A set of rules for employees of a corporation related to the use of information technology equipment and systems.
3
votes
2answers
195 views
How to devise a security policy?
I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as ...
3
votes
2answers
572 views
What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?
I'm curious if people have different views on this and why.
Update based on comments:
Defend enterprises.
Quotes:
"Long-time blog readers should know that I don't rely on tools to defend my ...
3
votes
2answers
203 views
Home “datacenter” security, where and what to look for?
This is a question to learn more about security management and physical security.
I'm running a small serverroom in the basement at home, mainly as testbed for attacks I dont want to try on live ...
3
votes
2answers
129 views
Security Training for corporate Facebook users
One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
3
votes
1answer
145 views
Facebook changed the default email address for every contact. How do I mitigate the impact and risk?
Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address.
This is an ...
2
votes
6answers
183 views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
2
votes
2answers
178 views
I just discovered that my sysadmin created a loophole that gives me root access. What should I do?
At our company the Linux system administration is handled by the security team. The guy assigned to my project has been a great big pain, and has seemed to me at several points to be of questionable ...
2
votes
2answers
390 views
Looking for a presentation about information security for corporate employees
I'd appreciate if you could recommend me a presentation the describes the dangers and possible solutions and guidelines, when using the Internet. Specifically, in corporate settings. I would need to ...
2
votes
2answers
163 views
Is WCF or Java Metro security configuration in-scope for your security department; should it be?
Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet.
Given the port sharing abilities of IIS, or even that a web ...
2
votes
1answer
83 views
Windows App Store security
It seems like most companies now a days, give you a crappy laptop with some version of Windows on it that allows you to access the internet (sometimes they block YouTube, Facebook, etc.), comes with ...
2
votes
1answer
124 views
Industrial security — resources for ISO27k compliance, social-engineering trend reports
I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
2
votes
3answers
164 views
What are some good references discussing the pros and cons of a company Wi-Fi network for personal use?
I am a software developer at a company that currently does not allow associates to use personal devices at work (ethernet and guest wi-fi alike). This makes it very hard to work on side projects (like ...
2
votes
1answer
250 views
Clarification needed for NIST's whitepaper “Recommendation for Password-Based Key Derivation”
What are some sample use-cases the NIST is supporting in this policy / whitepaper regarding PBKDF2?
This Recommendation specifies a family of password-based key
derivation functions (PBKDFs) ...
1
vote
5answers
219 views
How can I prevent forwarding a manipulated email?
How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
1
vote
2answers
86 views
How to protect against an attack where a person claims to be in a position of authority?
In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
1
vote
3answers
361 views
Benefits to using EV certificates with a privately hosted Certificate Authority
For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate?
Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
1
vote
2answers
119 views
Policy for remote-access situations?
We have network which users (mostly management, it, and the presidents) use VPN to remote into their work desktops or to use their laptops from home.
After some users took it upon themselves to ...
1
vote
2answers
90 views
Can I instruct a Telco to prevent 2G connections from our phones?
Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices?
Some cell phones are unable to ...
0
votes
5answers
181 views
PCI Policy Management software?
I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation.
I am responsible for creating the policies and ...
-1
votes
1answer
85 views
How do I effectively communicate a security policy? [closed]
Lets break it down to three (C).
c= COMMUNICATE
c= Circulate
c= COMPLY
Accordingly, what approach would deliver the best C's?
-3
votes
1answer
394 views
Clean desk policy/No one giving me clear answer when asking about security procedures [closed]
I got a job working at an IBM lab. Many security procedures I do not see the point of and sometimes find so annoying makes me want to disregard the rules all together. The clean desk policy is in ...
