Organized Security education, background checks, and other efforts aimed at preventing people within an organization from being part of an attack.
-1
votes
1answer
85 views
How do I effectively communicate a security policy? [closed]
Lets break it down to three (C).
c= COMMUNICATE
c= Circulate
c= COMPLY
Accordingly, what approach would deliver the best C's?
2
votes
0answers
64 views
How do I run an effective IT-Sec Team Meeting? [closed]
I'm looking at revamping how our weekly team meetings are conducted. There is not a lot of techies in the meeting as the majority of operational work is outsourced.
I'm not looking for answers about ...
40
votes
8answers
2k views
What are the career paths in the (illegal) computer security field?
As a whitehat pentester I often wonder about the darkside. I see myself working in the office, and imagine that there is someone just like me in China or Romania or in their parent's basement that ...
1
vote
5answers
219 views
How can I prevent forwarding a manipulated email?
How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
5
votes
3answers
541 views
Theory X vs Theory Y in social engineering
Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require ...
-2
votes
1answer
72 views
Is SE a bigger threat than breaking-and-entering or other threats? [closed]
Thinking about this week's topic I thought of something I would love to hear more about:
What is so special about Social Engineering? Is SE a bigger threat than breaking-and-entering?
This is not ...
9
votes
2answers
381 views
Security quiz for developers
Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
4
votes
2answers
151 views
Recommendations for documenting security code review
How should I document the results of a security code review?
Does anyone know of any resources for reviewers that provide guidance on how they should document their findings? Maybe a document that ...
4
votes
0answers
211 views
How to make sure that previous sysadmin has not compromised corporate IT security? [duplicate]
Possible Duplicate:
When a sysadmin leaves what extra precautions need to be taken?
A company has been maintaining its ALL internal and external (like google emails, apps, etc.) IT systems ...
5
votes
4answers
187 views
When should I use the word hacker, cracker, or black hat?
Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics.
To others, it's the aggressor, bad-guy, cracker, or ...
5
votes
3answers
163 views
What types of background checks of employees are state-of-the-art?
A high security environment requires trust in the integrity of the employees. I am talking about administrators, developers and everyone else who could compromise the security easily. One way to ...
6
votes
2answers
392 views
Outsourcing security evaluation
Does anyone have any experience with outsourcing security code review via freelance sites (like Rent-a-coder, Elance, Guru, Getafreelancer, etc.)? Is this effective? What are the best practices? ...
5
votes
2answers
459 views
Security Manager job description
I work in a growing, family owned business. The company has 300 employees and has landed some big clients who require major policy changes in order to give us their continued business. Among those ...
2
votes
3answers
270 views
Help me find the right Security Consultant for the stage our organization is in
We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the ...
26
votes
4answers
5k views
What are the career paths in the computer security field?
What sorts of jobs are there, in which organizations, with what sorts of day-to-day responsibilities?
What areas are good for folks coming out of school, vs what are good 2nd careers for experienced ...
15
votes
11answers
741 views
How to persuade average people that security matters?
If people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing....
So what are the best tips, to persuade a regular user to pay a little more attention to ...
5
votes
2answers
123 views
Standards for hiring trusted personnel - American or Canadian Government?
Is anyone familiar with an ISO standard outlining the hiring of labour for vendors being hired by DHS or Canadian government? I've found security standards but nothing for hiring practices.
Edit for ...
3
votes
3answers
589 views
What key attributes indicate candidate potential for future success in a security career?
So you are looking to hire a fresh graduate to work in an entry-level/trainee IT security role that covers a wide range of tasks: vulnerability research, penetration testing, secure software ...
10
votes
4answers
493 views
What should I ask a prospective security consultant?
What should I ask a security consultant to see if they are legitimate or not?
I'm looking to hire someone to perform an assessment, but I'd like to make sure that someone is reputable first.
16
votes
5answers
290 views
What questions would the Joel test for Infosec professionals consist of?
See Server Fault and the original test. In other words what are some good questions that an information security professional should ask of a prospective employer? These questions might also lend ...
2
votes
2answers
367 views
What personal traits and characteristics do you look for in a IT Security pro?
IT Security Pros are very smart people who need to give your environment with the respect and care that the business requires.
Part 1
What are the traits you look for in an employee before ...
5
votes
5answers
244 views
Does IT policy apply to the Board of Directors? What policies do apply?
What is your experience with applying IT policy to the Board of Directors?
Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
5
votes
2answers
126 views
Managing a team of IDS experts; how would you orgainze your team?
Suppose you are managing a team of Intrusion Detection Experts:
...what are the functional areas of the IDS knowledge space would you group your team into?
...how would you structure your team?
...
2
votes
2answers
163 views
Is WCF or Java Metro security configuration in-scope for your security department; should it be?
Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet.
Given the port sharing abilities of IIS, or even that a web ...
23
votes
8answers
1k views
When a sysadmin leaves what extra precautions need to be taken?
If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials?
Obviously there is also the standard ...
18
votes
5answers
2k views
Professional certifications for IT Security
Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist.
Information Security
CEH ...
