A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

12
votes
2answers
1k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
17
votes
5answers
1k views

How to best defend against Targeted Attacks?

We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
27
votes
8answers
2k views

When a sysadmin leaves what extra precautions need to be taken?

If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials? Obviously there is also the standard ...
5
votes
6answers
6k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
4
votes
1answer
318 views

How does the mobile security technology APNS and 3LM work?

APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones. I recently got off the phone with Boxtone and they said they ...
17
votes
6answers
487 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
-3
votes
1answer
959 views

Clean desk policy/No one giving me clear answer when asking about security procedures [closed]

I got a job working at an IBM lab. Many security procedures I do not see the point of and sometimes find so annoying makes me want to disregard the rules all together. The clean desk policy is in ...
63
votes
15answers
4k views

How to write an email regarding IT Security that will be read, and not ignored by the end user?

I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications. The problem seems to be among people ...
28
votes
8answers
2k views

Is it safer to use less heard of software than popular software?

Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for ...
9
votes
4answers
685 views

Security policy for system administrators

I've been in charge of systems administration for a small company for a couple of years and am now training some new collaborators to take over. So far, there has been no security policy, but I would ...
19
votes
5answers
3k views

What is the most security benefit of a clean desk policy?

Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?” The choices are: ...
17
votes
5answers
418 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
5
votes
1answer
688 views

Clarification needed for NIST's whitepaper “Recommendation for Password-Based Key Derivation”

What are some sample use-cases the NIST is supporting in this policy / whitepaper regarding PBKDF2? This Recommendation specifies a family of password-based key derivation functions (PBKDFs) ...
8
votes
2answers
705 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
7
votes
3answers
2k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
2
votes
1answer
144 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
2
votes
3answers
536 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
2
votes
6answers
219 views

What are possible approaches and arguments for securing corporate IT systems with most computers being portable?

I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
11
votes
4answers
601 views

How to convince your boss about importance of IT security

Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security? There are a couple of known good practices in the field of IT security. ...
5
votes
5answers
274 views

Does IT policy apply to the Board of Directors? What policies do apply?

What is your experience with applying IT policy to the Board of Directors? Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
4
votes
0answers
221 views

How to make sure that previous sysadmin has not compromised corporate IT security? [duplicate]

Possible Duplicate: When a sysadmin leaves what extra precautions need to be taken? A company has been maintaining its ALL internal and external (like google emails, apps, etc.) IT systems ...
2
votes
2answers
202 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...