Questions tagged [security]

Security is the degree of resistance to, or protection from, harm. Workplace questions should only be tagged with this if they relate to actual security concerns (physical or digital) and are specific to the workplace. See extended tag info for usage guidelines.

Filter by
Sorted by
Tagged with
-2
votes
1answer
158 views

Need Advice On Cyber Security Career Path [closed]

I'm an amateur hacker with a solid experience in full stack and programming. I recently decided to chase after my dream job and transitioned to the Cyber industry. I applied to a few companies and ...
211
votes
9answers
27k views

Should a new employee be disciplined for not recognising a superior? [closed]

I work as a senior developer in a small/medium UK-based company with multiple offices. Rarely do personnel go between the different offices. Our office has a publicly accessible reception area but the ...
0
votes
1answer
387 views

Github permission issue from developer's perspective when working on someone else's Organisation [closed]

I am working on a project where the company seems suspicious to me. It's a remote job. They invited me to their Organisation and I accepted it on my Github. They have Android, iOS & Backend ...
156
votes
11answers
31k views

What to do when during a meeting client's people start to (physically) fight with each other?

I work on a project that requires many on-site meetings at the client's location, with client people from different departments. These departments can be considered as closed silos, where everyone ...
5
votes
5answers
3k views

May a company look at the local drives and folders of the employees? [closed]

Some company policies include the possibility to monitor their Technology for security purposes when employees utilize it, including monitoring software to scan and review Company material stored, ...
73
votes
14answers
14k views

Should I disclose that I can still access a company's systems after I've left?

I used to work for a company as head of one of the IT departments. I quit because of, let's say, overall low standards and my conviction that changing them would be very difficult or impossible given ...
13
votes
6answers
3k views

Handling fallout due to new security policies

I am an InfoSec professional working as an IT auditor. For several months now, I have working closely with our information security team to strengthen the security controls governing our PCI and SOX ...
3
votes
2answers
769 views

What rights do I have in regards to workforce management apps?

Can I declare I won't be using their app; what rights do I have? I am very thorough with my privacy and security and do not answer emails, calls, texts etc outside my contracted hours. However, the ...
75
votes
11answers
15k views

How can I get an information security team to see that their over-the-top security measures are only decreasing security?

Summary: I worked for a small startup, that was acquired by a mega corporation. Its IT security policies are excessive, but they don't add more security, and prevent me from doing work. How do I ...
1
vote
2answers
491 views

Can poor performance in optional , but work sponsored activities hurt my standing in the company?

For National Cybersecurity Awareness Month in October, my employer is sponsoring a secure code warrior competition where teams who sign up are presented with software code with security ...
0
votes
1answer
326 views

Retraining for cyber security. What's the quickest way into the field? [closed]

I’m 26 and I recently graduated with a bachelor's degree in psychology, but it hasn’t proven to be useful in finding a job. I understand there are a lot of job opportunities (with many specializations)...
0
votes
3answers
260 views

Switching from software developer to infosec/pentester [closed]

About a week ago I had a chance to observe the workflow and talk with team of incredibly talented and young hackers, they were pentesting our system and dug up 4 security holes within a day. What I ...
-1
votes
1answer
476 views

How to get team members to be more open with their opinions regarding architecture?

I have recently joined the architectural review board (ARB) at the place where I work serving as the security representative. The role of the ARB is to recommend and approve software design ...
0
votes
6answers
886 views

Secure code review requirement for cybersecurity engineer hiring

I am the team lead on the IT Security team where I work. Recently we were interviewing for an security engine role. One of the traditional security / SOC engineer roles in all the places I worked is ...
7
votes
4answers
1k views

What should I do when in a work environment that confuses security with control actually slows down my workflow?

So I am working as a temp basically for a banking institution that has me restricted from downloading Git, it creates a Bitbucket repo for me but I am denied access to the repo that was created on my ...
13
votes
6answers
26k views

Should I give recruiter my DOB and last four digits of SSN?

This site has had similar questions about giving private information to recruiters but I haven't seen this particular case. When I'm cold-called by an recruitment agency about a job, and I agree to ...
0
votes
2answers
655 views

Is participation in different bug hunting programs viable career path and source of income?

Is participation in different bug hunting programs viable career path and source of income? More specific questions: What are estimated, expected earnings of bug hunters? How long one needs to train/...
34
votes
6answers
6k views

Coworker brings girlfriend to the office during afterhours

My coworker and I often work some (unpaid) hours on evenings and weekends. He recently started to bring in his girlfriend to the company. She will sit next to him without talking, doing stuff on her ...
8
votes
5answers
1k views

How to tell junior team member that particular certification may be not right for them at this time without being demoralizing?

I have been working in the cybersecurity profession for about close to 6 years now, and just last year got CISSP certification, along with the AWS Security certification recently. As the team lead, ...
4
votes
2answers
429 views

How can I help junior colleagues understand the why of tasks our team does

I work in IT Security as the team lead of the team. I really enjoy mentoring younger, more junior colleagues of team and in the past, my manager has complimented me on how teaching and leadership are ...
34
votes
9answers
10k views

How to communicate to developers about security vulnerability detected when not included in user stories (requirements) [closed]

I work as the team lead of the IT Security team where I work. A major part of my job duties is leading vulnerabilities scanning, management, and remediation validation. I frequently interact with ...
86
votes
13answers
14k views

As a developer, how can I ask for more freedom when confronted with a tight IT security policy?

I've just joined a new company of around 100 employees, 15 of which are developers (including myself). A very frustrating aspect of the job is the IT security policy. As developers we need access to ...
2
votes
3answers
248 views

How to coordinate urgent video conferencing meetings with team when working remote with less than optimal Internet connection?

I work as team lead of the IT Security team where I work. Today we had a security incident (verified via tripped canary tokens / observed IOCs) and I had to coordinate all hands on deck meeting with ...
8
votes
8answers
1k views

How can I help developers reduce amount of instant messages to my team?

I am the team lead of the IT security team where I currently work. We have recently completed our annual vulnerability penetration testing and now user stories to remediate vulnerabilities are been ...
2
votes
1answer
459 views

How can I safely show in my resume my experience with pen testing tools

I work in the cybersecurity field as a security analyst. As a part of my work I have gained decent experience with white hat penetration testing tools such as Snort, Burp Suite, MetaSploit etc. I also ...
1
vote
3answers
203 views

Value of intermediate status to certification in cybersecurity profession - Associate ISC^2

In the past year, I successfully passed the CISSP exam administered by ISC^2 . The CISSP certification is highly reputable and the most widely recognized certification amongst IT Security ...
32
votes
7answers
11k views

Ensuring employees don't leak code or data [closed]

How do you make sure that your private code repository/data files aren't leaked by your employees? On their work device, they would need to simultaneously have sensitive code/data, along with ...
-1
votes
1answer
719 views

If a private company has been targeted by ransomware do they need to make this detail public?

What responsibility does a company have after they have fallen victim to a targeted hack/ransomware attack? And what responsibilities does an individual have if they know of such as issue, which is ...
4
votes
3answers
797 views

How can I make sure colleagues do not feel like I accuse them of doing something wrong?

I work in a small company in Thailand, SE Asia. I am originally from Europe. I live and work there since many years, we all speak English in the company, and normally communication works fine. I am ...
3
votes
6answers
745 views

Hiring at industry events in cybersecurity

On the information security team at my company where I currently work, we have several critical / urgent roles we are looking to fill, amongst including a senior security architect, several senior ...
49
votes
6answers
15k views

Accidentally defaced an internal production website during vulnerability scanning - How do I protect myself

I work in the information security department at my employer. Today while using automated tool of Burp Suite on one of our internal web applications in production to search for vulnerabilities, I ...
4
votes
5answers
2k views

I was duped into typing my password in plaintext during a Slack chat session

I worked in a heavily regulated industry and a company that is resistant to change. We recently just got Slack and everyone on our engineering team was getting used to it. A few jokes were made with ...
15
votes
3answers
3k views

Is it legal for my employer (UK) to ask personal questions?

My employer in the United Kingdom has been requested by a third party (whom we, the company, work for) that all employees complete a security related interview involving personal questions such as if ...
75
votes
11answers
17k views

Raised concerns about a security vulnerability to various managers, for more than a year, with no results. Should I mention it to external auditors?

Our team - I work in financial and operational reporting as one of a team of 3 -- I'm not an accountant or in the finance function as such, it's more like Management Information (or Business ...
5
votes
1answer
931 views

How to handle Social Engineered relationships after Red Team engagements? [closed]

I'm learning to become a Red Teamer, which simulates attacks by adversaries from multiple angles: Digital/Cyber, Physical and Social. This questions focuses on the Social Engineering aspect of Red ...
1
vote
4answers
426 views

Using MFA on client owned computer

I have had a pretty long-term relationship with a client. We develop medical applications and part of our arrangement is that they lent me a dedicated computer to use for all the work I do with them. ...
33
votes
9answers
21k views

Job interview by video at home and privacy concerns

I wrote a job application and the next step would be a video interview. Is it safe to do it at my home or should I go for example to a library or other public place to conduct the interview? I mean, ...
1
vote
3answers
879 views

Addressing client's security and controllability concerns

After events described in this question, my team and I decided to start our own company (limited liability). So far we are still going through setup procedures, and we are currently working with ...
5
votes
3answers
658 views

Should I disclose a disability that requires me to use a medical Bluetooth device during the application process?

I'm in the process of applying to jobs where security is a significant concern and foreign Bluetooth devices are often not permitted on site. However, I use such a device daily to manage a disability. ...
1
vote
1answer
672 views

37 years old with a psychology bachelors and work history in restaurant management [closed]

I have been wanting to change careers from being in the restaurant/hospitality industry for a few years now, but I did not want to choose a new career path without being absolutely sure that I was ...
1
vote
1answer
419 views

How could I have handled my colleagues unavailability during security incident response better?

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security ...
13
votes
4answers
2k views

How do I report an employee who is compromising security of employees and clients?

I work as a software developer on a team of 4 people for a community outreach organization. The network security is poor but upper management is aware of it, and we're planning to switch to a better ...
7
votes
4answers
1k views

Product Manager Doesn’t Care About Cybersecurity

Recently it was discovered that one of the open source packages we were using in our software was deemed vulnerable many years ago. It is no longer maintained. It is also too costly to remove and ...
-2
votes
2answers
219 views

Providing a security plan for a client [closed]

I started a small business that provides a web application to clients, and a new customer asked for a security plan. I've never written one before. I understand that security plans can vary in ...
114
votes
12answers
22k views

Should I report a leak of confidential HR information?

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and ...
48
votes
7answers
20k views

Quitting employee has privileged access to critical information

A colleague of mine had some very privileged access to sensitive information, that was kept in remote machines with no internet access whose files could not be copied to local machines. He quit the ...
8
votes
4answers
1k views

Company failed to take data breach seriously

A few months back, I was working with someone in Payroll to resolve some paycheck errors that occurred when my employer switched to a new payroll system. As it turns out, hundreds of employees were ...
3
votes
4answers
886 views

Request from management that I disagree with

Posting from real account now I work on the IT security team at my employer as a senior analyst / engineer. A part of my job duties is performance reporting to senior management on certain ...
0
votes
1answer
540 views

Is it good practice to sign not very important documents in a shared environment?

I learned about signing documents, so that we can assure integrity and the author attribution. In my company, we already use SharePoint which assigns documents to their creators, and also track last ...
83
votes
10answers
8k views

Sexual Harassment, helpless and scared

Disclaimer: I am not even posting this anonymous, because I really don't care anymore, and I want to be able to answer every single comment, and thank every single answer. Background Information: ...