A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

0
votes
2answers
35 views

What can be done to limit corporate Identity theft?

Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for ...
1
vote
1answer
59 views

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy?

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013. The ...
1
vote
2answers
57 views

What policies and agreements regarding information security are a must have for every self respecting company?

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered? For example (...
2
votes
4answers
123 views

Should a company physically destroy old HDD?

Is it advisable for a security-minded company (data stored could be client's detailed information, patent pending docs) destroy all replaced HDDs/SSD? Or is it OK to re-sell them online? Information ...
3
votes
0answers
93 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
8
votes
2answers
795 views

Implications of the proposed Burr-Feinstein senate bill? [closed]

It has been rumoured (I guess it is more than a rumour) that senators Burr and Feinstein will be introducing legislation requiring companies to provide the government (with warrants) access to encrypt ...
1
vote
1answer
126 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
0
votes
1answer
81 views

Surveillance in the Workplace? [closed]

Auditing, surveillance and logging are typical and common place in the workplace, understandably so. These actions are crucial to establishing metrics and performance of the network and its resources. ...
3
votes
1answer
77 views

Adblock to prevent employees from accidentally clicking malicious ads

Our Company allows browsing without restriction such as news, fb, twitter, blogs etc. Would it make sense to have employees install Adblock or similar plugins to prevent (accidentally) clicking ...
21
votes
5answers
2k views

Policy mandate dilemma

When writing security policies do you take into consideration user's (could be vendors) ability/capability to fulfil certain mandates in the policies or do you strictly want them to enforce, no matter ...
5
votes
4answers
147 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
5
votes
1answer
142 views

Restricting access to “hacking” sites and tools

I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy. What are the potential benefits and risks of allowing access to such sites to ...
2
votes
1answer
58 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
2
votes
2answers
180 views

Why is it dangerous for a company to allow employees to connect their own devices to the internet?

I've heard complaints about allowing employees, clients, etc. to bring their own device and connect it to the network. What exactly is the complaint and how can it be a threat? If no network resources ...
3
votes
2answers
62 views

How should we set up domain administrators?

We're a small company that is growing pretty fast. For a long time there were 2 of us that were domain administrators. But over the past 2 years this has increased to 6 people and this strikes me as a ...
1
vote
3answers
81 views

How should we store & share documents with restricted access

Up till now we have handled restricting access to documents by having a share on our server that only the 2 accounting people could access and another that only the 2 HR people could access. And ...
6
votes
1answer
122 views

Is online security training effective?

I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
3
votes
4answers
103 views

Thumbdrive and its obsolescence?

Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to ...
5
votes
1answer
84 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
3
votes
2answers
110 views

In CIA triad of information security, what's the difference between confidentiality and availability?

I sometimes get confused between confidentiality and availability. This site defines confidentiality as Measures undertaken to ensure confidentiality are designed to prevent sensitive ...
12
votes
5answers
2k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to ...
-1
votes
1answer
55 views

Measuring privacy policy [closed]

I want to measure if the user's data which is collected by the system is mentioned in the privacy policy. What is the best measure that I can use it in such case?
1
vote
1answer
317 views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
-1
votes
3answers
169 views

Writing an information security policy [closed]

We are required to write an "information security policy" for our company, and I want to know how much should we cover, and if there are any template or examples that would help.
2
votes
0answers
40 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
8
votes
1answer
147 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...
18
votes
5answers
2k views

At what point in their employment should security policies be explained to an employee?

There are the basic things that need to be explained to every employee about a security policy. For example: How sensitive information must be handled. How to properly maintain your ID, and password,...
1
vote
1answer
46 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
5
votes
3answers
104 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
2
votes
0answers
69 views

Prompt/Notify Users before connecting to PC - Corporate Policy

I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my ...
1
vote
0answers
67 views

Device Control Policy

I want to blacklist all the external storage devices and only allow specific brand of device such as SanDisk. I had blacklisted the external storage devices by using USBSTOR* and whitelist all the ...
1
vote
1answer
51 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
6
votes
3answers
343 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
93
votes
10answers
12k views

Prevention measures against laptop seizure at US borders

Since laptop and other electronic device seizures at US borders became legal without a warrant (including making copies of data), 7% of ACTE's business travelers reported being subject to a seizure as ...
13
votes
3answers
1k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
1
vote
1answer
68 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
3
votes
1answer
166 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
0
votes
1answer
380 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
3
votes
2answers
123 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore have ...
0
votes
2answers
324 views

The difference of Security Policy and Acceptable Use Policy ?

Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet. Information Security ...
1
vote
1answer
91 views

How to protect against portable applications

There are many portable apps around that could be downloaded and run on local PCs. Usually running of exe could be blocked by using UAC. however, in this case of portable applications, how do I ...
0
votes
2answers
333 views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
1
vote
1answer
597 views

Information Security Policy and Information Security Plan

I have a question about the guidance in NIST 800-53. The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information ...
4
votes
0answers
396 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowningly working for another character who wants access to the data of the United States ...
-1
votes
2answers
84 views

Resources fo Security Awareness training [closed]

as part of security awareness for the company, I am looking for something that I could use to spread the awareness. Maybe a web based application/portal which I can create quiz forms easily or share ...
6
votes
1answer
171 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, etc)...
1
vote
2answers
289 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
0
votes
1answer
211 views

Do US companies have citizenship requirements for security-related employees? [closed]

Do U.S. based companies or corporations generally have policies restricting their security staff to certain nationalities or are they generally open to all qualified persons regardless of citizenship?
4
votes
4answers
1k views

Server situated on two physical networks - Bad idea or not

The run down: Windows Server A (from here on referred to as 'the server') exists on the corporate network (ref as Corporate). A separate physical network exists for the Telecommunications Department ...
3
votes
2answers
115 views

Why is the *-property in BPL security model named “star”?

I am just looking for the meaning of "star" in this property