Questions tagged [governance]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
2 votes
1 answer
140 views

What are the FEDRAMP "complementary controls"?

Quoting the FedRAMP official FAQ: FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
niilzon's user avatar
  • 1,619
1 vote
0 answers
278 views

Difference between IAG and IDM

What is the difference between Identity Management products (such as Forefront/MIM, PicketLink, OpenIDM) and Identity Access Governance tools (such as Sailpoint,Savyint, CyberArk)? Apologies for ...
aquaman's user avatar
  • 93
0 votes
2 answers
202 views

A website had a breach and isn't telling customers. What can I do?

A website recently had a bug where users could effortlessly inadvertently access and operate other users accounts - payment information and all. This website has an official community forum where ...
guestp-p-p-panda's user avatar
1 vote
2 answers
271 views

Storing customer data securely (compliance)

I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do. ...
MR.Elegant's user avatar
1 vote
2 answers
155 views

Possible setup for a direct democracy voting system to prevent fraud

My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders. Some requirements as of now:...
mateos's user avatar
  • 175
25 votes
6 answers
5k views

How to start with an Information Security Program?

I am a software tester, InfoSec is mostly tangential to my job, and people only ask me questions about InfoSec because I am not afraid to use Google or Stack Exchange when I don't know something. (...
Amedee Van Gasse's user avatar
1 vote
1 answer
200 views

Challenges in Information security management [closed]

Information security management involves challenges that are essentially unique due to the combination of technical and organizational constraints. Identify two such challenges and discuss in ...
Jonovan's user avatar
  • 11
-1 votes
1 answer
105 views

Information Security Validation

One of the business units (ou1) within our company is in the process of establishing an encrypted communication feed with an external vendor. The vendor provided a set of requirements for the actual ...
RIN's user avatar
  • 1
1 vote
1 answer
673 views

What does Technical Constraint and Organisational Constraint mean in terms of Internet Security Management

I am on an essay with regards to the following topic: Information security management involves challenges that are essentially unique due to the combination of technical and organisational ...
gymcode's user avatar
  • 135
3 votes
4 answers
185 views

Thumbdrive and its obsolescence?

Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to ...
JinPangPang's user avatar
  • 1,951
1 vote
1 answer
424 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
ZygD's user avatar
  • 267
6 votes
1 answer
940 views

How to determine risk ratings for third party mobile apps

Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, ...
richhallstoke's user avatar
2 votes
2 answers
466 views

Are there specific reasons or benefits to using a tiered information security policy architecture?

I had another question in mind, but thought that I should ask this one first. Background: Everywhere I have been in the past has used a tiered policy architecture. What I mean is there is one ...
Craine's user avatar
  • 349
1 vote
1 answer
331 views

Choosing the Path in IT Security [closed]

I graduated last year from an Informatics and Security degree program. This program was taken in a Canadian college. It equipped me with the basic security knowledge in all fields; networks, systems ...
Abdullah ALM's user avatar
20 votes
9 answers
3k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
Akam's user avatar
  • 1,357