A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

3
votes
3answers
378 views

Why do we trust organizations that certificate ISO 27001?

I've been asked why do we trust organizations that certifies ISO 27001? From where did they get the authority and recognition to be able to certify ISO 27001? For example, I can start a certification ...
-2
votes
1answer
52 views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
1
vote
3answers
79 views

Howto pass overly protective corporate firewall

My Corporate Network was always being monitored, but a few days ago they started to block and censor all HTTPS traffic. Recently IT guys forged certificates for all major HTTPS web sites and acts as a ...
1
vote
3answers
61 views

Are clients blocking all incoming connections secure?

When clients (which are using both Linux and Windows) block all incoming traffic in a network, and the router is also blocking all incoming traffic, are we (almost) 100% secure? Maybe excluding silly ...
1
vote
1answer
94 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
1answer
70 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
-1
votes
1answer
65 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?
2
votes
2answers
302 views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
1
vote
3answers
100 views

Question: How to plan email policy for start-ups?

I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're ...
4
votes
3answers
140 views

security performance criteria in employee reviews

Have any of you security professionals been able to get security performance metrics into reviews that managers conduct for their employees? If so, are there any helpful resources you could share to ...
1
vote
1answer
81 views

Are there risks associated with connecting to a public hotspot?

When connecting to a unknown public hotspot, I know that the data transmitted can be captured and, if unencrypted, easily analyzed. But that's not the question here. I want to know whether the ...
1
vote
3answers
299 views

Which security standards define the time of inactivity before locking the screen

Security and usability are often colliding. When it comes to locking screens on workstations after a certain amount of inactivity this is definitely the case and complaints have to be expected from ...
0
votes
1answer
234 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
1
vote
1answer
105 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
4
votes
2answers
107 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
3
votes
2answers
121 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
1
vote
1answer
625 views

Does a network behind a NAT\modem firewall need a firewall?

Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough". For the most part the router ...
-1
votes
2answers
114 views

ISMS for SMB (Small And Medium Enterprise)? [closed]

Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ? The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , ...
1
vote
1answer
325 views

Relationship between FISMA and OMB Circular A-130?

Can someone explain to me the relationship between FISMA and OMB Circular A-130?
10
votes
1answer
202 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
8
votes
2answers
574 views

Gamification of IT security - any applications yet?

Gamification, which is the use of game design elements and game mechanics in a non-game context, is a heavily discussed topic. Looking at the behavioral impact on Gamification, it has potential in ...
2
votes
3answers
309 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
3
votes
2answers
306 views

How do you keep track of numerous keys in the workplace?

Where I'm currently working there is a policy where various assets (including laptops) have to be cable locked and in the tech support department we have so many transient assets it's becoming ...
33
votes
6answers
2k views

What are the purposes of these security policies?

I work at an IBM lab and there are some security policies that I do not understand the point of. When I ask why we do them my boss simply says it's policy and avoids answering the question. We must ...
2
votes
1answer
112 views

Considerations for information exchange agreement between governmental agencies

Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements? What is the security ...
5
votes
3answers
345 views

How can i deal with management who want 'Domain Admin' access?

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
5
votes
2answers
200 views

Segregation of Duties of 3 tier Applications

This is a tricky issue I'm dealing with at the office. Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications. I'm trying to figure ...
7
votes
5answers
408 views

Should a full disk encrypted hard drive on a live system be considered encryption at rest?

If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
4
votes
2answers
151 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
18
votes
5answers
2k views

What is the most security benefit of a clean desk policy?

Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?” The choices are: ...
1
vote
3answers
113 views

How to protect against an attack where a person claims to be in a position of authority?

In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
-3
votes
1answer
808 views

Clean desk policy/No one giving me clear answer when asking about security procedures [closed]

I got a job working at an IBM lab. Many security procedures I do not see the point of and sometimes find so annoying makes me want to disregard the rules all together. The clean desk policy is in ...
4
votes
3answers
302 views

Loss of hardware asset(such as a laptop) that belongs to an organization

What should an organization do if an employee loses their laptop owned by the company. The laptop is used for business purposes, has confidential data and is also encrypted. Are there specific ...
2
votes
1answer
128 views

Windows App Store security

It seems like most companies now a days, give you a crappy laptop with some version of Windows on it that allows you to access the internet (sometimes they block YouTube, Facebook, etc.), comes with ...
3
votes
2answers
167 views

What goes into an average incident response process for a corporate network?

I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
19
votes
7answers
986 views

How Involved Should a Developer Be in Designing a Security Policy?

I've been developing software for well over 20 years. During that time I've worked in Fortune 100 companies that had very specific security requirements developed by dedicated security professionals ...
4
votes
4answers
206 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
15
votes
7answers
822 views

My company policy states I must put all passwords in a password safe shared with management. Is this secure?

As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
6
votes
3answers
1k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
3
votes
2answers
222 views

I just discovered that my sysadmin created a loophole that gives me root access. What should I do?

At our company the Linux system administration is handled by the security team. The guy assigned to my project has been a great big pain, and has seemed to me at several points to be of questionable ...
0
votes
5answers
257 views

PCI Policy Management software?

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
0
votes
5answers
530 views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
4
votes
5answers
182 views

Is there a domain specific language for security policies

Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ? Edit: Typically to express security policies at network level ...
7
votes
2answers
140 views

Is there any security benefit to separating an RFID chip from an ID badge?

This seems to be a question that blurs the line between physical and IT security, but I'm hoping it's relevant enough! In order to meet with PCI standards, our company recently switched from an open ...
28
votes
8answers
1k views

Is it safer to use less heard of software than popular software?

Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for ...
10
votes
4answers
478 views

How to convince your boss about importance of IT security

Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security? There are a couple of known good practices in the field of IT security. ...
3
votes
3answers
730 views

How “enforcable” are email disclaimers

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following: This email and any ...
2
votes
3answers
263 views

What are some good references discussing the pros and cons of a company Wi-Fi network for personal use?

I am a software developer at a company that currently does not allow associates to use personal devices at work (ethernet and guest wi-fi alike). This makes it very hard to work on side projects (like ...
2
votes
2answers
231 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
4
votes
2answers
293 views

How to devise a security policy?

I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as ...