Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Security is the degree of resistance to, or protection from, harm. Workplace questions should only be tagged with this if they relate to actual security concerns (physical or digital) and are specific to the workplace. See extended tag info for usage guidelines.

6
votes
4answers
2k views

Found out co-worker got IT to get into my computer [closed]

At my current place of work, more than 1 person can use the same account on a single computer. The co-worker had initially asked why do I shut down my computer at the end of the day. To solve this ...
6
votes
2answers
3k views

Security clearance commitment as intern

I have an internship at a government contractor and just handed in my security clerance papers (TS/SCI). I heard they are expensive to sponsor, if I decide not to return to the company in the future ...
6
votes
3answers
680 views

Is it common for software development jobs to prioritise speed over security (or lack thereof)? [closed]

I have encountered startups to large corporations (outsourcing work) to prioritise speed, go-to-market and churning out as much code as fast as possible. In this scenario, any software developer can ...
6
votes
2answers
426 views

Raising concerns with a software vendor company

I was filling up some details in our payroll site that is maintained by a third party vendor. I had difficulty saving and there wasn't an error message. Curious, I decided to check the browser console ...
5
votes
5answers
1k views

Is it safe to check personal accounts in work computer?

So sometimes I check things like my personal emails and do financial transactions like pay bills on my work computer. I came across an article recently that it said your work monitors every little ...
5
votes
4answers
3k views

How do I report the improper use of social security numbers at work?

At my workplace, my employer has a web based timeclock. At each location, we have a shared computer at the counter that employees use to clock in. The user ID that each person is assigned is their ...
5
votes
4answers
1k views

I have noticed that a potential employer's website has been compromised - should I mention it during an interview?

I am about to have a telephone interview for a junior software developer position. When learning more about the company I have noticed that their website has been compromised or, simply put, hacked (...
5
votes
4answers
756 views

How can I explain technical concepts related to business management who lack background to understand?

I am an IT auditor. I am writing a report for a security review / audit that I completed of a business application used by my company. I have found weaknesses related to MITM (Man in the middle) and ...
5
votes
3answers
647 views

How can I help team members be more discreet and judicious?

I am an IT Auditor and the lead for the team. Our team has access to very sensitive data such as: Audit findings Pen testing results / vulnerability scans Audit committee correspondence If some of ...
4
votes
2answers
920 views

How to deal with senior employees subverting security tests [closed]

I work as an IT contractor for a large insurance company in the UK. Every so often, our security team will send a fake email around our office, to test that people can recognize and flag phishing/...
4
votes
4answers
841 views

Being held to a much higher standard than my peers

I am being held to a higher standard than my peers when it comes to security and best practices in my professional workplace. Some Background. My company's main office is located in the United ...
4
votes
6answers
652 views

How to gain trust of colleague who is blocking access to data?

I work in the research department of a small company. There are two people with access to the research database, me and my colleague. The research database contains anonymized data. My colleague is ...
4
votes
2answers
812 views

Should companies pay employees for responsible disclosures?

I recently discovered a major security vulnerability (SQL injection) in one of my companies projects in my free time. I'm working there as a developer, not as a security researcher, but after ...
4
votes
4answers
477 views

How to assist non - technical end users communicate effectively and concisely during incident response?

As a member of the Information Security team at my workplace, triaging, researching, and escalating if necessary of SIEM / IDS alerts is one of my job duties. I work at central company headquarters ...
4
votes
3answers
318 views

Startup is going without clear direction [closed]

I currently work at an international startup in Asia that has been around for more than 5 years, and I am currently going on 2 years working there. The problem is lately, many of the startup's plans ...
3
votes
3answers
2k views

Employer responsibility in a potentially (key) violent stalking situation?

Straight to the Point: What level of responsibility does an employer in the U.S. (New York State) have if an employee (full-time) alerts them to someone potentially stalking them and who might act out ...
3
votes
3answers
454 views

Should I open the door if I cannot verify that someone has an access card? [closed]

I work at a popular hospital, and we use keycards/badges to enter buildings. If someone asks me to open the door for them should I oblige?
3
votes
4answers
628 views

Request from management that I disagree with

Posting from real account now I work on the IT security team at my employer as a senior analyst / engineer. A part of my job duties is performance reporting to senior management on certain ...
3
votes
4answers
5k views

Should I provide my photo ID to a recruiter? [duplicate]

A third-party recruiter reached out to me for a job at a tech company. After receiving my resume, the recruiter said that the company (which he named) has requested my photo ID. The company seems to ...
2
votes
1answer
894 views

Cleaning Lady Snooping Around

Our company contracts cleaning services to a third party cleaning service. Last night I walked into my CEO's offices and caught our cleaning person sitting behind his desk on his chair texting and ...
2
votes
3answers
721 views

Manager is not replying about permission to use dummy data

As part of the project that I was doing at a company that I recently joined I need to submit a report to my college. During the start of the project I made it clear that I would need to submit the ...
2
votes
2answers
708 views

Communicating with a manager who has no programming experience

I am a Jr. Developer working in the healthcare industry. I am currently assigned to build automation tools that download eligibility files. I'll spare you most of the details since they are irrelevant ...
2
votes
3answers
2k views

Does my employer have the right to phishing a personal account for security purposes? [closed]

A few days ago I received a LinkedIn invitation email from some other employee of the company. I clicked the email link to check this person LinkedIn profile, I logged in with my personal account into ...
2
votes
3answers
770 views

Should I contact someone about IT asking for passwords? [closed]

I recently switched to a new laptop at work, so IT had to set it up for me and move my files over. The problem is they asked for my password to do it. I balked, and after some hemming and hawing on ...
2
votes
1answer
338 views

Client asks for SSN in Statement of Work and wants it sent signed via email

In a Statement of Work from a client, there's a field for the Social Security Number or the Tax Identification Number in the Contractor details. The client wants this SoW sent back signed, over email, ...
2
votes
3answers
3k views

Recruiter asking for last 3 digits of SSN, day and month of birth [duplicate]

The recruiter says they will need it to create my security ID as the role is through a vendor management system. Does this sound legit?
2
votes
4answers
462 views

Hiring at industry events in cybersecurity

On the information security team at my company where I currently work, we have several critical / urgent roles we are looking to fill, amongst including a senior security architect, several senior ...
2
votes
3answers
471 views

How to help new team member with security best practices without escalation to management

I currently work on the Information Security team at my employer and have been working at my company for about 4 years. Recently a new member joined the team, who per his resume has about 1.5 years of ...
2
votes
1answer
903 views

Adding a home address to an LLC - real home address vs PO box vs private mailbox service

Can someone provide insight on the pros/cons of registering a business using (1) a real home address vs (2) a PO Box vs (3) a private mail service? The company is a small software consulting business/...
1
vote
4answers
1k views

Is it an acceptable practice for IT to ask an employee for their password over Skype Messenger?

I got an email saying my password would expire in a few days, so I clicked on the link in the email and updated it. After doing so, I realized I could no longer log in to my computer, except by ...
1
vote
3answers
2k views

I'm a freelancer and my boss fired me without real reason. How can I secure my work? [closed]

Yesterday my boss fired me (I'm still in for one or two days) because of a pretty heated discussion that involved management steps and ideas. We are very far into the beta development stages. I ...
1
vote
3answers
1k views

My company sends honeypot phishing email; should I automatically junk them?

My company sends honeypot phishing emails from within our organization in Microsoft Outlook. e.g. hr@mycompanyname.com , ithelpdesk@mycompanyname.com , etc. I fell to one of these in a lapse of ...
1
vote
2answers
946 views

My manager wants to create an administrator account on my work computer that only he has the password to [closed]

This is on a Windows 10 system, that is provided to me by work. They want to create an administrator account that only my manager will have the password to. The thing is, this isn't from IT and it's ...
1
vote
6answers
1k views

Acceptable for new hire to bring up bad security practices, or “go with the flow”? [duplicate]

I'm a new hire low-level engineer at a large company in the US. When signing up for my benefits/insurance package, I noticed that the password requirements included a 9 character maximum. Needless to ...
1
vote
4answers
717 views

Moving to new technologies when colleagues don't want to [closed]

I work with really old technology which takes ages to create websites. The security is also bad (tons of vulnerabilities such as XSS, CSRF...). How do I change to a better situation? The guy who ...
1
vote
2answers
408 views

Addressing client's security and controllability concerns

After events described in this question, my team and I decided to start our own company (limited liability). So far we are still going through setup procedures, and we are currently working with ...
1
vote
1answer
356 views

Personal e-mail obtained due to compromised work account (GDPR) [closed]

At my current place of work a phishing e-mail was sent from an employee's e-mail address (Let's call them Sally). An e-mail originating from Sally's account was sent to everyone's work e-mail within ...
1
vote
2answers
497 views

Should I speak to my boss about Security Measures when my Internship is ending?

I'm currently in a 9 month internship in a small/medium sized company. On my first day in this job, I've been assigned to solo develop an application. I did, and the application is currently working ...
1
vote
3answers
127 views

Value of intermediate status to certification in cybersecurity profession - Associate ISC^2

In the past year, I successfully passed the CISSP exam administered by ISC^2 . The CISSP certification is highly reputable and the most widely recognized certification amongst IT Security ...
1
vote
1answer
265 views

Can I ask a freelance agency to not send me my own personal info through email?

To be clear, I'm an independent contractor: people come to their website and ask for services, and I reply to the ones I can help with. If they decide to go with me, all payment goes through the ...
1
vote
0answers
69 views

Should I give my SSN to recruiter? [duplicate]

I got call from recruiter and he said I should give him my SSN in order to apply to job. From his email: As part of our disclosures and to present you as a qualified Candidate to [Company Name], ...
0
votes
2answers
194 views

How to communicate with checkbox-tickers about CMS choices [closed]

A web department develops a lot of CMSes using developer-friendly tools and frameworks, mostly using open-source technologies. They are being asked to develop and support a website using Sharepoint ...
0
votes
3answers
497 views

How to get the attention of operations manager as a junior?

The software development company I work for has around 40-50 employees with about 12 of those being developers. I work as a junior developer and have been working for about a year after completing an ...
0
votes
2answers
563 views

Job offer was rescinded due to security clearance?

My husband received a conditional offer for a job that required security clearance. After they investigated him the report has "No Determination Status. Therefore the job offer was rescinded. We are ...
0
votes
2answers
1k views

Voluntary self identification of a disability form - should I discose my RA? [closed]

I have rheumatoid arthritis. Should I fill out the "voluntary self identification of a disability" form? I have worked for this company over 20 years. We do have a functional abilities test that ...
0
votes
1answer
506 views

Is it good practice to sign not very important documents in a shared environment?

I learned about signing documents, so that we can assure integrity and the author attribution. In my company, we already use SharePoint which assigns documents to their creators, and also track last ...
0
votes
1answer
164 views

Communicating with prospective vendor about official documents

My manager and senior management at my company has requested due diligence feedback on a prospective vendor our company is thinking of doing business with. It is the same company I asked about in this ...
0
votes
1answer
2k views

How much information should I give my former boss when I lost a company key? [closed]

I just ended my job and my last day was yesterday. I had lost my keys (I know, I'm bad) and informed the secretary who is encharge of them and she gave me a replacement set. The other day when I left ...
0
votes
4answers
241 views

Is reasonable right to privacy interpreted solely by policy, or are there limits within UK Law as to what is permitted? [closed]

We have a Data Protection Officer who is quite senior; and should, on paper, know the intricacies of EU/UK Data Law. However, they often make questionable choices that are challenged by other ...
0
votes
2answers
229 views

How to convince manager of need for additional security testing before release [closed]

I work in the InfoSec profession as an IT auditor. One of my duties at work is testing and verifying that necessary security requirements are in place before code and application updates are released ...