Questions tagged [security]

Security is the degree of resistance to, or protection from, harm. Workplace questions should only be tagged with this if they relate to actual security concerns (physical or digital) and are specific to the workplace. See extended tag info for usage guidelines.

Filter by
Sorted by
Tagged with
4
votes
5answers
2k views

I was duped into typing my password in plaintext during a Slack chat session

I worked in a heavily regulated industry and a company that is resistant to change. We recently just got Slack and everyone on our engineering team was getting used to it. A few jokes were made with ...
15
votes
3answers
3k views

Is it legal for my employer (UK) to ask personal questions?

My employer in the United Kingdom has been requested by a third party (whom we, the company, work for) that all employees complete a security related interview involving personal questions such as if ...
74
votes
11answers
17k views

Raised concerns about a security vulnerability to various managers, for more than a year, with no results. Should I mention it to external auditors?

Our team - I work in financial and operational reporting as one of a team of 3 -- I'm not an accountant or in the finance function as such, it's more like Management Information (or Business ...
5
votes
1answer
893 views

How to handle Social Engineered relationships after Red Team engagements? [closed]

I'm learning to become a Red Teamer, which simulates attacks by adversaries from multiple angles: Digital/Cyber, Physical and Social. This questions focuses on the Social Engineering aspect of Red ...
1
vote
4answers
411 views

Using MFA on client owned computer

I have had a pretty long-term relationship with a client. We develop medical applications and part of our arrangement is that they lent me a dedicated computer to use for all the work I do with them. ...
3
votes
2answers
480 views

How can I make sure colleagues do not feel like I accuse them of doing something wrong?

I work in a small company in Thailand, SE Asia. I am originally from Europe. I live and work there since many years, we all speak English in the company, and normally communication works fine. I am ...
33
votes
9answers
20k views

Job interview by video at home and privacy concerns

I wrote a job application and the next step would be a video interview. Is it safe to do it at my home or should I go for example to a library or other public place to conduct the interview? I mean, ...
1
vote
3answers
824 views

Addressing client's security and controllability concerns

After events described in this question, my team and I decided to start our own company (limited liability). So far we are still going through setup procedures, and we are currently working with ...
4
votes
3answers
615 views

Should I disclose a disability that requires me to use a medical Bluetooth device during the application process?

I'm in the process of applying to jobs where security is a significant concern and foreign Bluetooth devices are often not permitted on site. However, I use such a device daily to manage a disability. ...
1
vote
1answer
662 views

37 years old with a psychology bachelors and work history in restaurant management [closed]

I have been wanting to change careers from being in the restaurant/hospitality industry for a few years now, but I did not want to choose a new career path without being absolutely sure that I was ...
1
vote
1answer
388 views

How could I have handled my colleagues unavailability during security incident response better?

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security ...
10
votes
4answers
1k views

How do I report an employee who is compromising security of employees and clients?

I work as a software developer on a team of 4 people for a community outreach organization. The network security is poor but upper management is aware of it, and we're planning to switch to a better ...
7
votes
4answers
1k views

Product Manager Doesn’t Care About Cybersecurity

Recently it was discovered that one of the open source packages we were using in our software was deemed vulnerable many years ago. It is no longer maintained. It is also too costly to remove and ...
-2
votes
2answers
195 views

Providing a security plan for a client [closed]

I started a small business that provides a web application to clients, and a new customer asked for a security plan. I've never written one before. I understand that security plans can vary in ...
114
votes
12answers
21k views

Should I report a leak of confidential HR information?

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and ...
48
votes
7answers
19k views

Quitting employee has privileged access to critical information

A colleague of mine had some very privileged access to sensitive information, that was kept in remote machines with no internet access whose files could not be copied to local machines. He quit the ...
8
votes
4answers
1k views

Company failed to take data breach seriously

A few months back, I was working with someone in Payroll to resolve some paycheck errors that occurred when my employer switched to a new payroll system. As it turns out, hundreds of employees were ...
3
votes
4answers
756 views

Request from management that I disagree with

Posting from real account now I work on the IT security team at my employer as a senior analyst / engineer. A part of my job duties is performance reporting to senior management on certain ...
29
votes
6answers
4k views

Coworker brings girlfriend to the office during afterhours

My coworker and I often work some (unpaid) hours on evenings and weekends. He recently started to bring in his girlfriend to the company. She will sit next to him without talking, doing stuff on her ...
0
votes
1answer
533 views

Is it good practice to sign not very important documents in a shared environment?

I learned about signing documents, so that we can assure integrity and the author attribution. In my company, we already use SharePoint which assigns documents to their creators, and also track last ...
83
votes
10answers
7k views

Sexual Harassment, helpless and scared

Disclaimer: I am not even posting this anonymous, because I really don't care anymore, and I want to be able to answer every single comment, and thank every single answer. Background Information: ...
43
votes
3answers
12k views

Is it normal for a company to ask for a photo ID when finishing my new-hire paperwork?

I've been hired by a company recently and now they're finishing my paperwork. Today, I was asked to provide a photo ID. I'm going to use a picture of my license. I want to make sure this is normal ...
8
votes
3answers
752 views

Unable to persuade colleagues

An issue I've been running into a lot is that me and colleagues are discussing how to do a certain thing in the field of software development, e.g. security. The team leans towards a certain approach ...
2
votes
3answers
741 views

Manager is not replying about permission to use dummy data

As part of the project that I was doing at a company that I recently joined I need to submit a report to my college. During the start of the project I made it clear that I would need to submit the ...
9
votes
2answers
1k views

Salary employee (software developer) held personally liable for client's data loss or exposure (GDPR)

I'm working as full time software developer at relatively small IT company (around 15 employees) which itself is a part of larger group of small to mid sized companies. In preparation for EU's new ...
143
votes
10answers
29k views

What to do when during a meeting client's people start to (physically) fight with each other?

I work on a project that requires many on-site meetings at the client's location, with client people from different departments. These departments can be considered as closed silos, where everyone ...
2
votes
4answers
478 views

Hiring at industry events in cybersecurity

On the information security team at my company where I currently work, we have several critical / urgent roles we are looking to fill, amongst including a senior security architect, several senior ...
36
votes
11answers
11k views

Is there any risk in sharing info about technologies and products we use with a supplier?

Sometimes I email with suppliers of different software products we use, may use in the future or have used in the past. In these conversations I of course provide the info necessary so that the ...
0
votes
4answers
245 views

Is reasonable right to privacy interpreted solely by policy, or are there limits within UK Law as to what is permitted? [closed]

We have a Data Protection Officer who is quite senior; and should, on paper, know the intricacies of EU/UK Data Law. However, they often make questionable choices that are challenged by other ...
2
votes
3answers
573 views

How to help new team member with security best practices without escalation to management

I currently work on the Information Security team at my employer and have been working at my company for about 4 years. Recently a new member joined the team, who per his resume has about 1.5 years of ...
28
votes
10answers
9k views

How should I approach asking to have a lock put on my storage cabinet under my desk?

I work at a small startup and we are growing quite rapidly. We recently moved to a new, bigger location and got new desks and storage cabinets for our things. I'm not secretive and I have nothing to ...
4
votes
4answers
1k views

Being held to a much higher standard than my peers

I am being held to a higher standard than my peers when it comes to security and best practices in my professional workplace. Some Background. My company's main office is located in the United ...
-4
votes
4answers
561 views

Information Security hiring

I was discussing an issue with an ex-colleague. He is currently assisting (as an HR member) with hiring for an Information Security department, where the Information Security team are responsible for ...
0
votes
1answer
132 views

How to request colleague assistance for on call support during manager vacation?

I recently joined the information security team at my employer about a month ago. Just this week, I started to participate in off hours on-call support as security must be available on a continuous ...
4
votes
4answers
516 views

How to assist non - technical end users communicate effectively and concisely during incident response?

As a member of the Information Security team at my workplace, triaging, researching, and escalating if necessary of SIEM / IDS alerts is one of my job duties. I work at central company headquarters ...
4
votes
6answers
662 views

How to gain trust of colleague who is blocking access to data?

I work in the research department of a small company. There are two people with access to the research database, me and my colleague. The research database contains anonymized data. My colleague is ...
-6
votes
1answer
186 views

The kind of safe a large company uses for important documents [closed]

Wondering what a larger company with resources uses to store important potentially confidential documents. Or what is recommended as best practices if most companies don't typically adhere to them. ...
1
vote
3answers
136 views

Value of intermediate status to certification in cybersecurity profession - Associate ISC^2

In the past year, I successfully passed the CISSP exam administered by ISC^2 . The CISSP certification is highly reputable and the most widely recognized certification amongst IT Security ...
5
votes
5answers
3k views

Is it safe to check personal accounts in work computer?

So sometimes I check things like my personal emails and do financial transactions like pay bills on my work computer. I came across an article recently that it said your work monitors every little ...
11
votes
5answers
2k views

Management is failing at enforcing their own security policies, what should I do?

At my current job, some of my duties are related to security. I know security and usability are inversely proportional, and because of that I have tried very hard to find the proper balance. I have ...
-2
votes
2answers
550 views

How a cloud data center company hires security guards [closed]

In reading a little about cloud security on platforms such as Amazon Web Services (AWS) or Google Cloud, I realize they have to hire security guards in addition to having the software-level and ...
-7
votes
3answers
405 views

How to respond to third party (vendor) theft and fraud? [closed]

Our organization acquired a software from a software engineer (Alice). Alice designed the software to take 2% off the top of all transactions and place it into her bank account. If we complained to ...
-6
votes
1answer
207 views

Are incorrect login attempts logged in by the website or company [closed]

When you put in an incorrect user id and/or password , do companies/websites keep a record of that? Like for example Joe1 had an incorrect login attempt at this time? And if so how long do they keep ...
0
votes
1answer
197 views

Sharing promotion letter from an old employer

I am currently searching for a job. Can I include the promotion letter from my old employer in my portfolio? It includes words of appreciation, new designation, and allowance.
16
votes
7answers
3k views

How to talk about the possibility of the admin being an insider threat without offending?

I work on the Information Security team and my job is to look at various applications used by a multinational finance company to analyze the design of the systems find potential security risks - ...
1
vote
1answer
363 views

Personal e-mail obtained due to compromised work account (GDPR) [closed]

At my current place of work a phishing e-mail was sent from an employee's e-mail address (Let's call them Sally). An e-mail originating from Sally's account was sent to everyone's work e-mail within ...
0
votes
2answers
240 views

How to convince manager of need for additional security testing before release [closed]

I work in the InfoSec profession as an IT auditor. One of my duties at work is testing and verifying that necessary security requirements are in place before code and application updates are released ...
1
vote
3answers
1k views

My company sends honeypot phishing email; should I automatically junk them?

My company sends honeypot phishing emails from within our organization in Microsoft Outlook. e.g. hr@mycompanyname.com , ithelpdesk@mycompanyname.com , etc. I fell to one of these in a lapse of ...
30
votes
11answers
6k views

Should the manager be CC'd when sending username and password to employee

I often create logins for new employees and then send them an email with their login credentials. While doing so I also CC their manager to let him know his user has been setup. Is this the right ...
4
votes
3answers
324 views

Startup is going without clear direction [closed]

I currently work at an international startup in Asia that has been around for more than 5 years, and I am currently going on 2 years working there. The problem is lately, many of the startup's plans ...