Questions tagged [security]

Security is the degree of resistance to, or protection from, harm. Workplace questions should only be tagged with this if they relate to actual security concerns (physical or digital) and are specific to the workplace. See extended tag info for usage guidelines.

Filter by
Sorted by
Tagged with
7
votes
7answers
2k views

How to persuade boss that games with e-mail are not a good way to increase security

My boss wants to force a game that when you leave your computer unlocked and walk away others will send an e-mail from you (saying something stupid; like free doughnuts tomorrow). The impetus for ...
7
votes
4answers
1k views

Product Manager Doesn’t Care About Cybersecurity

Recently it was discovered that one of the open source packages we were using in our software was deemed vulnerable many years ago. It is no longer maintained. It is also too costly to remove and ...
7
votes
2answers
3k views

Employers installing keyloggers on work PC [closed]

I am in Canada. Is it legal for your employer to install a keylogger or other monitoring software on your workplace PC without informing you of this fact? Do I have any right regarding this?
6
votes
4answers
2k views

Found out co-worker got IT to get into my computer [closed]

At my current place of work, more than 1 person can use the same account on a single computer. The co-worker had initially asked why do I shut down my computer at the end of the day. To solve this ...
6
votes
2answers
3k views

Security clearance commitment as intern

I have an internship at a government contractor and just handed in my security clerance papers (TS/SCI). I heard they are expensive to sponsor, if I decide not to return to the company in the future ...
6
votes
3answers
683 views

Is it common for software development jobs to prioritise speed over security (or lack thereof)? [closed]

I have encountered startups to large corporations (outsourcing work) to prioritise speed, go-to-market and churning out as much code as fast as possible. In this scenario, any software developer can ...
6
votes
2answers
428 views

Raising concerns with a software vendor company

I was filling up some details in our payroll site that is maintained by a third party vendor. I had difficulty saving and there wasn't an error message. Curious, I decided to check the browser console ...
5
votes
5answers
2k views

Is it safe to check personal accounts in work computer?

So sometimes I check things like my personal emails and do financial transactions like pay bills on my work computer. I came across an article recently that it said your work monitors every little ...
5
votes
4answers
3k views

How do I report the improper use of social security numbers at work?

At my workplace, my employer has a web based timeclock. At each location, we have a shared computer at the counter that employees use to clock in. The user ID that each person is assigned is their ...
5
votes
4answers
1k views

I have noticed that a potential employer's website has been compromised - should I mention it during an interview?

I am about to have a telephone interview for a junior software developer position. When learning more about the company I have noticed that their website has been compromised or, simply put, hacked (...
5
votes
4answers
760 views

How can I explain technical concepts related to business management who lack background to understand?

I am an IT auditor. I am writing a report for a security review / audit that I completed of a business application used by my company. I have found weaknesses related to MITM (Man in the middle) and ...
5
votes
3answers
678 views

How can I help team members be more discreet and judicious?

I am an IT Auditor and the lead for the team. Our team has access to very sensitive data such as: Audit findings Pen testing results / vulnerability scans Audit committee correspondence If some of ...
4
votes
2answers
951 views

How to deal with senior employees subverting security tests [closed]

I work as an IT contractor for a large insurance company in the UK. Every so often, our security team will send a fake email around our office, to test that people can recognize and flag phishing/...
4
votes
4answers
906 views

Being held to a much higher standard than my peers

I am being held to a higher standard than my peers when it comes to security and best practices in my professional workplace. Some Background. My company's main office is located in the United ...
4
votes
6answers
658 views

How to gain trust of colleague who is blocking access to data?

I work in the research department of a small company. There are two people with access to the research database, me and my colleague. The research database contains anonymized data. My colleague is ...
4
votes
2answers
816 views

Should companies pay employees for responsible disclosures?

I recently discovered a major security vulnerability (SQL injection) in one of my companies projects in my free time. I'm working there as a developer, not as a security researcher, but after ...
4
votes
4answers
504 views

How to assist non - technical end users communicate effectively and concisely during incident response?

As a member of the Information Security team at my workplace, triaging, researching, and escalating if necessary of SIEM / IDS alerts is one of my job duties. I work at central company headquarters ...
4
votes
3answers
320 views

Startup is going without clear direction [closed]

I currently work at an international startup in Asia that has been around for more than 5 years, and I am currently going on 2 years working there. The problem is lately, many of the startup's plans ...
3
votes
3answers
2k views

Employer responsibility in a potentially (key) violent stalking situation?

Straight to the Point: What level of responsibility does an employer in the U.S. (New York State) have if an employee (full-time) alerts them to someone potentially stalking them and who might act out ...
3
votes
3answers
459 views

Should I open the door if I cannot verify that someone has an access card? [closed]

I work at a popular hospital, and we use keycards/badges to enter buildings. If someone asks me to open the door for them should I oblige?
3
votes
4answers
5k views

Should I provide my photo ID to a recruiter? [duplicate]

A third-party recruiter reached out to me for a job at a tech company. After receiving my resume, the recruiter said that the company (which he named) has requested my photo ID. The company seems to ...
3
votes
4answers
704 views

Request from management that I disagree with

Posting from real account now I work on the IT security team at my employer as a senior analyst / engineer. A part of my job duties is performance reporting to senior management on certain ...
2
votes
1answer
897 views

Cleaning Lady Snooping Around

Our company contracts cleaning services to a third party cleaning service. Last night I walked into my CEO's offices and caught our cleaning person sitting behind his desk on his chair texting and ...
2
votes
3answers
732 views

Manager is not replying about permission to use dummy data

As part of the project that I was doing at a company that I recently joined I need to submit a report to my college. During the start of the project I made it clear that I would need to submit the ...
2
votes
2answers
710 views

Communicating with a manager who has no programming experience

I am a Jr. Developer working in the healthcare industry. I am currently assigned to build automation tools that download eligibility files. I'll spare you most of the details since they are irrelevant ...
2
votes
3answers
2k views

Does my employer have the right to phishing a personal account for security purposes? [closed]

A few days ago I received a LinkedIn invitation email from some other employee of the company. I clicked the email link to check this person LinkedIn profile, I logged in with my personal account into ...
2
votes
3answers
774 views

Should I contact someone about IT asking for passwords? [closed]

I recently switched to a new laptop at work, so IT had to set it up for me and move my files over. The problem is they asked for my password to do it. I balked, and after some hemming and hawing on ...
2
votes
1answer
340 views

Client asks for SSN in Statement of Work and wants it sent signed via email

In a Statement of Work from a client, there's a field for the Social Security Number or the Tax Identification Number in the Contractor details. The client wants this SoW sent back signed, over email, ...
2
votes
3answers
3k views

Recruiter asking for last 3 digits of SSN, day and month of birth [duplicate]

The recruiter says they will need it to create my security ID as the role is through a vendor management system. Does this sound legit?
2
votes
4answers
473 views

Hiring at industry events in cybersecurity

On the information security team at my company where I currently work, we have several critical / urgent roles we are looking to fill, amongst including a senior security architect, several senior ...
2
votes
3answers
490 views

How to help new team member with security best practices without escalation to management

I currently work on the Information Security team at my employer and have been working at my company for about 4 years. Recently a new member joined the team, who per his resume has about 1.5 years of ...
2
votes
1answer
905 views

Adding a home address to an LLC - real home address vs PO box vs private mailbox service

Can someone provide insight on the pros/cons of registering a business using (1) a real home address vs (2) a PO Box vs (3) a private mail service? The company is a small software consulting business/...
1
vote
4answers
1k views

Is it an acceptable practice for IT to ask an employee for their password over Skype Messenger?

I got an email saying my password would expire in a few days, so I clicked on the link in the email and updated it. After doing so, I realized I could no longer log in to my computer, except by ...
1
vote
3answers
2k views

I'm a freelancer and my boss fired me without real reason. How can I secure my work? [closed]

Yesterday my boss fired me (I'm still in for one or two days) because of a pretty heated discussion that involved management steps and ideas. We are very far into the beta development stages. I ...
1
vote
3answers
1k views

My company sends honeypot phishing email; should I automatically junk them?

My company sends honeypot phishing emails from within our organization in Microsoft Outlook. e.g. hr@mycompanyname.com , ithelpdesk@mycompanyname.com , etc. I fell to one of these in a lapse of ...
1
vote
2answers
953 views

My manager wants to create an administrator account on my work computer that only he has the password to [closed]

This is on a Windows 10 system, that is provided to me by work. They want to create an administrator account that only my manager will have the password to. The thing is, this isn't from IT and it's ...
1
vote
6answers
1k views

Acceptable for new hire to bring up bad security practices, or “go with the flow”? [duplicate]

I'm a new hire low-level engineer at a large company in the US. When signing up for my benefits/insurance package, I noticed that the password requirements included a 9 character maximum. Needless to ...
1
vote
4answers
721 views

Moving to new technologies when colleagues don't want to [closed]

I work with really old technology which takes ages to create websites. The security is also bad (tons of vulnerabilities such as XSS, CSRF...). How do I change to a better situation? The guy who ...
1
vote
1answer
654 views

37 years old with a psychology bachelors and work history in restaurant management [closed]

I have been wanting to change careers from being in the restaurant/hospitality industry for a few years now, but I did not want to choose a new career path without being absolutely sure that I was ...
1
vote
2answers
411 views

Addressing client's security and controllability concerns

After events described in this question, my team and I decided to start our own company (limited liability). So far we are still going through setup procedures, and we are currently working with ...
1
vote
1answer
362 views

Personal e-mail obtained due to compromised work account (GDPR) [closed]

At my current place of work a phishing e-mail was sent from an employee's e-mail address (Let's call them Sally). An e-mail originating from Sally's account was sent to everyone's work e-mail within ...
1
vote
2answers
500 views

Should I speak to my boss about Security Measures when my Internship is ending?

I'm currently in a 9 month internship in a small/medium sized company. On my first day in this job, I've been assigned to solo develop an application. I did, and the application is currently working ...
1
vote
1answer
376 views

How could I have handled my colleagues unavailability during security incident response better?

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security ...
1
vote
3answers
135 views

Value of intermediate status to certification in cybersecurity profession - Associate ISC^2

In the past year, I successfully passed the CISSP exam administered by ISC^2 . The CISSP certification is highly reputable and the most widely recognized certification amongst IT Security ...
1
vote
1answer
266 views

Can I ask a freelance agency to not send me my own personal info through email?

To be clear, I'm an independent contractor: people come to their website and ask for services, and I reply to the ones I can help with. If they decide to go with me, all payment goes through the ...
1
vote
0answers
74 views

Should I give my SSN to recruiter? [duplicate]

I got call from recruiter and he said I should give him my SSN in order to apply to job. From his email: As part of our disclosures and to present you as a qualified Candidate to [Company Name], ...
0
votes
2answers
194 views

How to communicate with checkbox-tickers about CMS choices [closed]

A web department develops a lot of CMSes using developer-friendly tools and frameworks, mostly using open-source technologies. They are being asked to develop and support a website using Sharepoint ...
0
votes
3answers
500 views

How to get the attention of operations manager as a junior?

The software development company I work for has around 40-50 employees with about 12 of those being developers. I work as a junior developer and have been working for about a year after completing an ...
0
votes
2answers
576 views

Job offer was rescinded due to security clearance?

My husband received a conditional offer for a job that required security clearance. After they investigated him the report has "No Determination Status. Therefore the job offer was rescinded. We are ...
0
votes
2answers
1k views

Voluntary self identification of a disability form - should I discose my RA? [closed]

I have rheumatoid arthritis. Should I fill out the "voluntary self identification of a disability" form? I have worked for this company over 20 years. We do have a functional abilities test that ...