Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

0
votes
1answer
20 views

Regarding group policy

In an enterprise or office setting, should I set 'Continue experiences on this device' under the group policy to be disabled? Why should I set it to be disabled, or why shouldn't I set it to be ...
0
votes
1answer
30 views

network icon on lock screen, group policy

In an office setting, where it is an open space design, should I ensure that the laptop has 'Do not display network selection UI', enabled? Why or why not
0
votes
1answer
41 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
0
votes
2answers
51 views

Running open relay smtp in company network

We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the ...
61
votes
5answers
16k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
36
votes
8answers
11k views

Why do companies not give root access to employees on their desktop machines? [duplicate]

Why do companies typically not give their employees root access to their desktop machines that are only used by a single employee? If what I can do on my machine poses a threat to the rest of the ...
1
vote
2answers
75 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
2
votes
2answers
97 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
3
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
297
votes
25answers
43k views

Should I let my child's school have access to my kid's personal laptop?

My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. Now the school IT department wants to install some software on the laptop and is asking for ...
0
votes
1answer
462 views

Docker + AV on the host

I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question. What has been the typical solution ...
1
vote
2answers
163 views

Should organisations allow their employees connect with a VPN software from their own laptops to their machine at work?

I saw a few breaches on a very large scale where an organization like JP Morgan suffered a huge breach just by allowing their employees to connect via VPN to their machines at work. Seems that hackers ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
1
vote
1answer
959 views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup ...
4
votes
3answers
258 views

Convincing the boss about the importance of privacy and security

I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (...
4
votes
1answer
157 views

How should I approach my security team regarding aggressive group policies (VBA / macro blocking)?

My security organization has responded to the threat of macro-based viruses by changing all copies of Excel to no longer run macros/VBA scripts. Through some quick research, it looks like there are ...
0
votes
2answers
71 views

Why is Multifactor Authentation Presented in Two Steps Instead of One [duplicate]

When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code. This goes against at least one intuitive line ...
0
votes
0answers
78 views

How is your risk assessment process managed?

My organization is looking at implementing an in house security risk assessment/management process. This is partially to satisfy customers and security audits partially to encourage better practices ...
3
votes
2answers
167 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
3
votes
3answers
183 views

Convince an executive to mandate HTTPS use on Intranet web servers

I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to ...
6
votes
2answers
189 views

How Should a Midsized Startup Approach Information Security and Compliance?

The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data. As we'...
5
votes
4answers
329 views

What is the best practice when corporate network is overwriting SSL certificates?

The company I work at has started to overwrite SSL certificates with their own self issued one so that they can monitor traffic to the internet more closely. They also installed the corresponding CA ...
0
votes
0answers
80 views

Reference to Authoratative Support for VPN over direct server access

TL:DR Seeking highly authoritative references to the security of using VPN to access corporate network services. I am looking to make a persuasive argument in favour of tightly controlled VPN access ...
2
votes
1answer
236 views

Corporate penetration testing/phishing [closed]

If a company employs a security company to 'hack' into their systems and agrees to allow this security company to send fake phishing emails to employees... ...is that company (or the security company)...
1
vote
0answers
54 views

Restricting user sign-in on Chrome for Business

I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut ...
4
votes
2answers
153 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
0
votes
1answer
71 views

A term for a policy that forbids employees storing intellectualy property (e.g. Source Code) on hosted third parties services

To be honest, I was not sure if this belongs to this board or Law Stack Exchange. I am searching for a specific term that describes a policy that a company does not allow itself to share its ...
2
votes
4answers
170 views

Is there a term for over-zealous security policies? [closed]

I work for a company that deals with medical data, so we must comply with HIPAA as well as our desire for plain old corporate security. However, our ops team is quite zealous about the extent to ...
-1
votes
1answer
187 views

ISO 27001 structure and granularity of the content

I'm new to ISO 27001 and my goal is to come up with an ISMS policy for an mid-size organisation. As I did not purchase the standards, I went to read up advisera's articles and went through their free ...
3
votes
3answers
278 views

Is implementing an SSL proxy server considered a good practice?

There are many questions on this site from users finding out that their employer has a certificate proxy in place, essentially implementing a man-in-the-middle attack so that all traffic is able to be ...
1
vote
2answers
57 views

Can a website's privacy policy be made more effective by incorporating it into company bylaws?

I'm concerned primarily about the US, but also UK and Germany. Is there any way to give a privacy policy greater trust, and more effectiveness, by somehow binding it to a company's bylaws with the ...
1
vote
1answer
2k views

Can Google Policy Profile remotely erase all data on the device?

I'd like to configure my company's Google e-mail on my iPhone, however when enabling e-mail profile in Inbox, Gmail, Mail or any other app, the following Device Policy Alert is shown: To use Google ...
1
vote
1answer
2k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
0
votes
1answer
611 views

Should I be concerned if my employer is performing man-in-the-middle HTTPS attacks? [duplicate]

I have reason to believe that my employer may be performing HTTPS man-in-the-middle attacks on company-issued work laptops, as Java's SSL Certificate lists my employer as the Certificate Authority. ...
1
vote
1answer
142 views

Work from home, remote monitoring software, vpn, privacy

So I work for a company where I make and receive phone calls and connect to remote servers and workstations. I work from home, use a company laptop and connect to the company's network via software ...
1
vote
1answer
380 views

Pin change policy for RSA SecurID

My company permits remote access with authentication that includes: username password/phrase (20+ characters) User selected PIN + RSA SecurID token code Our passwords are required to be changed ...
3
votes
1answer
150 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
0
votes
2answers
107 views

Is it reasonable to block Cookies company-wide?

In our company we are using a tool for saving user profile data (like desktop settings, internet settings, cookies, etc.) into a database. During the annual cleanup of this database I discovered that ...
1
vote
0answers
94 views

How do I configure Symantec AV to permit pentesting tools without compromising my organization's network and my host computer?

When performing penetration testing for work, I often have to turn off Symantec Endpoint Protection in order to use certain payloads with Burp Suite and I recently had to do this for something as ...
4
votes
1answer
578 views

Amazon Echo/Dot on your network

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network. Below is the reasons I have come up with so far. This is still the rough list. The ...
4
votes
3answers
1k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
2
votes
3answers
1k views

Why does our Web Security team block web-fonts?

The company that I work for have begun to block web fonts on external domains. This creates a poor UX on most sites given that a large number of assets are generated through the likes of FontAwesome (...
3
votes
3answers
160 views

prevent virus code modifying commonly run executable files?

I have recently been looking into 'cyber essentials questionnaire' and I came across the question "Other than anti-virus software, are access control measures in place to prevent virus code modifying ...
1
vote
0answers
67 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
2
votes
3answers
536 views

forwarding company email to a contractor's email address

We use contractors from out of state and from other countries. An Active Directory account is created, which creates an Exchange email account. We forward email from the Exchange email address to a ...
0
votes
2answers
139 views

Password manager database and keyfile

I'm trying to store passwords more securely in my department. I was thinking about using Keepass, giving each of my colleagues a personal password database and require a simple password (they won't ...
10
votes
3answers
37k views

What Blue Coat Unified Agent application do?

I've experienced crash of Blue Coat Unified Agent tray application on my business laptop. I was wondering what is the exact purpose of this software, and how it suppose to help me or the company? ...
88
votes
13answers
18k views

Company computers for competent developers, how can you deal with them?

This is a follow up on Is there a legitimate reason I should be required to use my company’s computer. Mostly, because I see a huge issue in a couple of specific situations. Had I been in a position ...
0
votes
2answers
73 views

What is a privacy policy?

Im having trouble grasping the definition of a privacy policy. Is it the agreement of user and another party? or can it also be privacy settings a user specify in an application? or is it just the ...
2
votes
2answers
100 views

How to deal with administration tools such as ipscanners and PSTools?

In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools. How do you deal or control the usage of such tools in ...