31

I'll give it a shot. In a nutshell, the language is CYA in case you get breached or hacked and have access to their data, they can tell their customers "Acme said they had a security program and was protected so this is their fault". In that case if you end up being the cause of them losing data, they can blame you. That being said, its pretty ...


16

Although there are exceptions, generally managers do things for one of two reasons: Doing it will make them look good Not doing it will make them look bad Now apply this to your management to see who the key stakeholders are: Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV look good. However, if ...


10

This is really about closing the gap between Information Security and Business objectives. For most security departments today, the battle selling Information Security to the board is the major challenge. Usually, board members don't care about "good security”, they care about "good enough security". InfoSec is rarely clearly defined in most organizations ...


5

The theory is that you get support by using metrics: you have to put figures, preferably expressed in dollars (or euros or yens) behind security. Managers manage: they take decisions, based on observed situations and goals to reach. These goals are often expressed (at least in part) in financial terms. Therefore, managers will decide to support/fund/enforce ...


4

(Full disclosure: I build and run software pen-testing and security teams as a sub-function of building security software, and developing software securely. My company is not listed in any of the services recommendations below.) Should you build a security team or pen-testing team? While a few responders here have alluded to internal penetration testing, ...


3

Legal and contractual language is always complex and some times daunting to read that is why we sometimes gloss over the terms and conditions pages of products For your question of where to begin Here are few links from standard resources like NIST, SANS and ISACA each of these institute has a rich history in dealing with many facets of information ...


3

I responded to a lot of these. One thing jumps out: ACME will ensure that the Info Security Program is materially equivalent to Customer’s own information security standards in place from time to time applicable to the risks presented by the Products or Services (collectively the “IS Standards”). Get the customer's information security standards. ...


2

Your case is similar to mine. Neither there were a security position nor they took care of security, but after I joined as a system administrator, within a week I had "created" a security position which I took care of. How did I do that? Instilling fear to management about the consequences of their lack of security controls. Also, this fear was ...


2

What did you spend last year on incident management? What will you spend next year on incident management? What will you spend next year on incident management if you proactively deploy countermeasures? I'd also consult sources like the Verizon Data Breach report to find out the likelihood and cost of incidents at companies like yours.


2

Theres a couple glitches in that system. While you could effectively get rid of USB malware, you're restricting yourself to the components inside of the machine. High security firms and military installations use usb to connect to CAC cards in order to lock their credentials outside of the machine. If your company has solutions for all of their security ...


2

ANSI stands for American National Standards Institute ISO stands for International Organization for Standardization ANSI is the American representative of the ISO body. So, yes, ISO is the umbrella, but in the US, ANSI is the representative.


2

In my department, I am involved in mobile device security, and have looked into a product that does just what you're looking for. The product that I am familiar with is FireEye Mobile Threat Prevention. https://www.fireeye.com/products/mobile-threat-protection-mobile-security-products.html I have experienced some of the capabilities of this threat ...


2

Though entirely not advisable if not entirely illegal and not recommended, worst-case scenarios wake people up. Certain large organizations which prioritize internal security do a number of different things to enforce their policies. Arguably the best and most potent things done involve actual authorized (key word) exploits carried out by the security team ...


2

There's countless examples of where people need legitimate use of USB drives to conduct everyday business. Simply banning thumbdrives for all employees because of security will undoubtedly cost your business in lost productivity. Security departments often make these kinds of sweeping decisions without doing any cost/benefit analysis. How often do ...


2

A technical limitation could be lack of processing power to perform a specific task, for example if you work for Yahoo Mail and you can't digitally sign every email then this can be seen as a technical limitation. An organisational limitation could be not being able to use smart cards because the company culture does not allow such an authentication ...


2

I was personally speaking with the former chief information security officer of a $5B company last week and he mentioned his strategy to get the other executives to approve funding for security projects. He would spend a lot of time converting the possible losses into a dollar amount, being careful to show the various components(lawsuits, labor for disaster ...


2

Because they know about it and are open, when asked, about the problem, it is possible that there is nothing more they are required to do. Various jurisdictions require breach notification, but which jurisdiction applies to this company is beyond the scope of this site. So, you can check to see if they need to report, and prompt them to do so or to report ...


2

This White Paper from SANS discusses network architecture and the use of a DMZ: https://www.sans.org/reading-room/whitepapers/bestprac/infrastructure-security-architectureeffective-security-monitoring-36512 The PCI DSS is related to cardholder data but, if you substitute 'sensitive' for cardholder, the guidance is pretty good - see requirement 1.3.6 Place ...


2

It sounds like you may be asking about in person or online voting, so I will provide some info in both areas. General I would read the research from past conferences such as USNIX EVT/WOTE. DefCon had a voting village, this may be another source for research. People often present on voting security at different IEEE conferences as well. You need to think ...


2

In a perfect way you can't. There is always a group of people that could conspire to rig the system. It isn't feasible to allow every member of the public the opportunity to manually vet and observe each step. So what you do is form a group made up of representatives from each party. In this way you know the group are extremely unlikely to rig anything ...


1

Setting up an entire Info Sec program is a huge undertaking, and may be a case of trying to bite off more than you can chew. I would suggest seeking out the assistance of a CISSP to help guide you through setting up an effective info security program. There are many facets to standing up a successful program, and at least you already know that you don't ...


1

If you're going to begin a Security Program, you'll need to define the scope of the program. It's probably best to begin with a limited scope so you're working with something manageable. The scope could be the development and deployment cycle, system hardening and configuration management, user management, vulnerability and security testing program etc. ...


1

This is most definitely something that should be outlined in the contract between your company and the vendor. Is it not possible for you to contact the vendor and discuss the question you have asked here? Because unless someone here works for, and is a party to the specific contract, I wouldn't see how anyone here could really answer the question for you ...


1

Many people in security incorrectly arrive at the "block USB policy" in the enterprise. Security is about enabling the business to do their job while eliminating risk. Security teams often fail to realize that they work for the business... not against it. Nothing will stop the business from accomplishing what they need to do. So, for example, block USB ...


1

My suggestion is to lock driver installation to admins and or enforce device whitelisting. Transferring confidential and sensitive data outside the company needs to be to a server requiring authentication and encryption and should have a second form of authentication for new access attempts (different machine). This can be implemented using encrypted email ...


1

The basic idea is that Policies are separated from Procedures because Policies are going to rarely change. They are a high-level view of the intent of the company. Procedures are how that intent is carried out. Those implementational details can vary from department to department and modify over time. Imagine that the users can have one kind of password ...


1

Since the question is very long.. the answer will be short: do what you like and enjoy it. It doesn't really matter what path you take, as long as it makes you more knowledgeable each step.


Only top voted, non community-wiki answers of a minimum length are eligible