Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
0
votes
1answer
80 views

Making Users Prove They Have Reviewed The Information Security Policy Documents [closed]

I am looking for a way to hold the departments accountable and ensure they atleast review the policies that we have.  I was thinking about using adobe sign but don't want to go cloud.  An application ...
0
votes
1answer
93 views

Why does Chrome display “Managed by Organisation”? [closed]

My wife inadvertently clicked on a flash player update and suddenly my chrome browser displays that it is being managed by an Organisation. I tried deleting chrome and reinstalling it but nothing ...
0
votes
1answer
66 views

Measuring the Risk of Not Managing Risk

I've seen scenarios in which organizations don't invest enough in cybersecurity, are short-handed, and thus have a difficult time meeting the policy requirements defined within their Security Programs....
1
vote
1answer
62 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
0
votes
0answers
34 views

What's Gitlab token generation policy?

I'm searching for the GitLab token generation policy but nothing found on documentation : encryption method (RSA, ECDSA, ...), key length, expiration policy, ... It's to know if it's in agreement with ...
0
votes
1answer
49 views

Do corporate systems need to be updated immediately after updates are available? [duplicate]

I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
1
vote
3answers
63 views

What are the best practices in a manufacturing/production facility for data retention?

My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. ...
2
votes
2answers
368 views

Job laptop and VPN, security concerns for home network?

I've asked if I could continue working from home. They said ok. The laptop belongs to the company with VPN on it. From home I'll connect the laptop to my personal network/rooter with wifi. When I'll ...
-2
votes
1answer
57 views

Do large companies keep a detailed “company log” book/database? [closed]

In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a ...
1
vote
1answer
60 views

Is it a good (or not harmful) idea to allow employees to use their company phones privately?

As I try to come up with company regulations for IT security, the question arose if employees can use their company provided iPhones 8 for personal matters. Specifically they want to install spotify (...
0
votes
0answers
35 views

Handing login information to the customer

We have a software system with several different users (let's say 10) and a single super user. A super user is a regular user with the privileges needed for managing other user accounts. This is a ...
0
votes
2answers
132 views

What are the risks from letting users share their own calendars?

I've worked for a variety of technologies companies. In working for startups I've noticed a wide variety of opinions about whether sharing calendars is a security risk. I can imagine that it would ...
1
vote
1answer
47 views

VPN gateway software check enforcement as part of access policie

Can a VPN gateway enforce policies in form of checking whether a particular software or set of software is installed on the endpoint and based on that allow / deny the remote connection to be ...
0
votes
1answer
61 views

Is this a “valid” security policy item?

I'm reading a security policy, which seems to be a system security policy and there is an item that requires the system to implement a specific standard, something like "Implement the standard XYZ". ...
0
votes
2answers
146 views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
31
votes
12answers
13k views

How do I check that users don't write down their passwords?

I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
1
vote
1answer
189 views

How to prevent contradictions in policies

Some things in policies can be good controls, but the same controls can open up vulnerabilities or can be contradicted by other controls and conditions in other policies. What can be a good measure ...
16
votes
4answers
10k views

Is it a good security practice to force employees hide their employer to avoid being targeted?

A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, ...
2
votes
3answers
186 views

How should security user training be provided when implementing a company BYOD strategy?

Our company is implementing a BYOD policy. I am working with management to draft end user training guidelines / standards as senior member of the Information Security team. Our company is in a ...
1
vote
2answers
277 views

Basic things that need to be explained to employees about a security policy and at what point in their employment

I was asked this question: What are the basic things that need to be explained to every employee about a security policy? At what point in their employment? Why? (List at least 4 things). ...
0
votes
2answers
74 views

Should security policy acknowledgements in a company be customized for IT vs non IT users?

I currently work in the Information Security team at my company. I have been requested by company management to assist in reviewing and revising our current IT security policies. I am a trusted, ...
22
votes
3answers
3k views

Should corporate security training be tailored based on a users' job role?

I work in the Information Security team at my workplace. We work in the insurance and healthcare industry and work frequently with customer credit card, financial, and private health data. Today I ...
2
votes
1answer
197 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
0
votes
1answer
72 views

network icon on lock screen, group policy

In an office setting, where it is an open space design, should I ensure that the laptop has 'Do not display network selection UI', enabled? Why or why not
0
votes
1answer
229 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
0
votes
2answers
81 views

Running open relay smtp in company network

We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the ...
64
votes
5answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
35
votes
8answers
12k views

Why do companies not give root access to employees on their desktop machines? [duplicate]

Why do companies typically not give their employees root access to their desktop machines that are only used by a single employee? If what I can do on my machine poses a threat to the rest of the ...
1
vote
2answers
92 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
2
votes
2answers
118 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
5
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
305
votes
25answers
46k views

Should I let my child's school have access to my kid's personal laptop?

My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. Now the school IT department wants to install some software on the laptop and is asking for ...
0
votes
1answer
2k views

Docker + AV on the host

I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question. What has been the typical solution ...
1
vote
2answers
223 views

Should organisations allow their employees connect with a VPN software from their own laptops to their machine at work?

I saw a few breaches on a very large scale where an organization like JP Morgan suffered a huge breach just by allowing their employees to connect via VPN to their machines at work. Seems that hackers ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
2
votes
1answer
1k views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup ...
4
votes
3answers
306 views

Convincing the boss about the importance of privacy and security

I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (...
4
votes
1answer
197 views

How should I approach my security team regarding aggressive group policies (VBA / macro blocking)?

My security organization has responded to the threat of macro-based viruses by changing all copies of Excel to no longer run macros/VBA scripts. Through some quick research, it looks like there are ...
0
votes
2answers
76 views

Why is Multifactor Authentation Presented in Two Steps Instead of One [duplicate]

When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code. This goes against at least one intuitive line ...
3
votes
2answers
206 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
2
votes
3answers
189 views

Convince an executive to mandate HTTPS use on Intranet web servers

I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to ...
6
votes
2answers
239 views

How Should a Midsized Startup Approach Information Security and Compliance?

The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data. As we'...
5
votes
4answers
871 views

What is the best practice when corporate network is overwriting SSL certificates?

The company I work at has started to overwrite SSL certificates with their own self issued one so that they can monitor traffic to the internet more closely. They also installed the corresponding CA ...
2
votes
1answer
255 views

Corporate penetration testing/phishing [closed]

If a company employs a security company to 'hack' into their systems and agrees to allow this security company to send fake phishing emails to employees... ...is that company (or the security company)...
1
vote
1answer
101 views

Restricting user sign-in on Chrome for Business

I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut ...
4
votes
2answers
259 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
0
votes
1answer
77 views

A term for a policy that forbids employees storing intellectualy property (e.g. Source Code) on hosted third parties services

To be honest, I was not sure if this belongs to this board or Law Stack Exchange. I am searching for a specific term that describes a policy that a company does not allow itself to share its ...
2
votes
4answers
208 views

Is there a term for over-zealous security policies? [closed]

I work for a company that deals with medical data, so we must comply with HIPAA as well as our desire for plain old corporate security. However, our ops team is quite zealous about the extent to ...
-1
votes
1answer
269 views

ISO 27001 structure and granularity of the content

I'm new to ISO 27001 and my goal is to come up with an ISMS policy for an mid-size organisation. As I did not purchase the standards, I went to read up advisera's articles and went through their free ...
3
votes
3answers
524 views

Is implementing an SSL proxy server considered a good practice?

There are many questions on this site from users finding out that their employer has a certificate proxy in place, essentially implementing a man-in-the-middle attack so that all traffic is able to be ...

1
2 3 4 5