Skip to main content

Questions tagged [security]

Security is the degree of resistance to, or protection from, harm. Workplace questions should only be tagged with this if they relate to actual security concerns (physical or digital) and are specific to the workplace. See extended tag info for usage guidelines.

Filter by
Sorted by
Tagged with
56 votes
10 answers
14k views

How to push back against request to use personal laptop at conference due to risk of machine compromise

I manage cybersecurity team of 10 where I work. A major part of our job duties is providing application security consulting and in house penetration testing for our many development teams. Two months ...
Anthony's user avatar
  • 21.9k
3 votes
6 answers
1k views

Should I mention in my resume I have written exploit code thats incorporated into MetaSploit framework?

I have worked in cybersecurity industry for close to a decade and gained proficiency in using the open source exploit framework of MetaSploit for automated pen testing of systems that I was authorized ...
Anthony's user avatar
  • 21.9k
1 vote
2 answers
399 views

How appropriate are technical hands on exercises (e.g: CTF) when looking to hire application security engineers at industry conferences?

I am a manager within the cybersecurity division at the company where I work. Our team is responsible for internal penetration testing and the application security strategy of deployed in-house ...
Anthony's user avatar
  • 21.9k
0 votes
2 answers
1k views

How to help pen testing engineer improve intuition

I am a manager in the cybersecurity division of the company where I work and am responsible for overseeing internal pen testing of APIs and in house built applications. Many applications and APIs are ...
Anthony's user avatar
  • 21.9k
24 votes
4 answers
14k views

How can I state to junior engineers to not work a ticket unless he / she can own the task without demoralizing?

I am a manager in the cybersecurity division where I work. I have been a manager for the past five years and am well respected in the division. Our team is responsible for security engineering and ...
Anthony's user avatar
  • 21.9k
4 votes
3 answers
4k views

Employer asking us to provide SSN to a military customer [closed]

I work for a local trucking company. We deliver to many job sites in all places for our customers who are running them. Today two drivers went to military base. Typically one provides their birth ...
abettik's user avatar
  • 73
20 votes
10 answers
12k views

How can a cybersecurity team mitigate internal customer complaints that real time user training is too intrusive?

I manage a team in the cybersecurity division where I work. My team is responsible for owning several security tools used to protect company digital assets (Data loss protection suite - DLP, advanced ...
Anthony's user avatar
  • 21.9k
1 vote
6 answers
1k views

Handling a Refactoring Project with Limited Access to Source Code

I apologize if this isn't the correct place to ask this question, but I'm hoping to get some insight from the community on a problem I'm facing. I recently finished an interview with a company as a ...
Saud Alghamdi's user avatar
32 votes
13 answers
16k views

Leaving a note regarding unlocked computer

Yes, these questions/answers are related but do not answer my question. I work in a company that, to my understanding, handles very sensitive information on its network. The open space in which I am ...
z3r0's user avatar
  • 583
4 votes
4 answers
2k views

My boss wants to have access to my password manager master password

Our company has recently implemented an enterprise-wide password manager. This password manager allows us to store all our passwords that we use on a daily basis. A few days later, I was surprised to ...
KevinM's user avatar
  • 49
26 votes
5 answers
6k views

New employer's code is a timebomb of epic proportions. How to deal with this accordingly? [duplicate]

Using a temp anonymous account because I post regularly on stackoverflow/here under my real name. So I got a new employer the other week as a software engineer. Friendly team, good employer. No issues ...
BurnerAccount20230206's user avatar
0 votes
3 answers
989 views

Can I publically share code on Github for a website created for a company [closed]

I've been asked to create a website (shop-front) for a local company, now that it's done they have allowed me to share a link to my personal portfolio. The repository is currently private, but if ...
Innoc's user avatar
  • 19
17 votes
7 answers
4k views

Raising a critical security concern in organisation domain

Recently, our company (Dutch) got acquired by a bigger company (Indian) and consequently, our company had to switch over to the acquirer's IT ecosystem. Some parts of the acquirer's system are badly ...
Kinen's user avatar
  • 661
1 vote
4 answers
5k views

What are the possible consequences for refusing to use personal phone for authentication? [closed]

There are many questions here involving using ones personal phone as a phone for work purposes, and the answers tend to indicate that it is quite reasonable, even recommended, not to use a personal ...
User65535's user avatar
  • 1,009
5 votes
3 answers
878 views

How to approach IT security and legal issues with unwilling boss?

I am working as an apprentice in a very small company, and, although sizable amount of money and IP (Intellectual Property) pass by our company, IT Security and presence of legally obliged documents ...
signed's user avatar
  • 677
2 votes
6 answers
1k views

I keep getting challenged by internal infosec for no reason

I am a recent new hire (I am a data scientist on a work visa) and I've gone through all the training for my job. During my first month, I met someone named "Pete" in my office who works in ...
Antonia-InsideOut's user avatar
50 votes
8 answers
16k views

Wrongfully accused of lending my security badge to another employee

I work in the cybersecurity division of my employer, in a lead role for close to 9 years. Two days ago, I was working late patching and monitoring our systems as a result of a security incident that ...
Anthony's user avatar
  • 21.9k
3 votes
4 answers
1k views

Helping junior team members grasp abstract concepts in a new IT domain

I work as the team lead on the IT Security team where I work. I have close to 8 years of experience in cybersecurity. Recently a junior engineer joined my team. He changed IT domains from development ...
Anthony's user avatar
  • 21.9k
-2 votes
1 answer
209 views

Need Advice On Cyber Security Career Path [closed]

I'm an amateur hacker with a solid experience in full stack and programming. I recently decided to chase after my dream job and transitioned to the Cyber industry. I applied to a few companies and ...
amitsrourdev's user avatar
1 vote
1 answer
404 views

Github permission issue from developer's perspective when working on someone else's Organisation [closed]

I am working on a project where the company seems suspicious to me. It's a remote job. They invited me to their Organisation and I accepted it on my Github. They have Android, iOS & Backend ...
Tulon's user avatar
  • 137
4 votes
5 answers
5k views

May a company look at the local drives and folders of the employees? [closed]

Some company policies include the possibility to monitor their Technology for security purposes when employees utilize it, including monitoring software to scan and review Company material stored, ...
franz1's user avatar
  • 289
72 votes
13 answers
22k views

Should I disclose that I can still access a company's systems after I've left?

I used to work for a company as head of one of the IT departments. I quit because of, let's say, overall low standards and my conviction that changing them would be very difficult or impossible given ...
user43902's user avatar
  • 949
3 votes
2 answers
978 views

What rights do I have in regards to workforce management apps?

Can I declare I won't be using their app; what rights do I have? I am very thorough with my privacy and security and do not answer emails, calls, texts etc outside my contracted hours. However, the ...
rkm.b's user avatar
  • 51
1 vote
2 answers
582 views

Can poor performance in optional , but work sponsored activities hurt my standing in the company?

For National Cybersecurity Awareness Month in October, my employer is sponsoring a secure code warrior competition where teams who sign up are presented with software code with security ...
Anthony's user avatar
  • 21.9k
0 votes
1 answer
368 views

Retraining for cyber security. What's the quickest way into the field? [closed]

I’m 26 and I recently graduated with a bachelor's degree in psychology, but it hasn’t proven to be useful in finding a job. I understand there are a lot of job opportunities (with many specializations)...
Omar Abbadi's user avatar
0 votes
3 answers
364 views

Switching from software developer to infosec/pentester [closed]

About a week ago I had a chance to observe the workflow and talk with team of incredibly talented and young hackers, they were pentesting our system and dug up 4 security holes within a day. What I ...
Gurevich - SE Mods Censored Me's user avatar
-1 votes
1 answer
490 views

How to get team members to be more open with their opinions regarding architecture?

I have recently joined the architectural review board (ARB) at the place where I work serving as the security representative. The role of the ARB is to recommend and approve software design ...
Anthony's user avatar
  • 21.9k
0 votes
6 answers
951 views

Secure code review requirement for cybersecurity engineer hiring

I am the team lead on the IT Security team where I work. Recently we were interviewing for an security engine role. One of the traditional security / SOC engineer roles in all the places I worked is ...
Anthony's user avatar
  • 21.9k
104 votes
11 answers
40k views

How can I get an information security team to see that their over-the-top security measures are only decreasing security?

Summary: I worked for a small startup, that was acquired by a mega corporation. Its IT security policies are excessive, but they don't add more security, and prevent me from doing work. How do I ...
cypher's user avatar
  • 966
7 votes
4 answers
1k views

What should I do when in a work environment that confuses security with control actually slows down my workflow?

So I am working as a temp basically for a banking institution that has me restricted from downloading Git, it creates a Bitbucket repo for me but I am denied access to the repo that was created on my ...
Daniel's user avatar
  • 1,563
0 votes
2 answers
675 views

Is participation in different bug hunting programs viable career path and source of income?

Is participation in different bug hunting programs viable career path and source of income? More specific questions: What are estimated, expected earnings of bug hunters? How long one needs to train/...
Jan Kowalski's user avatar
8 votes
5 answers
2k views

How to tell junior team member that particular certification may be not right for them at this time without being demoralizing?

I have been working in the cybersecurity profession for about close to 6 years now, and just last year got CISSP certification, along with the AWS Security certification recently. As the team lead, ...
Anthony's user avatar
  • 21.9k
4 votes
2 answers
559 views

How can I help junior colleagues understand the why of tasks our team does

I work in IT Security as the team lead of the team. I really enjoy mentoring younger, more junior colleagues of team and in the past, my manager has complimented me on how teaching and leadership are ...
Anthony's user avatar
  • 21.9k
33 votes
9 answers
10k views

How to communicate to developers about security vulnerability detected when not included in user stories (requirements) [closed]

I work as the team lead of the IT Security team where I work. A major part of my job duties is leading vulnerabilities scanning, management, and remediation validation. I frequently interact with ...
Anthony's user avatar
  • 21.9k
3 votes
3 answers
263 views

How to coordinate urgent video conferencing meetings with team when working remote with less than optimal Internet connection?

I work as team lead of the IT Security team where I work. Today we had a security incident (verified via tripped canary tokens / observed IOCs) and I had to coordinate all hands on deck meeting with ...
Anthony's user avatar
  • 21.9k
8 votes
8 answers
2k views

How can I help developers reduce amount of instant messages to my team?

I am the team lead of the IT security team where I currently work. We have recently completed our annual vulnerability penetration testing and now user stories to remediate vulnerabilities are been ...
Anthony's user avatar
  • 21.9k
2 votes
1 answer
559 views

How can I safely show in my resume my experience with pen testing tools

I work in the cybersecurity field as a security analyst. As a part of my work I have gained decent experience with white hat penetration testing tools such as Snort, Burp Suite, MetaSploit etc. I also ...
Anthony's user avatar
  • 21.9k
32 votes
6 answers
11k views

Ensuring employees don't leak code or data [closed]

How do you make sure that your private code repository/data files aren't leaked by your employees? On their work device, they would need to simultaneously have sensitive code/data, along with ...
user997943's user avatar
-1 votes
1 answer
728 views

If a private company has been targeted by ransomware do they need to make this detail public?

What responsibility does a company have after they have fallen victim to a targeted hack/ransomware attack? And what responsibilities does an individual have if they know of such as issue, which is ...
Karm's user avatar
  • 807
48 votes
6 answers
16k views

Accidentally defaced an internal production website during vulnerability scanning - How do I protect myself

I work in the information security department at my employer. Today while using automated tool of Burp Suite on one of our internal web applications in production to search for vulnerabilities, I ...
Anthony's user avatar
  • 21.9k
4 votes
5 answers
2k views

I was duped into typing my password in plaintext during a Slack chat session

I worked in a heavily regulated industry and a company that is resistant to change. We recently just got Slack and everyone on our engineering team was getting used to it. A few jokes were made with ...
Jamie Fevor's user avatar
76 votes
11 answers
18k views

Raised concerns about a security vulnerability to various managers, for more than a year, with no results. Should I mention it to external auditors?

Our team - I work in financial and operational reporting as one of a team of 3 -- I'm not an accountant or in the finance function as such, it's more like Management Information (or Business ...
user111727's user avatar
14 votes
3 answers
4k views

Is it legal for my employer (UK) to ask personal questions?

My employer in the United Kingdom has been requested by a third party (whom we, the company, work for) that all employees complete a security related interview involving personal questions such as if ...
Steven's user avatar
  • 159
5 votes
1 answer
959 views

How to handle Social Engineered relationships after Red Team engagements? [closed]

I'm learning to become a Red Teamer, which simulates attacks by adversaries from multiple angles: Digital/Cyber, Physical and Social. This questions focuses on the Social Engineering aspect of Red ...
ChocolateOverflow's user avatar
1 vote
4 answers
452 views

Using MFA on client owned computer

I have had a pretty long-term relationship with a client. We develop medical applications and part of our arrangement is that they lent me a dedicated computer to use for all the work I do with them. ...
Sam Washburn's user avatar
4 votes
3 answers
876 views

How can I make sure colleagues do not feel like I accuse them of doing something wrong?

I work in a small company in Thailand, SE Asia. I am originally from Europe. I live and work there since many years, we all speak English in the company, and normally communication works fine. I am ...
Edgar's user avatar
  • 4,377
31 votes
9 answers
21k views

Job interview by video at home and privacy concerns

I wrote a job application and the next step would be a video interview. Is it safe to do it at my home or should I go for example to a library or other public place to conduct the interview? I mean, ...
guest's user avatar
  • 403
6 votes
3 answers
792 views

Should I disclose a disability that requires me to use a medical Bluetooth device during the application process?

I'm in the process of applying to jobs where security is a significant concern and foreign Bluetooth devices are often not permitted on site. However, I use such a device daily to manage a disability. ...
Scroopy's user avatar
  • 69
1 vote
1 answer
733 views

37 years old with a psychology bachelors and work history in restaurant management [closed]

I have been wanting to change careers from being in the restaurant/hospitality industry for a few years now, but I did not want to choose a new career path without being absolutely sure that I was ...
iNs1De0UT's user avatar
1 vote
1 answer
488 views

How could I have handled my colleagues unavailability during security incident response better?

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security ...
Anthony's user avatar
  • 21.9k