Organized Security education, background checks, and other efforts aimed at preventing people within an organization from being part of an attack.

learn more… | top users | synonyms

3
votes
3answers
291 views

System Hardening: Outsource to Security Expert or have Sys Admin do it? [closed]

Can any of you security experts help me make a decision on how to deal with staffing for an initial hardening for an Apache server running MySQL and PHP? We are working on a new site have to do ...
19
votes
9answers
1k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
2
votes
2answers
216 views

Building a web application security focused team

I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have ...
4
votes
3answers
169 views

security performance criteria in employee reviews

Have any of you security professionals been able to get security performance metrics into reviews that managers conduct for their employees? If so, are there any helpful resources you could share to ...
2
votes
0answers
80 views

How do I run an effective IT-Sec Team Meeting? [closed]

I'm looking at revamping how our weekly team meetings are conducted. There is not a lot of techies in the meeting as the majority of operational work is outsourced. I'm not looking for answers about ...
48
votes
8answers
2k views

What are the career paths in the (illegal) computer security field?

As a whitehat pentester I often wonder about the darkside. I see myself working in the office, and imagine that there is someone just like me in China or Romania or in their parent's basement that ...
0
votes
5answers
685 views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
6
votes
3answers
851 views

Theory X vs Theory Y in social engineering

Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require ...
10
votes
2answers
660 views

Security quiz for developers

Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
5
votes
2answers
207 views

Recommendations for documenting security code review

How should I document the results of a security code review? Does anyone know of any resources for reviewers that provide guidance on how they should document their findings? Maybe a document that ...
4
votes
0answers
220 views

How to make sure that previous sysadmin has not compromised corporate IT security? [duplicate]

Possible Duplicate: When a sysadmin leaves what extra precautions need to be taken? A company has been maintaining its ALL internal and external (like google emails, apps, etc.) IT systems ...
5
votes
4answers
227 views

When should I use the word hacker, cracker, or black hat?

Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics. To others, it's the aggressor, bad-guy, cracker, or ...
6
votes
4answers
228 views

What types of background checks of employees are state-of-the-art?

A high security environment requires trust in the integrity of the employees. I am talking about administrators, developers and everyone else who could compromise the security easily. One way to ...
6
votes
2answers
439 views

Outsourcing security evaluation

Does anyone have any experience with outsourcing security code review via freelance sites (like Rent-a-coder, Elance, Guru, Getafreelancer, etc.)? Is this effective? What are the best practices? ...
5
votes
2answers
545 views

Security Manager job description

I work in a growing, family owned business. The company has 300 employees and has landed some big clients who require major policy changes in order to give us their continued business. Among those ...
2
votes
3answers
295 views

Help me find the right Security Consultant for the stage our organization is in

We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the ...
38
votes
3answers
17k views

What are the career paths in the computer security field?

What sorts of jobs are there, in which organizations, with what sorts of day-to-day responsibilities? What areas are good for folks coming out of school, vs what are good 2nd careers for experienced ...
17
votes
11answers
855 views

How to persuade average people that security matters?

If people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing.... So what are the best tips, to persuade a regular user to pay a little more attention to ...
5
votes
2answers
137 views

Standards for hiring trusted personnel - American or Canadian Government?

Is anyone familiar with an ISO standard outlining the hiring of labour for vendors being hired by DHS or Canadian government? I've found security standards but nothing for hiring practices. Edit for ...
4
votes
3answers
835 views

What key attributes indicate candidate potential for future success in a security career?

So you are looking to hire a fresh graduate to work in an entry-level/trainee IT security role that covers a wide range of tasks: vulnerability research, penetration testing, secure software ...
10
votes
4answers
664 views

What should I ask a prospective security consultant?

What should I ask a security consultant to see if they are legitimate or not? I'm looking to hire someone to perform an assessment, but I'd like to make sure that someone is reputable first.
17
votes
5answers
316 views

What questions would the Joel test for Infosec professionals consist of?

See Server Fault and the original test. In other words what are some good questions that an information security professional should ask of a prospective employer? These questions might also lend ...
2
votes
2answers
562 views

What personal traits and characteristics do you look for in a IT Security pro?

IT Security Pros are very smart people who need to give your environment with the respect and care that the business requires. Part 1 What are the traits you look for in an employee before ...
5
votes
5answers
273 views

Does IT policy apply to the Board of Directors? What policies do apply?

What is your experience with applying IT policy to the Board of Directors? Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
5
votes
2answers
142 views

Managing a team of IDS experts; how would you orgainze your team?

Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? ...
2
votes
2answers
197 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...
27
votes
8answers
2k views

When a sysadmin leaves what extra precautions need to be taken?

If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials? Obviously there is also the standard ...
25
votes
5answers
3k views

Professional certifications for IT Security

Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist. Information Security CEH ...