A set of rules for employees of a corporation related to the use of information technology equipment and systems.
56
votes
15answers
3k views
How to write an email regarding IT Security that will be read, and not ignored by the end user?
I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.
The problem seems to be among people ...
24
votes
8answers
1k views
When a sysadmin leaves what extra precautions need to be taken?
If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials?
Obviously there is also the standard ...
17
votes
6answers
384 views
What policies maximize employee buy-in to security?
Security awareness training is a bane to most employees.
A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
16
votes
5answers
354 views
What are good ways to educate about IT security in a company?
I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
15
votes
5answers
1k views
What is the most security benefit of a clean desk policy?
Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?”
The choices are:
...
12
votes
2answers
228 views
Establishing routines on what to do if a PC gets stolen
I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal.
...
10
votes
4answers
327 views
Where are some Security Policies that are actually in use?
I know there are a lot of security policy samples and templates out in the web. I'm curious to know if there are security policies that are actually in use and still published publicly. I know they ...
10
votes
6answers
413 views
My company policy states I must put all passwords in a password safe shared with management. Is this secure?
As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
10
votes
5answers
468 views
How to best defend against Targeted Attacks?
We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
10
votes
3answers
200 views
open source software security rating — 3rd-party authority
A client is asking my company to write up internal standards that open source software must meet before we will approve it for use on our workstations. Our policy has always been subjective and hard ...
8
votes
7answers
475 views
What are the best reasons you've heard for not implementing security?
We can devise the best technical solution to a security problem, but that solution needs to be applied by people, by a business, to an organization, and/or in spite of objections.
The barriers ...
8
votes
4answers
440 views
Security policy for system administrators
I've been in charge of systems administration for a small company for a couple of years and am now training some new collaborators to take over. So far, there has been no security policy, but I would ...
8
votes
2answers
541 views
Protecting cellphones from USB attacks (a.k.a. Juice Jacking)
We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB.
The visual assumption ...
8
votes
5answers
170 views
Citations for inadvisability of globally unique password
I am looking for an authoritative source to back up my position in a disagreement over password policy.
I am having a disagreement with a client about the user identification/authentication process ...
8
votes
1answer
164 views
What is a practical example of an action that violates the non-interference model?
I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations).
I ...
7
votes
4answers
339 views
How to convince your boss about importance of IT security
Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security?
There are a couple of known good practices in the field of IT security. ...
7
votes
2answers
619 views
What is the procedure to follow against a security breach?
Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information.
One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
7
votes
2answers
720 views
Policy requirements of Sarbanes-Oxley (SOX)
I'm hoping this question will be appropriate for this site. The ServerFault people didn't think it applied to system administrators. Certainly I think it can be answered from a security perspective, ...
7
votes
1answer
363 views
Should iPhone backups be encrypted? Is this in-scope for Corporate IT if the device is linked to a home pc?
iPhone backups may reside on a computer that is outside of IT Policy (Home PC) and therefore doesn't have any Corporate IT protections on it. If this home PC was stolen or hacked, then the iPhone ...
7
votes
2answers
120 views
Is there any security benefit to separating an RFID chip from an ID badge?
This seems to be a question that blurs the line between physical and IT security, but I'm hoping it's relevant enough!
In order to meet with PCI standards, our company recently switched from an open ...
7
votes
2answers
914 views
What's the difference between an access control method, security model, and security policy?
(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).
I'm studying for the CISSP exam and I'm getting confused ...
6
votes
6answers
362 views
Disable internet access of development PC for security
My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
6
votes
5answers
287 views
What's the real reason behind blocking the social sites? Even legitimate sites like twitter which acts as a knowledge repository?
I see some sites are blocked for IT security at schools, colleges and offices. But, why do some obvious good sites are blocked too?
6
votes
3answers
2k views
Changing policy to allow USB drives. Why should I try to stop it?
We are currently in the process of allowing USB memory sticks, but with a stricter policy. Some key points in the policy is:
Any confidential data stored on the USB drive has to be encrypted
Always ...
6
votes
3answers
540 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
6
votes
2answers
207 views
Concerns and Gotcha with Secure Programming Standards Development
I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of ...
5
votes
6answers
4k views
Blocking insecure iPhones from accessing ActiveSync
Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint?
In ...
5
votes
4answers
2k views
Prevent network users from creating an unauthorized outgoing VPN connection to avoid network policies
Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies?
Edit- What is the best way to detect unauthorized outgoing VPN connections while ...
5
votes
5answers
245 views
Does IT policy apply to the Board of Directors? What policies do apply?
What is your experience with applying IT policy to the Board of Directors?
Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
5
votes
2answers
294 views
How to refute “don't use internet if you don't like it” answer?
I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc.
The response I always ...
5
votes
4answers
214 views
How can i deal with management who want 'Domain Admin' access?
While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
5
votes
2answers
462 views
Security Manager job description
I work in a growing, family owned business. The company has 300 employees and has landed some big clients who require major policy changes in order to give us their continued business. Among those ...
5
votes
3answers
134 views
What policies maximize incident detection (and compromise detection)?
What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
5
votes
2answers
105 views
Segregation of Duties of 3 tier Applications
This is a tricky issue I'm dealing with at the office. Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications.
I'm trying to figure ...
5
votes
1answer
853 views
How to deal with tunnel applications such as TeamViewer on the corporate network
Our IT department uses TeamViewer to provide support to users at remote locations. More recently we've noticed that users are using TeamViewer to get support for their lab equipment from vendors.
...
5
votes
2answers
125 views
Standards for hiring trusted personnel - American or Canadian Government?
Is anyone familiar with an ISO standard outlining the hiring of labour for vendors being hired by DHS or Canadian government? I've found security standards but nothing for hiring practices.
Edit for ...
4
votes
4answers
476 views
What issues are most important to cover in Corporate Security Policy?
What about a Privacy Policy? Both internal, and external.
From another Area51 proposal.
4
votes
3answers
167 views
Loss of hardware asset(such as a laptop) that belongs to an organization
What should an organization do if an employee loses their laptop owned by the company. The laptop is used for business purposes, has confidential data and is also encrypted. Are there specific ...
4
votes
3answers
430 views
Why would configuring a Blackberry to turn radio off when charging help with security?
A friend's work Blackberry is configured so that phone and Internet access are disabled while the device is charging. I assumed this was a fault, but apparently it's a deliberate security policy.
Has ...
4
votes
2answers
238 views
Issues with the use of network surveillance tool in your company?
What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ?
And what policies could be ...
4
votes
3answers
168 views
Should a full disk encrypted hard drive on a live system be considered encryption at rest?
If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
4
votes
1answer
201 views
Computer team's password change time different from other users?
We need to determine a password policy for our organization.
All users, in general, will have 90 days until they will have to change their passwords, complexity required and passwords need to be at ...
4
votes
4answers
165 views
Secure file sharing, instead of attaching files to emails?
Allow me to give a background, so you may understand my situation better.
We have been prone to sending emails to unintended recipients, many of which contained confidential data. Email is the only ...
4
votes
1answer
275 views
How does the mobile security technology APNS and 3LM work?
APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones.
I recently got off the phone with Boxtone and they said they ...
4
votes
0answers
211 views
How to make sure that previous sysadmin has not compromised corporate IT security? [duplicate]
Possible Duplicate:
When a sysadmin leaves what extra precautions need to be taken?
A company has been maintaining its ALL internal and external (like google emails, apps, etc.) IT systems ...
3
votes
3answers
323 views
How “enforcable” are email disclaimers
Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following:
This email and any ...
3
votes
2answers
407 views
Is viewing applied group policy on a client PC not considered a minor security breach?
A client on a company can run commands and view the Group Policy settings applied to his own account and computer.
The commands are:
gpresult (and all of its variants)
rsop.msc
In my opinion, ...
3
votes
2answers
217 views
How to convince the boss of an Acceptable Use Policy
So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the ...
3
votes
2answers
109 views
What goes into an average incident response process for a corporate network?
I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
3
votes
2answers
179 views
I just discovered that my sysadmin created a loophole that gives me root access. What should I do?
At our company the Linux system administration is handled by the security team. The guy assigned to my project has been a great big pain, and has seemed to me at several points to be of questionable ...
