On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do not manage such redirection, another company is tasked to manage the network. Every seat has a laptop running W7 with no restriction at all, that's it, admin user by default. External people can't access the building, we have ID and fingerprint scanners.

I'm trying to "create" a security specific role. I'm new in this company but I'm the only one interested in security here.

So far I've analyzed passwords (every basic password principle is violated lol!), accounts management on servers (disable LDAP accounts when someone leaves, set expirity of temp accounts), privacy issues (webcam, logged sessions when leaving), clean desk policy (although as external people can't access, I'm not sure whether this is going to have any effect) and least privilege (limit access to some resources, admin and user accounts on laptops, prohibit the use of USB sticks).

According to all the stated above, what other security controls could I implement?

2 Answers 2


ISO/IEC 27002 lists 114 security controls they feel everyone should at least consider, but I wouldn't recommend starting there; you need to do a risk assessment first so you know what you have to control.

Don't start with a list of controls, otherwise you'll make a horrible mistake like assuming fingerprints readers mean external people can't access your building.

(Who cleans the kitchen? Who fixes the toilet when it breaks? Who delivers parcels? Who checks your smoke alarms? Who would your lowest paid employee let in if I gave them $5,000? Who would your highest paid employee let in if I threatened to tell his wife?)


I'm new in this company but I'm the only one interested in security here.

If the bold phrase is literally true, you are already deep in trouble and may not be able to be effective in implementing your ideas. IT security is not, and should not, be the responsibility of a single individual. If the security culture of your workplace is lax, as it appears to be, then unless management decides to prioritize security, security will not be a major investment seen as adding value to the business.

As an IT auditor, my experience has been that an corporate IT security policy embraced and modeled by senior management is essential. I would recommend you first consider working with management to adopt a IT security policy first, rather than haphazardly implementing controls.

A good IT security policy should broadly set management expectations in areas such as

  • Employee expectation to commit to protecting company assets and data.
  • How policy will be enforced
  • What consequences can be expected from violation of policy
  • How company assets is to be classified per its "value" to the business

Only after you know what assets will be of most value and how management views its mission in protecting those assets will security controls be effective. After you learned management's stance on IT Security as described within a policy document, then the next step should be a risk assessment. Basically, at this stage you want to answer below questions:

  • What threats / attack sources may threaten valuable assets identified?
  • How likely are such attacks to happen?
  • If an attack succeeded, how severe can the resulting damage be? (impact)
  • What mitigating factors, if any, are in place already to reduce impact? (compensating controls)

Only after completing a risk assessment can security controls be meaningfully recommended to management to be implemented. Having said the above that the "IT security culture" at your company is missing, I see some controls that can be valuable based on limited information you gave.

One of our sites are accessible from outside but we do not manage such redirection, another company is tasked to manage the network

Given the network management is outsourced to a 3rd party, you want to verify controls around the following are in place:

  • Contractual terms - SLA monitoring and right to audit are essential
  • Vendor access to your network - How is access provisioning and deprovisoning governed?
  • User authentication - How is the vendor authenticating the identities of those users coming from the untrusted Internet to your public web facing company application?

You must log in to answer this question.