We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
7
votes
5answers
18k views

Prevent network users from creating an unauthorized outgoing VPN connection to avoid network policies

Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies? Edit- What is the best way to detect unauthorized outgoing VPN connections while ...
3
votes
2answers
163 views

How should we set up domain administrators?

We're a small company that is growing pretty fast. For a long time there were 2 of us that were domain administrators. But over the past 2 years this has increased to 6 people and this strikes me as a ...
1
vote
3answers
146 views

How should we store & share documents with restricted access

Up till now we have handled restricting access to documents by having a share on our server that only the 2 accounting people could access and another that only the 2 HR people could access. And ...
6
votes
1answer
208 views

Is online security training effective?

I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
5
votes
1answer
286 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
3
votes
4answers
127 views

Thumbdrive and its obsolescence?

Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to ...
3
votes
2answers
454 views

In CIA triad of information security, what's the difference between confidentiality and availability?

I sometimes get confused between confidentiality and availability. This site defines confidentiality as Measures undertaken to ensure confidentiality are designed to prevent sensitive information ...
6
votes
5answers
356 views

What's the real reason behind blocking the social sites? Even legitimate sites like Twitter which acts as a knowledge repository?

I see some sites are blocked for IT security at schools, colleges and offices. But, why are some obvious good sites blocked too?
-1
votes
2answers
124 views

Resources fo Security Awareness training [closed]

as part of security awareness for the company, I am looking for something that I could use to spread the awareness. Maybe a web based application/portal which I can create quiz forms easily or share ...
-1
votes
1answer
83 views

Measuring privacy policy [closed]

I want to measure if the user's data which is collected by the system is mentioned in the privacy policy. What is the best measure that I can use it in such case?
-1
votes
3answers
637 views

Writing an information security policy [closed]

We are required to write an "information security policy" for our company, and I want to know how much should we cover, and if there are any template or examples that would help.
2
votes
0answers
186 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall policy ...
9
votes
1answer
255 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...
18
votes
5answers
2k views

At what point in their employment should security policies be explained to an employee?

There are the basic things that need to be explained to every employee about a security policy. For example: How sensitive information must be handled. How to properly maintain your ID, and password, ...
1
vote
1answer
51 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
5
votes
4answers
1k views

What issues are most important to cover in Corporate Security Policy?

What about a Privacy Policy? Both internal, and external.
7
votes
3answers
2k views

How to devise a security policy?

I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as ...
5
votes
3answers
134 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
2
votes
0answers
481 views

Prompt/Notify Users before connecting to PC - Corporate Policy

I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my ...
2
votes
2answers
490 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
1
vote
0answers
99 views

Device Control Policy

I want to blacklist all the external storage devices and only allow specific brand of device such as SanDisk. I had blacklisted the external storage devices by using USBSTOR* and whitelist all the ...
1
vote
1answer
102 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
3
votes
2answers
355 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
6
votes
3answers
410 views

Risk of spyware on seized devices

This question (Prevention measures against laptop seizure at US borders) addresses a number of techniques for securing data while crossing borders. Perhaps the most useful advice was to simply not ...
104
votes
10answers
14k views

Prevention measures against laptop seizure at US borders

Since laptop and other electronic device seizures at US borders became legal without a warrant (including making copies of data), 7% of ACTE's business travelers reported being subject to a seizure as ...
4
votes
3answers
696 views

What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?

I'm curious if people have different views on this and why. Update based on comments: Defend enterprises. Quotes: "Long-time blog readers should know that I don't rely on tools to defend my ...
14
votes
3answers
2k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
1
vote
1answer
83 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
1
vote
1answer
925 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
0
votes
2answers
3k views

The difference of Security Policy and Acceptable Use Policy ?

Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet. Information Security ...
1
vote
1answer
141 views

How to protect against portable applications

There are many portable apps around that could be downloaded and run on local PCs. Usually running of exe could be blocked by using UAC. however, in this case of portable applications, how do I ...
13
votes
3answers
384 views

open source software security rating — 3rd-party authority

A client is asking my company to write up internal standards that open source software must meet before we will approve it for use on our workstations. Our policy has always been subjective and hard ...
0
votes
2answers
3k views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
1
vote
1answer
3k views

Information Security Policy and Information Security Plan

I have a question about the guidance in NIST 800-53. The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information ...
5
votes
3answers
29k views

Which security standards define the time of inactivity before locking the screen

Security and usability are often colliding. When it comes to locking screens on workstations after a certain amount of inactivity this is definitely the case and complaints have to be expected from ...
0
votes
1answer
431 views

Do US companies have citizenship requirements for security-related employees? [closed]

Do U.S. based companies or corporations generally have policies restricting their security staff to certain nationalities or are they generally open to all qualified persons regardless of citizenship?
4
votes
4answers
3k views

Server situated on two physical networks - Bad idea or not

The run down: Windows Server A (from here on referred to as 'the server') exists on the corporate network (ref as Corporate). A separate physical network exists for the Telecommunications Department -...
3
votes
2answers
378 views

Why is the *-property in BPL security model named “star”?

I am just looking for the meaning of "star" in this property
0
votes
1answer
792 views

Can Chrome's Incognito mode be disabled? [closed]

Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?
6
votes
3answers
892 views

Segregation of Duties of 3 tier Applications

This is a tricky issue I'm dealing with at the office. Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications. I'm trying to figure ...
3
votes
3answers
243 views

Are clients blocking all incoming connections secure?

When clients (which are using both Linux and Windows) block all incoming traffic in a network, and the router is also blocking all incoming traffic, are we (almost) 100% secure? Maybe excluding silly ...
1
vote
3answers
410 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
3
votes
1answer
847 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
-13
votes
2answers
404 views
4
votes
5answers
753 views

Is there a domain specific language for security policies

Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ? Edit: Typically to express security policies at network level ...
-2
votes
1answer
4k views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
1
vote
3answers
808 views

Howto pass overly protective corporate firewall

My Corporate Network was always being monitored, but a few days ago they started to block and censor all HTTPS traffic. Recently IT guys forged certificates for all major HTTPS web sites and acts as a ...
1
vote
1answer
144 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
1answer
254 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
0
votes
1answer
757 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?