Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
4
votes
2answers
3k views

Is viewing applied group policy on a client PC not considered a minor security breach?

A client on a company can run commands and view the Group Policy settings applied to his own account and computer. The commands are: gpresult (and all of its variants) rsop.msc In my opinion, ...
10
votes
7answers
757 views

What are the best reasons you've heard for not implementing security?

We can devise the best technical solution to a security problem, but that solution needs to be applied by people, by a business, to an organization, and/or in spite of objections. The barriers ...
12
votes
2answers
7k views

Policy requirements of Sarbanes-Oxley (SOX)

I'm hoping this question will be appropriate for this site. The ServerFault people didn't think it applied to system administrators. Certainly I think it can be answered from a security perspective, ...
4
votes
1answer
294 views

Computer team's password change time different from other users?

We need to determine a password policy for our organization. All users, in general, will have 90 days until they will have to change their passwords, complexity required and passwords need to be at ...
5
votes
5answers
328 views

Does IT policy apply to the Board of Directors? What policies do apply?

What is your experience with applying IT policy to the Board of Directors? Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
6
votes
3answers
839 views

Why would configuring a Blackberry to turn radio off when charging help with security?

A friend's work Blackberry is configured so that phone and Internet access are disabled while the device is charging. I assumed this was a fault, but apparently it's a deliberate security policy. Has ...
7
votes
1answer
2k views

How to deal with tunnel applications such as TeamViewer on the corporate network

Our IT department uses TeamViewer to provide support to users at remote locations. More recently we've noticed that users are using TeamViewer to get support for their lab equipment from vendors. ...
1
vote
3answers
1k views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
17
votes
6answers
747 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
5
votes
1answer
1k views

Clarification needed for NIST's whitepaper “Recommendation for Password-Based Key Derivation”

What are some sample use-cases the NIST is supporting in this policy / whitepaper regarding PBKDF2? This Recommendation specifies a family of password-based key derivation functions (PBKDFs) ...
6
votes
2answers
709 views

Security Manager job description

I work in a growing, family owned business. The company has 300 employees and has landed some big clients who require major policy changes in order to give us their continued business. Among those ...
9
votes
4answers
1k views

Security policy for system administrators

I've been in charge of systems administration for a small company for a couple of years and am now training some new collaborators to take over. So far, there has been no security policy, but I would ...
5
votes
2answers
365 views

Issues with the use of network surveillance tool in your company?

What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ? And what policies could be ...
12
votes
4answers
698 views

Where are some Security Policies that are actually in use?

I know there are a lot of security policy samples and templates out in the web. I'm curious to know if there are security policies that are actually in use and still published publicly. I know they ...
20
votes
5answers
2k views

How to best defend against Targeted Attacks?

We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
8
votes
1answer
1k views

What is a practical example of an action that violates the non-interference model?

I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations). I ...
4
votes
2answers
460 views

How to convince the boss of an Acceptable Use Policy

So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the ...
6
votes
2answers
308 views

Concerns and Gotcha with Secure Programming Standards Development

I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of ...
6
votes
3answers
199 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
8
votes
2answers
1k views

What is your approach to handling Guest Internet access?

Suppose you're a company that uses a web proxy to block objectionable content on your corporate network, and this technology may cause issues with some 3rd party VPNs. Or perhaps this 3rd party is ...
2
votes
2answers
312 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...