Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
7
votes
5answers
18k views

Prevent network users from creating an unauthorized outgoing VPN connection to avoid network policies

Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies? Edit- What is the best way to detect unauthorized outgoing VPN connections while ...
7
votes
3answers
7k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
7
votes
2answers
511 views

How to refute “don't use internet if you don't like it” answer?

I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc. The response I always ...
7
votes
2answers
1k views

What is your approach to handling Guest Internet access?

Suppose you're a company that uses a web proxy to block objectionable content on your corporate network, and this technology may cause issues with some 3rd party VPNs. Or perhaps this 3rd party is ...
7
votes
1answer
159 views

Restricting access to “hacking” sites and tools

I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy. What are the potential benefits and risks of allowing access to such sites to ...
7
votes
1answer
2k views

How to deal with tunnel applications such as TeamViewer on the corporate network

Our IT department uses TeamViewer to provide support to users at remote locations. More recently we've noticed that users are using TeamViewer to get support for their lab equipment from vendors. ...
6
votes
5answers
356 views

What's the real reason behind blocking the social sites? Even legitimate sites like Twitter which acts as a knowledge repository?

I see some sites are blocked for IT security at schools, colleges and offices. But, why are some obvious good sites blocked too?
6
votes
6answers
8k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
6
votes
3answers
836 views

Why would configuring a Blackberry to turn radio off when charging help with security?

A friend's work Blackberry is configured so that phone and Internet access are disabled while the device is charging. I assumed this was a fault, but apparently it's a deliberate security policy. Has ...
6
votes
2answers
307 views

Concerns and Gotcha with Secure Programming Standards Development

I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of ...
6
votes
3answers
401 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
6
votes
2answers
705 views

Security Manager job description

I work in a growing, family owned business. The company has 300 employees and has landed some big clients who require major policy changes in order to give us their continued business. Among those ...
6
votes
2answers
215 views

How Should a Midsized Startup Approach Information Security and Compliance?

The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data. As we'...
6
votes
3answers
197 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
6
votes
1answer
206 views

Is online security training effective?

I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
6
votes
3answers
886 views

Segregation of Duties of 3 tier Applications

This is a tricky issue I'm dealing with at the office. Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications. I'm trying to figure ...
6
votes
1answer
298 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, etc)...
5
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
5
votes
4answers
992 views

What issues are most important to cover in Corporate Security Policy?

What about a Privacy Policy? Both internal, and external.
5
votes
4answers
421 views

What is the best practice when corporate network is overwriting SSL certificates?

The company I work at has started to overwrite SSL certificates with their own self issued one so that they can monitor traffic to the internet more closely. They also installed the corresponding CA ...
5
votes
3answers
27k views

Which security standards define the time of inactivity before locking the screen

Security and usability are often colliding. When it comes to locking screens on workstations after a certain amount of inactivity this is definitely the case and complaints have to be expected from ...
5
votes
3answers
4k views

How “enforcable” are email disclaimers

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following: This email and any ...
5
votes
5answers
315 views

Does IT policy apply to the Board of Directors? What policies do apply?

What is your experience with applying IT policy to the Board of Directors? Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
5
votes
3answers
133 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
5
votes
4answers
222 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
5
votes
3answers
1k views

How can i deal with management who want 'Domain Admin' access?

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
5
votes
2answers
363 views

Issues with the use of network surveillance tool in your company?

What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ? And what policies could be ...
5
votes
3answers
2k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
5
votes
1answer
343 views

Facebook changed the default email address for every contact. How do I mitigate the impact and risk?

Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address. This is an ...
5
votes
2answers
177 views

Standards for hiring trusted personnel - American or Canadian Government?

Is anyone familiar with an ISO standard outlining the hiring of labour for vendors being hired by DHS or Canadian government? I've found security standards but nothing for hiring practices. Edit for ...
5
votes
1answer
1k views

Clarification needed for NIST's whitepaper “Recommendation for Password-Based Key Derivation”

What are some sample use-cases the NIST is supporting in this policy / whitepaper regarding PBKDF2? This Recommendation specifies a family of password-based key derivation functions (PBKDFs) ...
5
votes
1answer
271 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
4
votes
5answers
729 views

Is there a domain specific language for security policies

Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ? Edit: Typically to express security policies at network level ...
4
votes
2answers
3k views

Is viewing applied group policy on a client PC not considered a minor security breach?

A client on a company can run commands and view the Group Policy settings applied to his own account and computer. The commands are: gpresult (and all of its variants) rsop.msc In my opinion, ...
4
votes
4answers
3k views

Server situated on two physical networks - Bad idea or not

The run down: Windows Server A (from here on referred to as 'the server') exists on the corporate network (ref as Corporate). A separate physical network exists for the Telecommunications Department -...
4
votes
3answers
2k views

Why does our Web Security team block web-fonts?

The company that I work for have begun to block web fonts on external domains. This creates a poor UX on most sites given that a large number of assets are generated through the likes of FontAwesome (...
4
votes
4answers
3k views

Loss of hardware asset(such as a laptop) that belongs to an organization

What should an organization do if an employee loses their laptop owned by the company. The laptop is used for business purposes, has confidential data and is also encrypted. Are there specific ...
4
votes
2answers
455 views

How to convince the boss of an Acceptable Use Policy

So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the ...
4
votes
3answers
632 views

security performance criteria in employee reviews

Have any of you security professionals been able to get security performance metrics into reviews that managers conduct for their employees? If so, are there any helpful resources you could share to ...
4
votes
3answers
272 views

Convincing the boss about the importance of privacy and security

I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (...
4
votes
3answers
189 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
4
votes
3answers
696 views

What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?

I'm curious if people have different views on this and why. Update based on comments: Defend enterprises. Quotes: "Long-time blog readers should know that I don't rely on tools to defend my ...
4
votes
2answers
174 views

Difference between cyber security and information security?

What is the difference between an IT security policy, an information security policy and a cyber security policy?
4
votes
1answer
1k views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
4
votes
5answers
359 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
4
votes
2answers
264 views

Home “datacenter” security, where and what to look for?

This is a question to learn more about security management and physical security. I'm running a small serverroom in the basement at home, mainly as testbed for attacks I dont want to try on live ...
4
votes
1answer
294 views

Computer team's password change time different from other users?

We need to determine a password policy for our organization. All users, in general, will have 90 days until they will have to change their passwords, complexity required and passwords need to be at ...
4
votes
2answers
301 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
4
votes
1answer
176 views

How should I approach my security team regarding aggressive group policies (VBA / macro blocking)?

My security organization has responded to the threat of macro-based viruses by changing all copies of Excel to no longer run macros/VBA scripts. Through some quick research, it looks like there are ...
4
votes
1answer
348 views

How does the mobile security technology APNS and 3LM work?

APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones. I recently got off the phone with Boxtone and they said they ...