Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
2
votes
2answers
6k views

Can Google Policy Profile remotely erase all data on the device?

I'd like to configure my company's Google e-mail on my iPhone, however when enabling e-mail profile in Inbox, Gmail, Mail or any other app, the following Device Policy Alert is shown: To use Google ...
1
vote
1answer
4k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
0
votes
1answer
816 views

Should I be concerned if my employer is performing man-in-the-middle HTTPS attacks? [duplicate]

I have reason to believe that my employer may be performing HTTPS man-in-the-middle attacks on company-issued work laptops, as Java's SSL Certificate lists my employer as the Certificate Authority. ...
1
vote
1answer
210 views

Work from home, remote monitoring software, vpn, privacy

So I work for a company where I make and receive phone calls and connect to remote servers and workstations. I work from home, use a company laptop and connect to the company's network via software ...
4
votes
1answer
13k views

Is there a specification for the color values representing information classification levels for the United States? [closed]

Executive Order 13526 section 1.2.⁠ Specifies Information may be classified as Top Secret, Secret, and Confidential. The absense of a classification is Unclassified. US Classification Levels are used ...
1
vote
1answer
595 views

Pin change policy for RSA SecurID

My company permits remote access with authentication that includes: username password/phrase (20+ characters) User selected PIN + RSA SecurID token code Our passwords are required to be changed ...
3
votes
1answer
151 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
0
votes
2answers
163 views

Is it reasonable to block Cookies company-wide?

In our company we are using a tool for saving user profile data (like desktop settings, internet settings, cookies, etc.) into a database. During the annual cleanup of this database I discovered that ...
1
vote
2answers
343 views

How do I configure Symantec AV to permit pentesting tools without compromising my organization's network and my host computer?

When performing penetration testing for work, I often have to turn off Symantec Endpoint Protection in order to use certain payloads with Burp Suite and I recently had to do this for something as ...
3
votes
1answer
717 views

Amazon Echo/Dot on your network

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network. Below is the reasons I have come up with so far. This is still the rough list. The ...
5
votes
3answers
2k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
5
votes
3answers
2k views

Why does our Web Security team block web-fonts?

The company that I work for have begun to block web fonts on external domains. This creates a poor UX on most sites given that a large number of assets are generated through the likes of FontAwesome (...
2
votes
3answers
179 views

prevent virus code modifying commonly run executable files?

I have recently been looking into 'cyber essentials questionnaire' and I came across the question "Other than anti-virus software, are access control measures in place to prevent virus code modifying ...
1
vote
0answers
76 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
2
votes
3answers
851 views

forwarding company email to a contractor's email address

We use contractors from out of state and from other countries. An Active Directory account is created, which creates an Exchange email account. We forward email from the Exchange email address to a ...
0
votes
2answers
153 views

Password manager database and keyfile

I'm trying to store passwords more securely in my department. I was thinking about using Keepass, giving each of my colleagues a personal password database and require a simple password (they won't ...
15
votes
3answers
72k views

What does Blue Coat Unified Agent application do?

I've experienced a crash of the Blue Coat Unified Agent tray application on my business laptop. I was wondering what is the exact purpose of this software, and how is it supposed to help me or the ...
91
votes
13answers
18k views

Company computers for competent developers, how can you deal with them?

This is a follow up on Is there a legitimate reason I should be required to use my company’s computer. Mostly, because I see a huge issue in a couple of specific situations. Had I been in a position ...
0
votes
2answers
123 views

What is a privacy policy?

Im having trouble grasping the definition of a privacy policy. Is it the agreement of user and another party? or can it also be privacy settings a user specify in an application? or is it just the ...
2
votes
2answers
123 views

How to deal with administration tools such as ipscanners and PSTools?

In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools. How do you deal or control the usage of such tools in ...
3
votes
1answer
330 views

Active Directory Admin policy

I work for a small company (35 employees). Earlier this year we implemented Active Directory (to support an enterprise level application). We didn't implement AD for AD's sake but to provide LDAP ...
1
vote
2answers
2k views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”?

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy"? I had an argument about this with my management and whilst some think that its basically the same thing,...
1
vote
3answers
344 views

What can be done to limit corporate Identity theft?

Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for ...
2
votes
1answer
119 views

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy?

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013. The ...
1
vote
2answers
133 views

What policies and agreements regarding information security are a must have for every self respecting company?

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered? For example (...
2
votes
4answers
156 views

Should a company physically destroy old HDD?

Is it advisable for a security-minded company (data stored could be client's detailed information, patent pending docs) destroy all replaced HDDs/SSD? Or is it OK to re-sell them online? Information ...
3
votes
0answers
258 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
8
votes
2answers
810 views

Implications of the proposed Burr-Feinstein senate bill? [closed]

It has been rumoured (I guess it is more than a rumour) that senators Burr and Feinstein will be introducing legislation requiring companies to provide the government (with warrants) access to encrypt ...
1
vote
1answer
748 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
0
votes
1answer
128 views

Surveillance in the Workplace? [closed]

Auditing, surveillance and logging are typical and common place in the workplace, understandably so. These actions are crucial to establishing metrics and performance of the network and its resources. ...
2
votes
1answer
117 views

Adblock to prevent employees from accidentally clicking malicious ads

Our Company allows browsing without restriction such as news, fb, twitter, blogs etc. Would it make sense to have employees install Adblock or similar plugins to prevent (accidentally) clicking ...
20
votes
5answers
3k views

Policy mandate dilemma

When writing security policies do you take into consideration user's (could be vendors) ability/capability to fulfil certain mandates in the policies or do you strictly want them to enforce, no matter ...
5
votes
4answers
233 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
7
votes
1answer
161 views

Restricting access to “hacking” sites and tools

I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy. What are the potential benefits and risks of allowing access to such sites to ...
58
votes
3answers
7k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
2
votes
1answer
159 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
3
votes
2answers
2k views

Why is it dangerous for a company to allow employees to connect their own devices to the internet?

I've heard complaints about allowing employees, clients, etc. to bring their own device and connect it to the network. What exactly is the complaint and how can it be a threat? If no network resources ...
3
votes
2answers
166 views

How should we set up domain administrators?

We're a small company that is growing pretty fast. For a long time there were 2 of us that were domain administrators. But over the past 2 years this has increased to 6 people and this strikes me as a ...
1
vote
3answers
158 views

How should we store & share documents with restricted access

Up till now we have handled restricting access to documents by having a share on our server that only the 2 accounting people could access and another that only the 2 HR people could access. And ...
6
votes
1answer
214 views

Is online security training effective?

I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
3
votes
4answers
129 views

Thumbdrive and its obsolescence?

Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to ...
5
votes
1answer
312 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
3
votes
2answers
467 views

In CIA triad of information security, what's the difference between confidentiality and availability?

I sometimes get confused between confidentiality and availability. This site defines confidentiality as Measures undertaken to ensure confidentiality are designed to prevent sensitive information ...
19
votes
6answers
12k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to home, ...
120
votes
12answers
23k views

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

I just got a new job at a medium-sized (~100 employees) company and one of the first things I was told is that I cannot use my own computer, because I need to be able to connect to their network, ...
-1
votes
1answer
84 views

Measuring privacy policy [closed]

I want to measure if the user's data which is collected by the system is mentioned in the privacy policy. What is the best measure that I can use it in such case?
1
vote
1answer
1k views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
-1
votes
3answers
659 views

Writing an information security policy [closed]

We are required to write an "information security policy" for our company, and I want to know how much should we cover, and if there are any template or examples that would help.
2
votes
0answers
233 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall policy ...
9
votes
1answer
263 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...