A set of rules for employees of a corporation related to the use of information technology equipment and systems.

learn more… | top users | synonyms (1)

12
votes
2answers
2k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
5
votes
6answers
7k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
17
votes
5answers
1k views

How to best defend against Targeted Attacks?

We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
30
votes
8answers
3k views

When a sysadmin leaves what extra precautions need to be taken?

If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials? Obviously there is also the standard ...
4
votes
1answer
326 views

How does the mobile security technology APNS and 3LM work?

APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones. I recently got off the phone with Boxtone and they said they ...
17
votes
6answers
579 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
6
votes
3answers
535 views

How to devise a security policy?

I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as ...
9
votes
2answers
755 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
-3
votes
1answer
1k views

Clean desk policy/No one giving me clear answer when asking about security procedures [closed]

I got a job working at an IBM lab. Many security procedures I do not see the point of and sometimes find so annoying makes me want to disregard the rules all together. The clean desk policy is in ...
90
votes
10answers
11k views

Prevention measures against laptop seizure at US borders

Since laptop and other electronic device seizures at US borders became legal without a warrant (including making copies of data), 7% of ACTE's business travelers reported being subject to a seizure as ...
67
votes
15answers
6k views

How to write an email regarding IT Security that will be read, and not ignored by the end user?

I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications. The problem seems to be among people ...
9
votes
4answers
809 views

Security policy for system administrators

I've been in charge of systems administration for a small company for a couple of years and am now training some new collaborators to take over. So far, there has been no security policy, but I would ...
28
votes
8answers
2k views

Is it safer to use less heard of software than popular software?

Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for ...
21
votes
5answers
3k views

What is the most security benefit of a clean desk policy?

Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?” The choices are: ...
18
votes
5answers
531 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
12
votes
4answers
502 views

Where are some Security Policies that are actually in use?

I know there are a lot of security policy samples and templates out in the web. I'm curious to know if there are security policies that are actually in use and still published publicly. I know they ...
8
votes
2answers
2k views

What's the difference between an access control method, security model, and security policy?

(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me). I'm studying for the CISSP exam and I'm getting confused ...
5
votes
1answer
925 views

Clarification needed for NIST's whitepaper “Recommendation for Password-Based Key Derivation”

What are some sample use-cases the NIST is supporting in this policy / whitepaper regarding PBKDF2? This Recommendation specifies a family of password-based key derivation functions (PBKDFs) ...
6
votes
3answers
3k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
2
votes
1answer
299 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
2
votes
1answer
138 views

Are there risks associated with connecting to a public hotspot?

When connecting to a unknown public hotspot, I know that the data transmitted can be captured and, if unencrypted, easily analyzed. But that's not the question here. I want to know whether the ...
2
votes
3answers
882 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
2
votes
6answers
241 views

What are possible approaches and arguments for securing corporate IT systems with most computers being portable?

I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
1
vote
2answers
215 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
11
votes
4answers
702 views

How to convince your boss about importance of IT security

Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security? There are a couple of known good practices in the field of IT security. ...
5
votes
5answers
293 views

Does IT policy apply to the Board of Directors? What policies do apply?

What is your experience with applying IT policy to the Board of Directors? Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
4
votes
0answers
227 views

How to make sure that previous sysadmin has not compromised corporate IT security? [duplicate]

Possible Duplicate: When a sysadmin leaves what extra precautions need to be taken? A company has been maintaining its ALL internal and external (like google emails, apps, etc.) IT systems ...
2
votes
2answers
243 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...