A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

12
votes
2answers
258 views

Establishing routines on what to do if a PC gets stolen

I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal. ...
8
votes
5answers
181 views

Citations for inadvisability of globally unique password

I am looking for an authoritative source to back up my position in a disagreement over password policy. I am having a disagreement with a client about the user identification/authentication process ...
7
votes
1answer
421 views

Should iPhone backups be encrypted? Is this in-scope for Corporate IT if the device is linked to a home pc?

iPhone backups may reside on a computer that is outside of IT Policy (Home PC) and therefore doesn't have any Corporate IT protections on it. If this home PC was stolen or hacked, then the iPhone ...
4
votes
2answers
842 views

What is your approach to handling Guest Internet access?

Suppose you're a company that uses a web proxy to block objectionable content on your corporate network, and this technology may cause issues with some 3rd party VPNs. Or perhaps this 3rd party is ...
5
votes
6answers
6k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
5
votes
5answers
274 views

Does IT policy apply to the Board of Directors? What policies do apply?

What is your experience with applying IT policy to the Board of Directors? Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
2
votes
2answers
207 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...
17
votes
6answers
493 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
5
votes
3answers
146 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
17
votes
5answers
435 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
4
votes
4answers
687 views

What issues are most important to cover in Corporate Security Policy?

What about a Privacy Policy? Both internal, and external. From another Area51 proposal.
28
votes
8answers
2k views

When a sysadmin leaves what extra precautions need to be taken?

If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials? Obviously there is also the standard ...