A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

1
vote
2answers
198 views

Policy for remote-access situations?

We have network which users (mostly management, it, and the presidents) use VPN to remote into their work desktops or to use their laptops from home. After some users took it upon themselves to ...
1
vote
3answers
174 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
1
vote
1answer
96 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
1
vote
2answers
125 views

Can I instruct a Telco to prevent 2G connections from our phones?

Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices? Some cell phones are unable to ...
1
vote
1answer
39 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
1
vote
1answer
63 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
1
vote
1answer
46 views

How to protect against portable applications

There are many portable apps around that could be downloaded and run on local PCs. Usually running of exe could be blocked by using UAC. however, in this case of portable applications, how do I ...
1
vote
1answer
100 views

Information Security Policy and Information Security Plan

I have a question about the guidance in NIST 800-53. The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information ...
1
vote
3answers
116 views

Question: How to plan email policy for start-ups?

I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're ...
1
vote
1answer
2k views

Does a network behind a NAT\modem firewall need a firewall?

Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough". For the most part the router ...
1
vote
1answer
49 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
1
vote
1answer
60 views

Process of getting approval to make changes in information security infrastructure [closed]

If i were to propose a change in my company's information security infrastructure, how does that proposal get processed up the corporate hierarchy? For example, does the proposal reach the VP of IT ...
1
vote
1answer
113 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
1answer
180 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
1
vote
0answers
26 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
1
vote
0answers
24 views

Prompt/Notify Users before connecting to PC - Corporate Policy

I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my ...
1
vote
0answers
28 views

Device Control Policy

I want to blacklist all the external storage devices and only allow specific brand of device such as SanDisk. I had blacklisted the external storage devices by using USBSTOR* and whitelist all the ...
0
votes
5answers
1k views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
0
votes
1answer
128 views

Do US companies have citizenship requirements for security-related employees? [closed]

Do U.S. based companies or corporations generally have policies restricting their security staff to certain nationalities or are they generally open to all qualified persons regardless of citizenship? ...
0
votes
2answers
96 views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
0
votes
2answers
56 views

The difference of Security Policy and Acceptable Use Policy ?

Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet. Information Security ...
0
votes
1answer
736 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
0
votes
5answers
362 views

PCI Policy Management software?

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
0
votes
1answer
25 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
0
votes
1answer
60 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
-1
votes
3answers
55 views

Writing an information security policy [on hold]

We are required to write an "information security policy" for our company, and I want to know how much should we cover, and if there are any template or examples that would help.
-1
votes
1answer
458 views

Can Chrome's Incognito mode be disabled? [closed]

Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?
-1
votes
1answer
245 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?
-1
votes
2answers
167 views

ISMS for SMB (Small And Medium Enterprise)? [closed]

Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ? The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , ...
-2
votes
2answers
48 views

Resources fo Security Awareness training [closed]

as part of security awareness for the company, I am looking for something that I could use to spread the awareness. Maybe a web based application/portal which I can create quiz forms easily or share ...
-2
votes
1answer
953 views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
-3
votes
1answer
1k views

Clean desk policy/No one giving me clear answer when asking about security procedures [closed]

I got a job working at an IBM lab. Many security procedures I do not see the point of and sometimes find so annoying makes me want to disregard the rules all together. The clean desk policy is in ...
-9
votes
2answers
169 views

Why does a business need to secure its email system? [closed]

Why is important for a business to secure its email system?