A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

6
votes
3answers
267 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
89
votes
10answers
11k views

Prevention measures against laptop seizure at US borders

Since laptop and other electronic device seizures at US borders became legal without a warrant (including making copies of data), 7% of ACTE's business travelers reported being subject to a seizure as ...
12
votes
3answers
1k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
1
vote
1answer
41 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
1
vote
1answer
49 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
0
votes
1answer
37 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
1
vote
0answers
35 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
0
votes
2answers
31 views

The difference of Security Policy and Acceptable Use Policy ?

Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet. Information Security ...
1
vote
1answer
41 views

How to protect against portable applications

There are many portable apps around that could be downloaded and run on local PCs. Usually running of exe could be blocked by using UAC. however, in this case of portable applications, how do I ...
0
votes
2answers
72 views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
1
vote
1answer
64 views

Information Security Policy and Information Security Plan

I have a question about the guidance in NIST 800-53. The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information ...
3
votes
0answers
204 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowningly working for another character who wants access to the data of the United States ...
-2
votes
2answers
47 views

Resources fo Security Awareness training [closed]

as part of security awareness for the company, I am looking for something that I could use to spread the awareness. Maybe a web based application/portal which I can create quiz forms easily or share ...
2
votes
1answer
42 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
0
votes
2answers
151 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
0
votes
1answer
114 views

Do US companies have citizenship requirements for security-related employees? [closed]

Do U.S. based companies or corporations generally have policies restricting their security staff to certain nationalities or are they generally open to all qualified persons regardless of citizenship? ...
4
votes
4answers
751 views

Server situated on two physical networks - Bad idea or not

The run down: Windows Server A (from here on referred to as 'the server') exists on the corporate network (ref as Corporate). A separate physical network exists for the Telecommunications Department ...
3
votes
2answers
40 views

Why is the *-property in BPL security model named “star”?

I am just looking for the meaning of "star" in this property
2
votes
1answer
80 views

Are there specific reasons or benefits to using a tiered information security policy architecture?

I had another question in mind, but thought that I should ask this one first. Background: Everywhere I have been in the past has used a tiered policy architecture. What I mean is there is one ...
-1
votes
1answer
420 views

Can Chrome's Incognito mode be disabled? [closed]

Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?
1
vote
3answers
166 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
1
vote
1answer
53 views

Process of getting approval to make changes in information security infrastructure [closed]

If i were to propose a change in my company's information security infrastructure, how does that proposal get processed up the corporate hierarchy? For example, does the proposal reach the VP of IT ...
2
votes
1answer
232 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
-10
votes
2answers
143 views

Why does a business need to secure its email system? [closed]

Why is important for a business to secure its email system?
4
votes
4answers
2k views

Why do we trust organizations that certificate ISO 27001?

I've been asked why do we trust organizations that certifies ISO 27001? From where did they get the authority and recognition to be able to certify ISO 27001? For example, I can start a certification ...
-2
votes
1answer
847 views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
1
vote
3answers
187 views

Howto pass overly protective corporate firewall

My Corporate Network was always being monitored, but a few days ago they started to block and censor all HTTPS traffic. Recently IT guys forged certificates for all major HTTPS web sites and acts as a ...
3
votes
3answers
156 views

Are clients blocking all incoming connections secure?

When clients (which are using both Linux and Windows) block all incoming traffic in a network, and the router is also blocking all incoming traffic, are we (almost) 100% secure? Maybe excluding silly ...
1
vote
1answer
111 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
1answer
93 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
-1
votes
1answer
215 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?
3
votes
2answers
1k views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
1
vote
3answers
110 views

Question: How to plan email policy for start-ups?

I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're ...
4
votes
3answers
212 views

security performance criteria in employee reviews

Have any of you security professionals been able to get security performance metrics into reviews that managers conduct for their employees? If so, are there any helpful resources you could share to ...
1
vote
1answer
119 views

Are there risks associated with connecting to a public hotspot?

When connecting to a unknown public hotspot, I know that the data transmitted can be captured and, if unencrypted, easily analyzed. But that's not the question here. I want to know whether the ...
1
vote
3answers
3k views

Which security standards define the time of inactivity before locking the screen

Security and usability are often colliding. When it comes to locking screens on workstations after a certain amount of inactivity this is definitely the case and complaints have to be expected from ...
0
votes
1answer
695 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
1
vote
1answer
172 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
4
votes
2answers
126 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
9
votes
2answers
745 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
1
vote
1answer
2k views

Does a network behind a NAT\modem firewall need a firewall?

Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough". For the most part the router ...
-1
votes
2answers
162 views

ISMS for SMB (Small And Medium Enterprise)? [closed]

Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ? The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , ...
1
vote
1answer
882 views

Relationship between FISMA and OMB Circular A-130?

Can someone explain to me the relationship between FISMA and OMB Circular A-130?
11
votes
1answer
271 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
8
votes
2answers
961 views

Gamification of IT security - any applications yet?

Gamification, which is the use of game design elements and game mechanics in a non-game context, is a heavily discussed topic. Looking at the behavioral impact on Gamification, it has potential in ...
2
votes
3answers
766 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
3
votes
2answers
757 views

How do you keep track of numerous keys in the workplace?

Where I'm currently working there is a policy where various assets (including laptops) have to be cable locked and in the tech support department we have so many transient assets it's becoming ...
35
votes
6answers
2k views

What are the purposes of these security policies?

I work at an IBM lab and there are some security policies that I do not understand the point of. When I ask why we do them my boss simply says it's policy and avoids answering the question. We must ...
2
votes
1answer
130 views

Considerations for information exchange agreement between governmental agencies

Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements? What is the security ...
5
votes
3answers
465 views

How can i deal with management who want 'Domain Admin' access?

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...