A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

2
votes
1answer
61 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
6
votes
1answer
179 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, etc)...
-1
votes
1answer
38 views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy" ? I had an argument about this with my management and whilst some think that its basically the same ...
0
votes
2answers
41 views

What can be done to limit corporate Identity theft?

Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for ...
3
votes
2answers
130 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore have ...
1
vote
1answer
59 views

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy?

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013. The ...
1
vote
2answers
64 views

What policies and agreements regarding information security are a must have for every self respecting company?

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered? For example (...
2
votes
4answers
124 views

Should a company physically destroy old HDD?

Is it advisable for a security-minded company (data stored could be client's detailed information, patent pending docs) destroy all replaced HDDs/SSD? Or is it OK to re-sell them online? Information ...
3
votes
0answers
93 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
3
votes
1answer
180 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
8
votes
2answers
797 views

Implications of the proposed Burr-Feinstein senate bill? [closed]

It has been rumoured (I guess it is more than a rumour) that senators Burr and Feinstein will be introducing legislation requiring companies to provide the government (with warrants) access to encrypt ...
1
vote
1answer
129 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
0
votes
1answer
83 views

Surveillance in the Workplace? [closed]

Auditing, surveillance and logging are typical and common place in the workplace, understandably so. These actions are crucial to establishing metrics and performance of the network and its resources. ...
3
votes
1answer
77 views

Adblock to prevent employees from accidentally clicking malicious ads

Our Company allows browsing without restriction such as news, fb, twitter, blogs etc. Would it make sense to have employees install Adblock or similar plugins to prevent (accidentally) clicking ...
21
votes
5answers
2k views

Policy mandate dilemma

When writing security policies do you take into consideration user's (could be vendors) ability/capability to fulfil certain mandates in the policies or do you strictly want them to enforce, no matter ...
5
votes
4answers
147 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
1
vote
1answer
343 views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
5
votes
1answer
142 views

Restricting access to “hacking” sites and tools

I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy. What are the potential benefits and risks of allowing access to such sites to ...
25
votes
5answers
4k views

How does a clean desk policy provide security benefits?

I'm starting to study for Security+ using Darril Gibson's book. I took the pre-exam and one of the questions is “What is the most important security benefit of a clean desk policy?” The choices are: ...
2
votes
7answers
452 views

PCI Policy Management software? [closed]

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
2
votes
2answers
195 views

Why is it dangerous for a company to allow employees to connect their own devices to the internet?

I've heard complaints about allowing employees, clients, etc. to bring their own device and connect it to the network. What exactly is the complaint and how can it be a threat? If no network resources ...
7
votes
5answers
11k views

Prevent network users from creating an unauthorized outgoing VPN connection to avoid network policies

Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies? Edit- What is the best way to detect unauthorized outgoing VPN connections while ...
3
votes
2answers
64 views

How should we set up domain administrators?

We're a small company that is growing pretty fast. For a long time there were 2 of us that were domain administrators. But over the past 2 years this has increased to 6 people and this strikes me as a ...
1
vote
3answers
85 views

How should we store & share documents with restricted access

Up till now we have handled restricting access to documents by having a share on our server that only the 2 accounting people could access and another that only the 2 HR people could access. And ...
6
votes
1answer
126 views

Is online security training effective?

I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
5
votes
1answer
87 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
3
votes
4answers
103 views

Thumbdrive and its obsolescence?

Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to ...
9
votes
4answers
3k views

Why do we trust organizations that certificate ISO 27001?

I've been asked why do we trust organizations that certifies ISO 27001? From where did they get the authority and recognition to be able to certify ISO 27001? For example, I can start a certification ...
12
votes
5answers
2k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to ...
3
votes
2answers
123 views

In CIA triad of information security, what's the difference between confidentiality and availability?

I sometimes get confused between confidentiality and availability. This site defines confidentiality as Measures undertaken to ensure confidentiality are designed to prevent sensitive ...
6
votes
5answers
346 views

What's the real reason behind blocking the social sites? Even legitimate sites like Twitter which acts as a knowledge repository?

I see some sites are blocked for IT security at schools, colleges and offices. But, why are some obvious good sites blocked too?
-1
votes
2answers
84 views

Resources fo Security Awareness training [closed]

as part of security awareness for the company, I am looking for something that I could use to spread the awareness. Maybe a web based application/portal which I can create quiz forms easily or share ...
-1
votes
1answer
56 views

Measuring privacy policy [closed]

I want to measure if the user's data which is collected by the system is mentioned in the privacy policy. What is the best measure that I can use it in such case?
18
votes
5answers
576 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
-1
votes
3answers
182 views

Writing an information security policy [closed]

We are required to write an "information security policy" for our company, and I want to know how much should we cover, and if there are any template or examples that would help.
2
votes
0answers
40 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
8
votes
1answer
150 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...
18
votes
5answers
2k views

At what point in their employment should security policies be explained to an employee?

There are the basic things that need to be explained to every employee about a security policy. For example: How sensitive information must be handled. How to properly maintain your ID, and password,...
1
vote
1answer
47 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
5
votes
4answers
825 views
6
votes
3answers
932 views

How to devise a security policy?

I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as ...
5
votes
3answers
106 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
2
votes
0answers
73 views

Prompt/Notify Users before connecting to PC - Corporate Policy

I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my ...
1
vote
2answers
296 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
1
vote
0answers
70 views

Device Control Policy

I want to blacklist all the external storage devices and only allow specific brand of device such as SanDisk. I had blacklisted the external storage devices by using USBSTOR* and whitelist all the ...
1
vote
1answer
52 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
3
votes
2answers
319 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
6
votes
3answers
345 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
93
votes
10answers
12k views

Prevention measures against laptop seizure at US borders

Since laptop and other electronic device seizures at US borders became legal without a warrant (including making copies of data), 7% of ACTE's business travelers reported being subject to a seizure as ...
4
votes
3answers
681 views

What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?

I'm curious if people have different views on this and why. Update based on comments: Defend enterprises. Quotes: "Long-time blog readers should know that I don't rely on tools to defend my ...