2
votes
0answers
176 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowningly working for another character who wants access to the data of the United States ...
-2
votes
2answers
44 views

Resources fo Security Awareness training [closed]

as part of security awareness for the company, I am looking for something that I could use to spread the awareness. Maybe a web based application/portal which I can create quiz forms easily or share ...
2
votes
1answer
34 views

Possible for Lync clients to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
0
votes
2answers
145 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
0
votes
1answer
105 views

Do US companies have citizenship requirements for security-related employees? [closed]

Do U.S. based companies or corporations generally have policies restricting their security staff to certain nationalities or are they generally open to all qualified persons regardless of citizenship? ...
4
votes
4answers
727 views

Server situated on two physical networks - Bad idea or not

The run down: Windows Server A (from here on referred to as 'the server') exists on the corporate network (ref as Corporate). A separate physical network exists for the Telecommunications Department ...
3
votes
2answers
37 views

Why is the *-property in BPL security model named “star”?

I am just looking for the meaning of "star" in this property
2
votes
1answer
74 views

Are there specific reasons or benefits to using a tiered information security policy architecture?

I had another question in mind, but thought that I should ask this one first. Background: Everywhere I have been in the past has used a tiered policy architecture. What I mean is there is one ...
-1
votes
1answer
393 views

Can Chrome's Incognito mode be disabled? [closed]

Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?
1
vote
3answers
163 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
1
vote
1answer
50 views

Process of getting approval to make changes in information security infrastructure [closed]

If i were to propose a change in my company's information security infrastructure, how does that proposal get processed up the corporate hierarchy? For example, does the proposal reach the VP of IT ...
2
votes
1answer
218 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
-10
votes
2answers
141 views

Why does a business need to secure its email system? [closed]

Why is important for a business to secure its email system?
4
votes
4answers
2k views

Why do we trust organizations that certificate ISO 27001?

I've been asked why do we trust organizations that certifies ISO 27001? From where did they get the authority and recognition to be able to certify ISO 27001? For example, I can start a certification ...
-2
votes
1answer
789 views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
1
vote
3answers
185 views

Howto pass overly protective corporate firewall

My Corporate Network was always being monitored, but a few days ago they started to block and censor all HTTPS traffic. Recently IT guys forged certificates for all major HTTPS web sites and acts as a ...
3
votes
3answers
154 views

Are clients blocking all incoming connections secure?

When clients (which are using both Linux and Windows) block all incoming traffic in a network, and the router is also blocking all incoming traffic, are we (almost) 100% secure? Maybe excluding silly ...
1
vote
1answer
111 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
1answer
93 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
-1
votes
1answer
204 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?
3
votes
2answers
1k views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
1
vote
3answers
108 views

Question: How to plan email policy for start-ups?

I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're ...
4
votes
3answers
208 views

security performance criteria in employee reviews

Have any of you security professionals been able to get security performance metrics into reviews that managers conduct for their employees? If so, are there any helpful resources you could share to ...
1
vote
1answer
116 views

Are there risks associated with connecting to a public hotspot?

When connecting to a unknown public hotspot, I know that the data transmitted can be captured and, if unencrypted, easily analyzed. But that's not the question here. I want to know whether the ...
1
vote
3answers
3k views

Which security standards define the time of inactivity before locking the screen

Security and usability are often colliding. When it comes to locking screens on workstations after a certain amount of inactivity this is definitely the case and complaints have to be expected from ...
0
votes
1answer
672 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
1
vote
1answer
165 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
4
votes
2answers
123 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
9
votes
2answers
741 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
1
vote
1answer
2k views

Does a network behind a NAT\modem firewall need a firewall?

Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough". For the most part the router ...
-1
votes
2answers
158 views

ISMS for SMB (Small And Medium Enterprise)? [closed]

Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ? The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , ...
1
vote
1answer
851 views

Relationship between FISMA and OMB Circular A-130?

Can someone explain to me the relationship between FISMA and OMB Circular A-130?
11
votes
1answer
269 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
8
votes
2answers
938 views

Gamification of IT security - any applications yet?

Gamification, which is the use of game design elements and game mechanics in a non-game context, is a heavily discussed topic. Looking at the behavioral impact on Gamification, it has potential in ...
2
votes
3answers
724 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
3
votes
2answers
711 views

How do you keep track of numerous keys in the workplace?

Where I'm currently working there is a policy where various assets (including laptops) have to be cable locked and in the tech support department we have so many transient assets it's becoming ...
35
votes
6answers
2k views

What are the purposes of these security policies?

I work at an IBM lab and there are some security policies that I do not understand the point of. When I ask why we do them my boss simply says it's policy and avoids answering the question. We must ...
2
votes
1answer
129 views

Considerations for information exchange agreement between governmental agencies

Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements? What is the security ...
5
votes
3answers
452 views

How can i deal with management who want 'Domain Admin' access?

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
6
votes
3answers
442 views

Segregation of Duties of 3 tier Applications

This is a tricky issue I'm dealing with at the office. Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications. I'm trying to figure ...
8
votes
5answers
662 views

Should a full disk encrypted hard drive on a live system be considered encryption at rest?

If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
4
votes
2answers
208 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...