we are starting to do a security sweep of information and how users use company information or access to company information in an effort to see if there are any possible holes in how a company operates. is there a best practices guide, or high level security checklist, that can be used as a reference. any info would be helpful, i guess the basics are obvious but i am looking for out of the box sugggestions for monitoring and protecting. thanks.
locked by HopelessN00b Jan 22 at 18:42
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.
This topic is so broad... you'll need to give us some clue as to what your goals and security requirements actually are. For instance:
In addition, you first need to define your security goals and requirements in order to analyze whether or not your company falls short of those goals and requirements.
How will you know if there are any holes if you haven't defined what those holes are and what they mean to you in the context of your security "mandate"?
An invaluable resource I often use about security is NIST. They have good guides (The Special Publications) that go from hardening servers to policies about non-computer stuff. The checklist repository is also quite good.
It's also important to notice that most leaks aren't really related to technology, they are more related to a disgruntled employee who has legitimate access to the information. As they say "A disgruntled employee can take down a government". Using technology to fix leaks is necessary, but sometimes the problem goes far away from that into the realm of policies and even human resources.
Generally what you need to do is
EDIT: try to get in touch with companies that specialise on DLP, like Websense - their integration services can provide a full scale solution for you to use
protected by Michael Hampton♦ Feb 19 '13 at 15:44
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?