Hot answers tagged corporate-policy
79
A small trick I learned years ago - lay your email out like this:
Short Version
Small number of very short succinct points
If X, then you need to do this
Else, then you need to do that (or don't need to do anything)
Long Version or Full Details
...and here you lay out whatever full version you want.
97% of your users will never ...
27
Clean desks policies are quite literal. They don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all. So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours.
Sensitive data doesn't only include password. ...
22
Trevor Paglen's book about USA Department of Defense secrecy Blank Spots on the Map has an illuminating incident. During the Manhattan Project, a Los Alamos physicist got in trouble for leaving an orange on his desk after lunch. The Manhattan Project security people had a policy against leaving spherical objects out in the open, probably because the atom ...
18
As @gowenfawr says many users will not read messages no matter what you do.
So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism.
This can be simple, using social approach - for example asking users an essentially fake question while providing ...
14
An admin should never have "super user credentials" that cannot be removed by simply removing his user account or move the user account to a group that lacks the permission.
An example: The admin logs in to a Linux system with his own account and uses sudo somecommand to do things that requires root permission. You don't allow this admin user to actually ...
12
@ChrisAD
From personal experience:
Key prerequisite is an effective asset register. Otherwise you wont even know if it is one of your laptops / pc's that is missing or that turns up on the front page of the daily mail (well ok they may help in letting you know it was your device!).
Secondly - Establish a clear requirement and ability for your staff to ...
12
I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header:
Please read this carefully - It's not just the usual yada yada.
Because of the light hearted nature of this, I found myself to read the docs ...
11
There are all sorts of security risks - the ones I tend to highlight are:
The big social networking sites are a
wonderful target for attackers.
Imagine a group of over a billion
users, most of whom are not
technically savvy, that all use the
same web app (eg Facebook) and have
personal data, links to others etc.
So take it as read that these sites
are ...
11
IMHO it is doing the un-sexy things consistently that will provide you the best defences against even targeted attacks and "APT's".
As I wrote when RSA provided details of their advanced attack good lessons learnt are:
Email as a malware distribution mechanism is not dead. Dig out those user awareness presentations and add some training on spear phishing ...
10
Paradoxically, the first responsibility of the security training is to show why the security training is important, interesting to you (the employee), and relevant (for your work).
Any training (at least the first-time awareness trainings) must start with this, or at least lead up to it very quickly, otherwise its pointless.
Though it seems from your WTF ...
10
This may be seen more as a template than a policy, but I think it's worth mentioning here.
The U.S. National Institute of Standards and Technology has a number of Special Publications (SPs) regarding the security of information systems. These are collectively called the 800 series, as all of them have numeric designations beginning with 800. They are used ...
10
You will likely not find too many people or groups who will vouch for OSS product's security because it could put them at risk of being legally liable. While reputation is a part of a measure, it is hard to quantify and people like hard numbers. Here are some factors you could consider.
Has it been independently reviewed?
Ok here's your numbers. Coverity ...
10
Some points that come to my mind:
Be concise and precise. Too long messages are usually dropped.
Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short).
If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...
10
Serverfault has a great canonical answer on "what should we do now to clean up this mess", so I'll take a stab at "what should we do to prevent this happening ever again".
Your organisation needs to establish an "employee leaving" process and stick to it.
Your organisation will need to work out if they should treat all terminations the same, or differently ...
9
It does depend quite a lot on if the admin left on good terms and how complex your network is but some good steps to take are. I have worked with a number of organisations that take some of these steps but none of them take them all. A lot of them only revoke the user credentials and only take further steps if the admin left on bad terms or was going to a ...
9
I certainly think it would be useful to mandate that devices are backed up in an encrypted format, if the reason for using local encryption is that you intend the data to be encrypted ;).
On the iPhone side, you would implement the security policy using Apple's iPhone Configuration Utility to create configuration profiles that control how the device is set ...
9
The non-interference model is all about preventing covert channels through shared resources or inference attacks.
An example can be the following:
Suppose that two users of different security levels are working on the same system (remotely, using shells for example).
The lower level user should not be know anything about the work done by the higher level ...
9
One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly.
For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...
8
Many companies are very nervous about publishing their policies for obvious reasons. The merit of those reasons, however, is beside the point. On the other hand, I have had great luck finding such policies at educational sites.
Because of the specific environment within an educational institution standards and policies are typically made publicly available. ...
8
The kind of attack you are talking is popularly coined as "Juice Jacking".
Are there any "known bad" or "known safe" smartphones with regard to USB security?
In my knowledge, NO.
How does a corporation protect from these risks?
By making policies (actually spreading awareness) about the threat
as many people yet aren't aware about it.
And ...
8
No.
Well, yes, but probably not the way you're thinking. You'd have to block all outbound traffic by default, and then white-list only the outside hosts (not ports, not services) which you can guarantee won't be usable to bounce traffic (generally because they are also similarly restricted).
If you wanted to block all traffic types that for which tools ...
8
First of all, I'm in the camp that thinks this is a terrible idea. Security is about trade-offs, usually trading potential safety against convenience. But in a business environment it's all about costs. The cost of a potentially malicious outside influence in your source code (which is dubious at best) would have to outweigh the increase in development ...
8
Firstly I would answer the question "Is it within my remit to be worried by this". Presumably the sys-admins have a team lead or line manager, and it is their responsibility, not yours. You may be letting emotions cloud judgement a bit.
A good place to start if you want to get involved regardless is to propose some level of change control. Putting all ...
7
discovering all the answers in the raw HTML code
Isn't it slightly hard to take security training seriously, when the training is that easy to subvert?
For job related security code-review or peer review with positive feedback is probably the best way.
When you get down to it, hiring employees that care is the most important policy followed with ...
7
Launching a "simulated" attack against your company's network should only be done with explicit, written permission of senior management based on an understanding of the scope of your work and agreed limitations on the results of your attack. Otherwise you risk getting yourself fired for sabotage, espionage, or just plain violating local rules.
But how do ...
7
What has worked on several occasions for me is to stick the following chart in front of management:
Run down the list of threats (left column) and ask if they believe if any of those type people described may harm the business.
If so, then you may have won a battle. Now you can describe what is needed to address each of those threats.
@atdre had a ...
7
USB drives allow the propagation of data without control from the network firewall -- so any reason why such a firewall was set in the first place is a good reason to ban USB drives.
I do not see how you could enforce a policy of no-private usage. People will use USB drives to transfer private data, if only the latest photographs of their dog, and there is ...
7
I have built a business case, got funding and implemented removable media controls at a large bank. I wrote about my lessons learned here.
The key reasons on why you need removable media controls:
Data loss prevention - if you lose a removable device with lots of valuable data on it you don't get fined by the regulator, face data breech reporting and lose ...
7
Alright, so this was originally intended as a comment to your response to the answer given by @jl01 but it became too long and it should have merit on it's own....
There's almost an art to creating policies. Ideally (though i'm sure some people would disagree with me) a policy would be a very general statement regarding the topic. For example, something ...
7
I think you can't look at just one mail message. Having watched our IT and ITSEC groups evolve over the years, I've noticed that the common perception of them has to do with the overall body of emails they put out, nothing gets fixed with just a few great emails.
Here's some overall thoughts:
don't use just one communication medium - I know you want to ...
Only top voted, non community-wiki answers of a minimum length are eligible
