Questions tagged [corporate-policy]

A set of rules for employees of a corporation related to the use of information technology equipment and systems.

Filter by
Sorted by
Tagged with
2
votes
0answers
206 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall policy ...
2
votes
0answers
497 views

Prompt/Notify Users before connecting to PC - Corporate Policy

I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my ...
1
vote
3answers
134 views

How to protect against an attack where a person claims to be in a position of authority?

In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
1
vote
3answers
1k views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
1
vote
2answers
132 views

What policies and agreements regarding information security are a must have for every self respecting company?

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered? For example (...
1
vote
3answers
151 views

How should we store & share documents with restricted access

Up till now we have handled restricting access to documents by having a share on our server that only the 2 accounting people could access and another that only the 2 HR people could access. And ...
1
vote
2answers
213 views

Should organisations allow their employees connect with a VPN software from their own laptops to their machine at work?

I saw a few breaches on a very large scale where an organization like JP Morgan suffered a huge breach just by allowing their employees to connect via VPN to their machines at work. Seems that hackers ...
1
vote
2answers
60 views

Can a website's privacy policy be made more effective by incorporating it into company bylaws?

I'm concerned primarily about the US, but also UK and Germany. Is there any way to give a privacy policy greater trust, and more effectiveness, by somehow binding it to a company's bylaws with the ...
1
vote
2answers
2k views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”?

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy"? I had an argument about this with my management and whilst some think that its basically the same thing,...
1
vote
3answers
422 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
1
vote
3answers
899 views

Howto pass overly protective corporate firewall

My Corporate Network was always being monitored, but a few days ago they started to block and censor all HTTPS traffic. Recently IT guys forged certificates for all major HTTPS web sites and acts as a ...
1
vote
1answer
2k views

Relationship between FISMA and OMB Circular A-130?

Can someone explain to me the relationship between FISMA and OMB Circular A-130?
1
vote
2answers
277 views

Policy for remote-access situations?

We have network which users (mostly management, it, and the presidents) use VPN to remote into their work desktops or to use their laptops from home. After some users took it upon themselves to ...
1
vote
1answer
57 views

Is it a good (or not harmful) idea to allow employees to use their company phones privately?

As I try to come up with company regulations for IT security, the question arose if employees can use their company provided iPhones 8 for personal matters. Specifically they want to install spotify (...
1
vote
2answers
253 views

Basic things that need to be explained to employees about a security policy and at what point in their employment

I was asked this question: What are the basic things that need to be explained to every employee about a security policy? At what point in their employment? Why? (List at least 4 things). ...
1
vote
2answers
145 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
1
vote
1answer
2k views

Can someone please briefly explain HIPAA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
1
vote
2answers
142 views

Can I instruct a Telco to prevent 2G connections from our phones?

Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices? Some cell phones are unable to ...
1
vote
2answers
88 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
1
vote
1answer
51 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
1
vote
1answer
141 views

How to protect against portable applications

There are many portable apps around that could be downloaded and run on local PCs. Usually running of exe could be blocked by using UAC. however, in this case of portable applications, how do I ...
1
vote
1answer
3k views

Information Security Policy and Information Security Plan

I have a question about the guidance in NIST 800-53. The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information ...
1
vote
3answers
152 views

Question: How to plan email policy for start-ups?

I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're ...
1
vote
1answer
3k views

Does a network behind a NAT\modem firewall need a firewall?

Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough". For the most part the router ...
1
vote
1answer
47 views

VPN gateway software check enforcement as part of access policie

Can a VPN gateway enforce policies in form of checking whether a particular software or set of software is installed on the endpoint and based on that allow / deny the remote connection to be ...
1
vote
1answer
183 views

How to prevent contradictions in policies

Some things in policies can be good controls, but the same controls can open up vulnerabilities or can be contradicted by other controls and conditions in other policies. What can be a good measure ...
1
vote
1answer
4k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
1
vote
1answer
193 views

Work from home, remote monitoring software, vpn, privacy

So I work for a company where I make and receive phone calls and connect to remote servers and workstations. I work from home, use a company laptop and connect to the company's network via software ...
1
vote
1answer
565 views

Pin change policy for RSA SecurID

My company permits remote access with authentication that includes: username password/phrase (20+ characters) User selected PIN + RSA SecurID token code Our passwords are required to be changed ...
1
vote
2answers
291 views

How do I configure Symantec AV to permit pentesting tools without compromising my organization's network and my host computer?

When performing penetration testing for work, I often have to turn off Symantec Endpoint Protection in order to use certain payloads with Burp Suite and I recently had to do this for something as ...
1
vote
3answers
341 views

What can be done to limit corporate Identity theft?

Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for ...
1
vote
1answer
1k views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
1
vote
1answer
84 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
1
vote
1answer
938 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
1
vote
1answer
149 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
1answer
254 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
1
vote
3answers
57 views

What are the best practices in a manufacturing/production facility for data retention?

My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. ...
1
vote
1answer
87 views

Restricting user sign-in on Chrome for Business

I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut ...
1
vote
0answers
76 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
1
vote
1answer
724 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
1
vote
0answers
100 views

Device Control Policy

I want to blacklist all the external storage devices and only allow specific brand of device such as SanDisk. I had blacklisted the external storage devices by using USBSTOR* and whitelist all the ...
1
vote
1answer
102 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
0
votes
5answers
4k views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
0
votes
1answer
442 views

Do US companies have citizenship requirements for security-related employees? [closed]

Do U.S. based companies or corporations generally have policies restricting their security staff to certain nationalities or are they generally open to all qualified persons regardless of citizenship?
0
votes
2answers
76 views

Why is Multifactor Authentation Presented in Two Steps Instead of One [duplicate]

When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code. This goes against at least one intuitive line ...
0
votes
2answers
3k views

How frequently install patches in an enterprise environment?

We're trying to implement a patch schedule in our environment for both linux and windows systems. I'm curious to hear how often other enterprise companies are patching their servers so we can get an ...
0
votes
1answer
792 views

Can Chrome's Incognito mode be disabled? [closed]

Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?
0
votes
1answer
760 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?
0
votes
2answers
77 views

What are the risks from letting users share their own calendars?

I've worked for a variety of technologies companies. In working for startups I've noticed a wide variety of opinions about whether sharing calendars is a security risk. I can imagine that it would ...
0
votes
1answer
60 views

Is this a “valid” security policy item?

I'm reading a security policy, which seems to be a system security policy and there is an item that requires the system to implement a specific standard, something like "Implement the standard XYZ". ...