Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
31
votes
12answers
12k views

How do I check that users don't write down their passwords?

I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
0
votes
1answer
138 views

How to prevent contradictions in policies

Some things in policies can be good controls, but the same controls can open up vulnerabilities or can be contradicted by other controls and conditions in other policies. What can be a good measure ...
16
votes
4answers
10k views

Is it a good security practice to force employees hide their employer to avoid being targeted?

A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, ...
2
votes
3answers
162 views

How should security user training be provided when implementing a company BYOD strategy?

Our company is implementing a BYOD policy. I am working with management to draft end user training guidelines / standards as senior member of the Information Security team. Our company is in a ...
0
votes
2answers
180 views

Basic things that need to be explained to employees about a security policy and at what point in their employment

I have was asked this question: What are the basic things that need to be explained to every employee about a security policy? At what point in their employment? Why? (List at least 4 things). ...
0
votes
2answers
66 views

Should security policy acknowledgements in a company be customized for IT vs non IT users?

I currently work in the Information Security team at my company. I have been requested by company management to assist in reviewing and revising our current IT security policies. I am a trusted, ...
22
votes
3answers
3k views

Should corporate security training be tailored based on a users' job role?

I work in the Information Security team at my workplace. We work in the insurance and healthcare industry and work frequently with customer credit card, financial, and private health data. Today I ...
0
votes
0answers
21 views

Check OpenVAS tests

I have a list of security policies that need to be implemented. These are for example: standard passwords shall not be used and must be replaced. standard admin accounts like root and admin shall be ...
2
votes
1answer
69 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
0
votes
1answer
52 views

network icon on lock screen, group policy

In an office setting, where it is an open space design, should I ensure that the laptop has 'Do not display network selection UI', enabled? Why or why not
0
votes
1answer
55 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
0
votes
2answers
63 views

Running open relay smtp in company network

We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the ...
62
votes
5answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
35
votes
8answers
11k views

Why do companies not give root access to employees on their desktop machines? [duplicate]

Why do companies typically not give their employees root access to their desktop machines that are only used by a single employee? If what I can do on my machine poses a threat to the rest of the ...
1
vote
2answers
82 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
2
votes
2answers
102 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
5
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
299
votes
25answers
44k views

Should I let my child's school have access to my kid's personal laptop?

My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. Now the school IT department wants to install some software on the laptop and is asking for ...
0
votes
1answer
1k views

Docker + AV on the host

I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question. What has been the typical solution ...
1
vote
2answers
175 views

Should organisations allow their employees connect with a VPN software from their own laptops to their machine at work?

I saw a few breaches on a very large scale where an organization like JP Morgan suffered a huge breach just by allowing their employees to connect via VPN to their machines at work. Seems that hackers ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
2
votes
1answer
1k views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup ...
4
votes
3answers
273 views

Convincing the boss about the importance of privacy and security

I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (...
4
votes
1answer
176 views

How should I approach my security team regarding aggressive group policies (VBA / macro blocking)?

My security organization has responded to the threat of macro-based viruses by changing all copies of Excel to no longer run macros/VBA scripts. Through some quick research, it looks like there are ...
0
votes
2answers
76 views

Why is Multifactor Authentation Presented in Two Steps Instead of One [duplicate]

When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code. This goes against at least one intuitive line ...
3
votes
2answers
193 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
3
votes
3answers
185 views

Convince an executive to mandate HTTPS use on Intranet web servers

I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to ...
6
votes
2answers
215 views

How Should a Midsized Startup Approach Information Security and Compliance?

The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data. As we'...
5
votes
4answers
424 views

What is the best practice when corporate network is overwriting SSL certificates?

The company I work at has started to overwrite SSL certificates with their own self issued one so that they can monitor traffic to the internet more closely. They also installed the corresponding CA ...
2
votes
1answer
245 views

Corporate penetration testing/phishing [closed]

If a company employs a security company to 'hack' into their systems and agrees to allow this security company to send fake phishing emails to employees... ...is that company (or the security company)...
1
vote
1answer
70 views

Restricting user sign-in on Chrome for Business

I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut ...
4
votes
2answers
175 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
0
votes
1answer
76 views

A term for a policy that forbids employees storing intellectualy property (e.g. Source Code) on hosted third parties services

To be honest, I was not sure if this belongs to this board or Law Stack Exchange. I am searching for a specific term that describes a policy that a company does not allow itself to share its ...
2
votes
4answers
184 views

Is there a term for over-zealous security policies? [closed]

I work for a company that deals with medical data, so we must comply with HIPAA as well as our desire for plain old corporate security. However, our ops team is quite zealous about the extent to ...
-1
votes
1answer
219 views

ISO 27001 structure and granularity of the content

I'm new to ISO 27001 and my goal is to come up with an ISMS policy for an mid-size organisation. As I did not purchase the standards, I went to read up advisera's articles and went through their free ...
3
votes
3answers
393 views

Is implementing an SSL proxy server considered a good practice?

There are many questions on this site from users finding out that their employer has a certificate proxy in place, essentially implementing a man-in-the-middle attack so that all traffic is able to be ...
1
vote
2answers
59 views

Can a website's privacy policy be made more effective by incorporating it into company bylaws?

I'm concerned primarily about the US, but also UK and Germany. Is there any way to give a privacy policy greater trust, and more effectiveness, by somehow binding it to a company's bylaws with the ...
1
vote
1answer
3k views

Can Google Policy Profile remotely erase all data on the device?

I'd like to configure my company's Google e-mail on my iPhone, however when enabling e-mail profile in Inbox, Gmail, Mail or any other app, the following Device Policy Alert is shown: To use Google ...
1
vote
1answer
3k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
0
votes
1answer
706 views

Should I be concerned if my employer is performing man-in-the-middle HTTPS attacks? [duplicate]

I have reason to believe that my employer may be performing HTTPS man-in-the-middle attacks on company-issued work laptops, as Java's SSL Certificate lists my employer as the Certificate Authority. ...
1
vote
1answer
157 views

Work from home, remote monitoring software, vpn, privacy

So I work for a company where I make and receive phone calls and connect to remote servers and workstations. I work from home, use a company laptop and connect to the company's network via software ...
1
vote
1answer
459 views

Pin change policy for RSA SecurID

My company permits remote access with authentication that includes: username password/phrase (20+ characters) User selected PIN + RSA SecurID token code Our passwords are required to be changed ...
3
votes
1answer
150 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
0
votes
2answers
114 views

Is it reasonable to block Cookies company-wide?

In our company we are using a tool for saving user profile data (like desktop settings, internet settings, cookies, etc.) into a database. During the annual cleanup of this database I discovered that ...
1
vote
1answer
160 views

How do I configure Symantec AV to permit pentesting tools without compromising my organization's network and my host computer?

When performing penetration testing for work, I often have to turn off Symantec Endpoint Protection in order to use certain payloads with Burp Suite and I recently had to do this for something as ...
3
votes
1answer
637 views

Amazon Echo/Dot on your network

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network. Below is the reasons I have come up with so far. This is still the rough list. The ...
5
votes
3answers
2k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
4
votes
3answers
2k views

Why does our Web Security team block web-fonts?

The company that I work for have begun to block web fonts on external domains. This creates a poor UX on most sites given that a large number of assets are generated through the likes of FontAwesome (...
2
votes
3answers
165 views

prevent virus code modifying commonly run executable files?

I have recently been looking into 'cyber essentials questionnaire' and I came across the question "Other than anti-virus software, are access control measures in place to prevent virus code modifying ...