Collaborate Disseminate
I saw a few breaches on a very large scale where an organization like JP Morgan suffered a huge breach just by allowing their employees to connect via VPN to their machines at work. Seems that hackers took over JP. Morgan emp… Continue reading Should organisations allow their employees connect with a VPN software from their own laptops to their machine at work?
We are building an internal network and will have our software engineers developing code locally on the server using gitlab. This server will not be connected to the internet in any way, neither will the employee’s laptops an… Continue reading Should Software Development companies allow internet usage? [on hold]
I’m reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like
Mimimum password length requirements
Second factor authentication
Backup protection policies
and the l… Continue reading EU GDPR – Data protection requirement standards missing?
My admin has set the group policy so that no executable can be run on the folder \\appdata\local (because this is a common place for virus to start infecting).
As a consequence, my electron applications can’t be run anymore … Continue reading How to work when the folder \\appdata\local is locked because of security policy? [on hold]
My organization is looking at implementing an in house security risk assessment/management process. This is partially to satisfy customers and security audits partially to encourage better practices but we have no requirement… Continue reading How is your risk assessment process managed?
I’d like to use Jenkins’ ssh-slaves, but the openjdk-1.8.0-131 crypto is crippled. To fix the ciphers I need to get the Java Cryptography Extensions from the Oracle site. My specific problem is that I can only use a shell on … Continue reading How to enable JCE in a command line environment
I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a “SafeConnect Policy Key” (.exe) which, according to its … Continue reading How to respond when network info sec check requires run of downloaded unknown .exe?
I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to authenticate Windows dom… Continue reading Convince an executive to mandate HTTPS use on Intranet web servers
The situation:
An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we’ve grown and given the i… Continue reading How Should a Midsized Startup Approach Information Security and Compliance?
I work for a small consulting company with no formal IT personnel. One other employee actually cares about infosec and network management but we both get a ton of resistance when we try to spend time on this stuff because it … Continue reading Company acquires client contracts based on fake policies, what can I do? [migrated]