1
vote
2answers
60 views

FTP Multi User Environment doesn't allow multiple logins

I think ths is a general question but I'm not sure if it needs to be migrated because of the technical and security related nature of the beast in question. For my current client we have an SFTP key ...
0
votes
1answer
233 views

Remove “Act as part of the operating system” policy

On one of our servers we have enabled the "Act as part of the operating system" policy in the Local Security Policy. (Security Settings > Local Policies > User Rights Assignment). Now we would like ...
9
votes
3answers
329 views

“Template” for handing out user & passwords for employees

Within this relatively small company I work for, I have been handing out usernames and passwords written very simply in a word document. I wish for this process to be more professional now that we ...
25
votes
9answers
2k views

What should I do about a “misbehaving” user?

What should I do about this user? The user is: Downloading pornography Attempting unauthorized access Running hacking software Sending unsolicited email Installing software / tampering with the ...
1
vote
1answer
237 views

Why warn users weeks before their passwords expire? [closed]

At my workplace (and I am told many others), several password-requiring systems warn users every day during the two week period before their passwords expire. The warning consists of a dialog box that ...
1
vote
3answers
464 views

Disabling USB/removable devices in software

How can I truly disable USB/removable drive support purely with software? On Windows for example I know I could disable the relevant hardware in device manager, and users would not be able to ...
34
votes
12answers
8k views

What do you do about staff and personal laptops?

Today, one of our developers had his laptop stolen from his house. Apparently, he had a full svn checkout of the company's source code, as well as a full copy of the SQL database. This is one ...
0
votes
2answers
114 views

How do I configure privileges for a Standard user account?

How do I limit the features of a Standard user account, without affecting the Admin account?
8
votes
3answers
518 views

What are some best practices when taking over IT at a new company?

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
4
votes
1answer
153 views

Remembering Passwords

I stumbled across this question earlier and it got me thinking. Everyone's encountered systems that require you change your password every x days and not reuse any of your last y passwords. This ...
1
vote
3answers
845 views

signed applet automatically running as insecure

My application is deployed as a self-signed applet to several thousand users at more than 50 schools across the country (in Norway). The user is presented with the standard Java security warning ...
3
votes
4answers
853 views

Web Site Anti-Defacement

what are the best practices, policies, tools/utilities for monitoring & barring website defacement
1
vote
4answers
865 views

How to apply a policy at the ou level on Windows 2003

OK, so I am going to level, I am a software engineer trying to do the work of a System Admin. I asked a question about overriding password policies and got an answer that sounded right, but that I ...
2
votes
1answer
2k views

How to Disable the Password Policy for Local Users on Windows 2003

I have one Windows Server 2003 VM that I need to disable the Password Complexity policy for Local users on. I still want the Active Directory users to use the domain Password Complexity Policy. Is ...
23
votes
9answers
2k views

A partner wants a copy of our written IT security policy and I'm not sure what to do

My company is working with another company and as part of the contract they are requesting a copy of my company's written IT Security Policy. I don't have a written IT security policy, and I'm not ...
10
votes
17answers
1k views

What are the arguments for and against a network policy where the sys admin knows users passwords?

I'd like to know pros and cons.. reasons for and against the idea of sys admin’s maintaining user account lists with passwords.. and additionally not allowing those users to change their passwords. I ...
3
votes
3answers
1k views

Tripwire policy suggestions

I've setup tripwire on a debian server, and default policy had some strange settings. # # Critical devices # ( rulename = "Devices & Kernel information", severity = $(SIG_HI), ) { /dev ...
17
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...