Questions tagged [corporate-policy]
A set of rules for employees of a corporation related to the use of information technology equipment and systems.
237
questions
1
vote
1
answer
77
views
Is Google Drive compliant with control A.8.15 in ISO 27001:2022?
Is Google Drive compliant with control A.8.15 in ISO 27001:2022?
As ISO 27001 requirements for logging and monitoring, are Event logging, Log storage, Protection of logs, and Analysis of logs, could I ...
- 111
1
vote
3
answers
500
views
Sharing internal security policies with potential customers?
We have a set of ISMS documents like master security policy, supplier relations etc. classified as INTERNAL according to data classification policy.
Now a potential customers infosec department is ...
- 115
-1
votes
1
answer
144
views
Difference between the telegram (win1) desktop app and web interface when it is "managed by your organization"?
Sometime ago I was told by our cyber department that Telegram desktop app is not "safe" as it allows silent installation of programs (first I heard about it, and they could not back it by ...
1
vote
2
answers
200
views
What is the reason for Sensitive But Unclassified (SBU)?
I've been reading about security classifications, and have a fundamental question I can't seem to find an answer to. Why does the designation Sensitive But Unclassified (SBU) exist? Why not just ...
- 171
-3
votes
1
answer
103
views
Is Windows 10 Insider Build usable within SOC 2 compliance? [closed]
Or Windows 11 pre-release, just cause I'm curious?
(By employees if that wasn't implicit.)
1
vote
1
answer
150
views
Cyber Essentials at a small business (20 employees) that keeps all business data within SaaS
Background
I've recently joined a rapidly growing small business (from 4 to 20 people in last 12 months) with a very DIY IT setup. It's fallen to me (I'm a developer so I just happen to be sitting ...
- 11
0
votes
0
answers
155
views
What is a good common approach for encrypted backup/restore on an embedded device?
An embedded device with Linux supports backup/restore of files encrypted with openssl. The idea of backup is: tar -c .... | openssl smime -encrypt -binary -aes-256-cbc -out backupfile.encrypted -...
- 101
0
votes
1
answer
118
views
Do the organisational policies need to have ownership to ensure accountability?
Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
- 13
0
votes
1
answer
123
views
Making Users Prove They Have Reviewed The Information Security Policy Documents [closed]
I am looking for a way to hold the departments accountable and ensure they atleast review the policies that we have. I was thinking about using adobe sign but don't want to go cloud. An application ...
- 197
0
votes
1
answer
148
views
Why does Chrome display "Managed by Organisation"? [closed]
My wife inadvertently clicked on a flash player update and suddenly my chrome browser displays that it is being managed by an Organisation.
I tried deleting chrome and reinstalling it but nothing ...
0
votes
2
answers
166
views
Measuring the Risk of Not Managing Risk
I've seen scenarios in which organizations don't invest enough in cybersecurity, are short-handed, and thus have a difficult time meeting the policy requirements defined within their Security Programs....
- 438
2
votes
1
answer
150
views
Requiring an on-site visit to reset a password or get VPN access
This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
- 437
0
votes
1
answer
97
views
Do corporate systems need to be updated immediately after updates are available? [duplicate]
I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
- 5,717
1
vote
3
answers
106
views
What are the best practices in a manufacturing/production facility for data retention?
My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. ...
2
votes
2
answers
1k
views
Job laptop and VPN, security concerns for home network?
I've asked if I could continue working from home. They said ok. The laptop belongs to the company with VPN on it. From home I'll connect the laptop to my personal network/rooter with wifi. When I'll ...
- 23
-2
votes
1
answer
126
views
Do large companies keep a detailed "company log" book/database? [closed]
In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a ...
- 1
1
vote
1
answer
148
views
Is it a good (or not harmful) idea to allow employees to use their company phones privately?
As I try to come up with company regulations for IT security, the question arose if employees can use their company provided iPhones 8 for personal matters. Specifically they want to install spotify (...
- 135
0
votes
0
answers
82
views
Handing login information to the customer
We have a software system with several different users (let's say 10) and a single super user. A super user is a regular user with the privileges needed for managing other user accounts.
This is a ...
- 101
0
votes
2
answers
1k
views
What are the risks from letting users share their own calendars?
I've worked for a variety of technologies companies. In working for startups I've noticed a wide variety of opinions about whether sharing calendars is a security risk. I can imagine that it would ...
- 145
1
vote
1
answer
92
views
VPN gateway software check enforcement as part of access policie
Can a VPN gateway enforce policies in form of checking whether a particular software or set of software is installed on the endpoint and based on that allow / deny the remote connection to be ...
- 1,558
0
votes
1
answer
109
views
Is this a "valid" security policy item?
I'm reading a security policy, which seems to be a system security policy and there is an item that requires the system to implement a specific standard, something like "Implement the standard XYZ". ...
- 35
0
votes
2
answers
847
views
SSO Log Users Out Based on IP Address
We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
32
votes
12
answers
13k
views
How do I check that users don't write down their passwords?
I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
- 445
0
votes
1
answer
291
views
How to prevent contradictions in policies
Some things in policies can be good controls, but the same controls can open up vulnerabilities or can be contradicted by other controls and conditions in other policies.
What can be a good measure ...
user211258
16
votes
4
answers
11k
views
Is it a good security practice to force employees hide their employer to avoid being targeted?
A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, ...
- 279
2
votes
3
answers
239
views
How should security user training be provided when implementing a company BYOD strategy?
Our company is implementing a BYOD policy. I am working with management to draft end user training guidelines / standards as senior member of the Information Security team. Our company is in a ...
- 1,766
1
vote
2
answers
508
views
Basic things that need to be explained to employees about a security policy and at what point in their employment
I was asked this question:
What are the basic things that need to be explained to every employee
about a security policy? At what point in their employment? Why? (List
at least 4 things).
...
- 11
0
votes
2
answers
131
views
Should security policy acknowledgements in a company be customized for IT vs non IT users?
I currently work in the Information Security team at my company. I have been requested by company management to assist in reviewing and revising our current IT security policies. I am a trusted, ...
- 1,766
22
votes
3
answers
3k
views
Should corporate security training be tailored based on a users' job role?
I work in the Information Security team at my workplace. We work in the insurance and healthcare industry and work frequently with customer credit card, financial, and private health data.
Today I ...
- 1,766
2
votes
1
answer
2k
views
What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?
I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like.
...
- 25
0
votes
1
answer
125
views
network icon on lock screen, group policy
In an office setting, where it is an open space design, should I ensure that the laptop has 'Do not display network selection UI', enabled? Why or why not
- 67
0
votes
1
answer
764
views
What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?
I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
- 25
0
votes
2
answers
164
views
Running open relay smtp in company network
We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the ...
- 129
64
votes
5
answers
17k
views
Can Beehive detect a Snowden-like actor?
In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did.
From their ...
- 5,504
35
votes
8
answers
13k
views
Why do companies not give root access to employees on their desktop machines? [duplicate]
Why do companies typically not give their employees root access to their desktop machines that are only used by a single employee?
If what I can do on my machine poses a threat to the rest of the ...
- 477
1
vote
2
answers
158
views
What is the recommanded periodicity for antivirus RAM and disk scans?
Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
- 597
2
votes
2
answers
203
views
Does an admin need legitimaly to access his own logs generated by auditd?
In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
- 597
5
votes
3
answers
2k
views
Aren't endpoint devices inherently MFA?
I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
- 161
312
votes
25
answers
49k
views
Should I let my child's school have access to my kid's personal laptop?
My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. Now the school IT department wants to install some software on the laptop and is asking for ...
- 2,109
0
votes
1
answer
3k
views
Docker + AV on the host
I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question.
What has been the typical solution ...
- 103
1
vote
2
answers
306
views
Should organisations allow their employees connect with a VPN software from their own laptops to their machine at work?
I saw a few breaches on a very large scale where an organization like JP Morgan suffered a huge breach just by allowing their employees to connect via VPN to their machines at work. Seems that hackers ...
27
votes
10
answers
6k
views
How to strike a balance between security policies and practical implementation challenges? [duplicate]
At our organization, we came across some frequent incidents such as:
Reported successful password guessing attacks
Frequent password reset complaints
We started an investigation to identify the ...
- 2,033
2
votes
1
answer
1k
views
EU GDPR - Data protection requirement standards missing?
I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like
Mimimum password length requirements
Second factor authentication
Backup ...
- 4,066
4
votes
3
answers
405
views
Convincing the boss about the importance of privacy and security
I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (...
- 584
4
votes
1
answer
266
views
How should I approach my security team regarding aggressive group policies (VBA / macro blocking)?
My security organization has responded to the threat of macro-based viruses by changing all copies of Excel to no longer run macros/VBA scripts. Through some quick research, it looks like there are ...
0
votes
2
answers
123
views
Why is Multifactor Authentation Presented in Two Steps Instead of One [duplicate]
When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code.
This goes against at least one intuitive line ...
- 1,540
3
votes
2
answers
251
views
How to respond when network info sec check requires run of downloaded unknown .exe?
I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
- 556
2
votes
3
answers
236
views
Convince an executive to mandate HTTPS use on Intranet web servers
I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to ...
- 23
6
votes
2
answers
293
views
How Should a Midsized Startup Approach Information Security and Compliance?
The situation:
An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we'...
- 61
6
votes
4
answers
2k
views
What is the best practice when corporate network is overwriting SSL certificates?
The company I work at has started to overwrite SSL certificates with their own self issued one so that they can monitor traffic to the internet more closely. They also installed the corresponding CA ...
- 63