The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
4
votes
0answers
591 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowingly working for another character who wants access to the data of the United States ...
4
votes
0answers
263 views

How to make sure that previous sysadmin has not compromised corporate IT security? [duplicate]

Possible Duplicate: When a sysadmin leaves what extra precautions need to be taken? A company has been maintaining its ALL internal and external (like google emails, apps, etc.) IT systems (...
3
votes
2answers
775 views

I just discovered that my sysadmin created a loophole that gives me root access. What should I do?

At our company the Linux system administration is handled by the security team. The guy assigned to my project has been a great big pain, and has seemed to me at several points to be of questionable ...
3
votes
3answers
451 views

Is implementing an SSL proxy server considered a good practice?

There are many questions on this site from users finding out that their employer has a certificate proxy in place, essentially implementing a man-in-the-middle attack so that all traffic is able to be ...
3
votes
2answers
2k views

Why is it dangerous for a company to allow employees to connect their own devices to the internet?

I've heard complaints about allowing employees, clients, etc. to bring their own device and connect it to the network. What exactly is the complaint and how can it be a threat? If no network resources ...
3
votes
2answers
450 views

In CIA triad of information security, what's the difference between confidentiality and availability?

I sometimes get confused between confidentiality and availability. This site defines confidentiality as Measures undertaken to ensure confidentiality are designed to prevent sensitive information ...
3
votes
3answers
1k views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
3
votes
2answers
336 views

What goes into an average incident response process for a corporate network?

I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
3
votes
4answers
127 views

Thumbdrive and its obsolescence?

Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to ...
3
votes
2answers
5k views

How do you keep track of numerous keys in the workplace?

Where I'm currently working there is a policy where various assets (including laptops) have to be cable locked and in the tech support department we have so many transient assets it's becoming ...
3
votes
3answers
187 views

Convince an executive to mandate HTTPS use on Intranet web servers

I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to ...
3
votes
2answers
4k views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
3
votes
2answers
355 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
3
votes
1answer
842 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
3
votes
3answers
242 views

Are clients blocking all incoming connections secure?

When clients (which are using both Linux and Windows) block all incoming traffic in a network, and the router is also blocking all incoming traffic, are we (almost) 100% secure? Maybe excluding silly ...
3
votes
2answers
276 views

Security Training for corporate Facebook users

One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
3
votes
1answer
316 views

Active Directory Admin policy

I work for a small company (35 employees). Earlier this year we implemented Active Directory (to support an enterprise level application). We didn't implement AD for AD's sake but to provide LDAP ...
3
votes
2answers
221 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore have ...
3
votes
2answers
375 views

Why is the *-property in BPL security model named “star”?

I am just looking for the meaning of "star" in this property
3
votes
2answers
199 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
3
votes
1answer
151 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
3
votes
1answer
672 views

Amazon Echo/Dot on your network

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network. Below is the reasons I have come up with so far. This is still the rough list. The ...
3
votes
2answers
163 views

How should we set up domain administrators?

We're a small company that is growing pretty fast. For a long time there were 2 of us that were domain administrators. But over the past 2 years this has increased to 6 people and this strikes me as a ...
3
votes
0answers
256 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
2
votes
6answers
362 views

What are possible approaches and arguments for securing corporate IT systems with most computers being portable?

I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
2
votes
1answer
161 views

Considerations for information exchange agreement between governmental agencies

Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements? What is the security ...
2
votes
7answers
526 views

PCI Policy Management software? [closed]

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation. I am responsible for creating the policies and ...
2
votes
2answers
107 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
2
votes
1answer
1k views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup ...
2
votes
3answers
705 views

forwarding company email to a contractor's email address

We use contractors from out of state and from other countries. An Active Directory account is created, which creates an Exchange email account. We forward email from the Exchange email address to a ...
2
votes
2answers
489 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
2
votes
2answers
117 views

How to deal with administration tools such as ipscanners and PSTools?

In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools. How do you deal or control the usage of such tools in ...
2
votes
2answers
1k views

Looking for a presentation about information security for corporate employees

I'd appreciate if you could recommend me a presentation the describes the dangers and possible solutions and guidelines, when using the Internet. Specifically, in corporate settings. I would need to ...
2
votes
1answer
246 views

Corporate penetration testing/phishing [closed]

If a company employs a security company to 'hack' into their systems and agrees to allow this security company to send fake phishing emails to employees... ...is that company (or the security company)...
2
votes
1answer
114 views

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy?

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013. The ...
2
votes
4answers
153 views

Should a company physically destroy old HDD?

Is it advisable for a security-minded company (data stored could be client's detailed information, patent pending docs) destroy all replaced HDDs/SSD? Or is it OK to re-sell them online? Information ...
2
votes
1answer
107 views

Adblock to prevent employees from accidentally clicking malicious ads

Our Company allows browsing without restriction such as news, fb, twitter, blogs etc. Would it make sense to have employees install Adblock or similar plugins to prevent (accidentally) clicking ...
2
votes
1answer
209 views

Are there risks associated with connecting to a public hotspot?

When connecting to a unknown public hotspot, I know that the data transmitted can be captured and, if unencrypted, easily analyzed. But that's not the question here. I want to know whether the ...
2
votes
2answers
312 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...
2
votes
3answers
169 views

prevent virus code modifying commonly run executable files?

I have recently been looking into 'cyber essentials questionnaire' and I came across the question "Other than anti-virus software, are access control measures in place to prevent virus code modifying ...
2
votes
1answer
279 views

Windows App Store security

It seems like most companies now a days, give you a crappy laptop with some version of Windows on it that allows you to access the internet (sometimes they block YouTube, Facebook, etc.), comes with ...
2
votes
1answer
172 views

Industrial security — resources for ISO27k compliance, social-engineering trend reports

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
2
votes
3answers
172 views

How should security user training be provided when implementing a company BYOD strategy?

Our company is implementing a BYOD policy. I am working with management to draft end user training guidelines / standards as senior member of the Information Security team. Our company is in a ...
2
votes
1answer
79 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
2
votes
4answers
188 views

Is there a term for over-zealous security policies? [closed]

I work for a company that deals with medical data, so we must comply with HIPAA as well as our desire for plain old corporate security. However, our ops team is quite zealous about the extent to ...
2
votes
1answer
142 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
2
votes
2answers
363 views

Are there specific reasons or benefits to using a tiered information security policy architecture?

I had another question in mind, but thought that I should ask this one first. Background: Everywhere I have been in the past has used a tiered policy architecture. What I mean is there is one ...
2
votes
3answers
482 views

What are some good references discussing the pros and cons of a company Wi-Fi network for personal use?

I am a software developer at a company that currently does not allow associates to use personal devices at work (ethernet and guest wi-fi alike). This makes it very hard to work on side projects (like ...
2
votes
0answers
184 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall policy ...
2
votes
0answers
479 views

Prompt/Notify Users before connecting to PC - Corporate Policy

I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my ...