A set of rules for employees of a corporation related to the use of information technology equipment and systems.
5
votes
4answers
203 views
How can i deal with management who want 'Domain Admin' access?
While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
5
votes
2answers
99 views
Segregation of Duties of 3 tier Applications
This is a tricky issue I'm dealing with at the office. Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications.
I'm trying to figure ...
4
votes
3answers
151 views
Should a full disk encrypted hard drive on a live system be considered encryption at rest?
If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
8
votes
2answers
524 views
Protecting cellphones from USB attacks (a.k.a. Juice Jacking)
We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB.
The visual assumption ...
15
votes
5answers
979 views
What is the most security benefit of a clean desk policy?
Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?”
The choices are:
...
-1
votes
1answer
84 views
How do I effectively communicate a security policy? [closed]
Lets break it down to three (C).
c= COMMUNICATE
c= Circulate
c= COMPLY
Accordingly, what approach would deliver the best C's?
-3
votes
1answer
383 views
Clean desk policy/No one giving me clear answer when asking about security procedures [closed]
I got a job working at an IBM lab. Many security procedures I do not see the point of and sometimes find so annoying makes me want to disregard the rules all together. The clean desk policy is in ...
1
vote
2answers
86 views
How to protect against an attack where a person claims to be in a position of authority?
In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
4
votes
3answers
153 views
Loss of hardware asset(such as a laptop) that belongs to an organization
What should an organization do if an employee loses their laptop owned by the company. The laptop is used for business purposes, has confidential data and is also encrypted. Are there specific ...
5
votes
6answers
4k views
Blocking insecure iPhones from accessing ActiveSync
Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint?
In ...
2
votes
1answer
83 views
Windows App Store security
It seems like most companies now a days, give you a crappy laptop with some version of Windows on it that allows you to access the internet (sometimes they block YouTube, Facebook, etc.), comes with ...
8
votes
5answers
170 views
Citations for inadvisability of globally unique password
I am looking for an authoritative source to back up my position in a disagreement over password policy.
I am having a disagreement with a client about the user identification/authentication process ...
1
vote
5answers
218 views
How can I prevent forwarding a manipulated email?
How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
3
votes
2answers
101 views
What goes into an average incident response process for a corporate network?
I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
4
votes
4answers
158 views
Secure file sharing, instead of attaching files to emails?
Allow me to give a background, so you may understand my situation better.
We have been prone to sending emails to unintended recipients, many of which contained confidential data. Email is the only ...
0
votes
5answers
178 views
PCI Policy Management software?
I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation.
I am responsible for creating the policies and ...
5
votes
2answers
123 views
Standards for hiring trusted personnel - American or Canadian Government?
Is anyone familiar with an ISO standard outlining the hiring of labour for vendors being hired by DHS or Canadian government? I've found security standards but nothing for hiring practices.
Edit for ...
10
votes
6answers
396 views
My company policy states I must put all passwords in a password safe shared with management. Is this secure?
As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
6
votes
3answers
491 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
2
votes
2answers
178 views
I just discovered that my sysadmin created a loophole that gives me root access. What should I do?
At our company the Linux system administration is handled by the security team. The guy assigned to my project has been a great big pain, and has seemed to me at several points to be of questionable ...
7
votes
2answers
118 views
Is there any security benefit to separating an RFID chip from an ID badge?
This seems to be a question that blurs the line between physical and IT security, but I'm hoping it's relevant enough!
In order to meet with PCI standards, our company recently switched from an open ...
7
votes
4answers
330 views
How to convince your boss about importance of IT security
Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security?
There are a couple of known good practices in the field of IT security. ...
3
votes
3answers
296 views
How “enforcable” are email disclaimers
Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following:
This email and any ...
2
votes
2answers
384 views
Looking for a presentation about information security for corporate employees
I'd appreciate if you could recommend me a presentation the describes the dangers and possible solutions and guidelines, when using the Internet. Specifically, in corporate settings. I would need to ...
2
votes
3answers
164 views
What are some good references discussing the pros and cons of a company Wi-Fi network for personal use?
I am a software developer at a company that currently does not allow associates to use personal devices at work (ethernet and guest wi-fi alike). This makes it very hard to work on side projects (like ...
3
votes
2answers
195 views
How to devise a security policy?
I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as ...
3
votes
1answer
145 views
Facebook changed the default email address for every contact. How do I mitigate the impact and risk?
Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address.
This is an ...
7
votes
1answer
360 views
Should iPhone backups be encrypted? Is this in-scope for Corporate IT if the device is linked to a home pc?
iPhone backups may reside on a computer that is outside of IT Policy (Home PC) and therefore doesn't have any Corporate IT protections on it. If this home PC was stolen or hacked, then the iPhone ...
7
votes
2answers
602 views
What is the procedure to follow against a security breach?
Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information.
One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
6
votes
3answers
2k views
Changing policy to allow USB drives. Why should I try to stop it?
We are currently in the process of allowing USB memory sticks, but with a stricter policy. Some key points in the policy is:
Any confidential data stored on the USB drive has to be encrypted
Always ...
4
votes
1answer
270 views
How does the mobile security technology APNS and 3LM work?
APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones.
I recently got off the phone with Boxtone and they said they ...
1
vote
2answers
90 views
Can I instruct a Telco to prevent 2G connections from our phones?
Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices?
Some cell phones are unable to ...
23
votes
8answers
1k views
When a sysadmin leaves what extra precautions need to be taken?
If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials?
Obviously there is also the standard ...
2
votes
6answers
183 views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
56
votes
15answers
3k views
How to write an email regarding IT Security that will be read, and not ignored by the end user?
I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.
The problem seems to be among people ...
4
votes
0answers
211 views
How to make sure that previous sysadmin has not compromised corporate IT security? [duplicate]
Possible Duplicate:
When a sysadmin leaves what extra precautions need to be taken?
A company has been maintaining its ALL internal and external (like google emails, apps, etc.) IT systems ...
2
votes
1answer
124 views
Industrial security — resources for ISO27k compliance, social-engineering trend reports
I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
3
votes
2answers
203 views
Home “datacenter” security, where and what to look for?
This is a question to learn more about security management and physical security.
I'm running a small serverroom in the basement at home, mainly as testbed for attacks I dont want to try on live ...
3
votes
2answers
129 views
Security Training for corporate Facebook users
One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
6
votes
6answers
360 views
Disable internet access of development PC for security
My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
5
votes
2answers
281 views
How to refute “don't use internet if you don't like it” answer?
I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc.
The response I always ...
1
vote
2answers
118 views
Policy for remote-access situations?
We have network which users (mostly management, it, and the presidents) use VPN to remote into their work desktops or to use their laptops from home.
After some users took it upon themselves to ...
3
votes
2answers
366 views
Is viewing applied group policy on a client PC not considered a minor security breach?
A client on a company can run commands and view the Group Policy settings applied to his own account and computer.
The commands are:
gpresult (and all of its variants)
rsop.msc
In my opinion, ...
5
votes
4answers
2k views
Prevent network users from creating an unauthorized outgoing VPN connection to avoid network policies
Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies?
Edit- What is the best way to detect unauthorized outgoing VPN connections while ...
7
votes
7answers
467 views
What are the best reasons you've heard for not implementing security?
We can devise the best technical solution to a security problem, but that solution needs to be applied by people, by a business, to an organization, and/or in spite of objections.
The barriers ...
7
votes
2answers
654 views
Policy requirements of Sarbanes-Oxley (SOX)
I'm hoping this question will be appropriate for this site. The ServerFault people didn't think it applied to system administrators. Certainly I think it can be answered from a security perspective, ...
4
votes
1answer
199 views
Computer team's password change time different from other users?
We need to determine a password policy for our organization.
All users, in general, will have 90 days until they will have to change their passwords, complexity required and passwords need to be at ...
6
votes
5answers
286 views
What's the real reason behind blocking the social sites? Even legitimate sites like twitter which acts as a knowledge repository?
I see some sites are blocked for IT security at schools, colleges and offices. But, why do some obvious good sites are blocked too?
5
votes
5answers
244 views
Does IT policy apply to the Board of Directors? What policies do apply?
What is your experience with applying IT policy to the Board of Directors?
Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
4
votes
3answers
415 views
Why would configuring a Blackberry to turn radio off when charging help with security?
A friend's work Blackberry is configured so that phone and Internet access are disabled while the device is charging. I assumed this was a fault, but apparently it's a deliberate security policy.
Has ...
