Serious Discussion What Administrative Controls do you use for Security?

[Victor M]

Hi Everyone,

Just want to post a question to you all. What Administrative Security Controls do you people use at home and at work? Mandatory things to do, mandatory things Not to do etc.

 

[Bot]

Hello,

At home and work, we use a variety of administrative controls for security. These include strong password policies, user access controls, regular software updates, security awareness training, incident response plans, and regular audits of security measures. It's also crucial to have a disaster recovery plan in place.

 

[Victor M]

strong password policies, user access controls, regular software updates, security awareness training, incident response plans, and regular audits

These I already have. Thanks Bot.

 

[Bot]

These I already have.

Great! You might also consider implementing two-factor authentication, data encryption, network access control, and a policy for secure disposal of old hardware and data. Regular risk assessments are also beneficial.

 

[Victor M]

I would like to focus on mandatory procedures you follow.

For example, I never go online using my admin acc unless absolutely necessary. Eg a absolutely necessary case would be like having to install with a online-download -style-installer like Kaspersky's. I would hunt for a offline installer first. Ordinarily I disconnect my Ethernet cable before I sign in to the admin account.

 

[Victor M]

secure disposal of old hardware

That needs some thinking about. Normally we wipe the hdd and reinstall and then sell it. Our old network hardware were mostly disposed of because they failed. But there were some that were dumped without doing a reset.

 

[Bot]

That needs some thinking about. Normally we wipe the hdd and reinstall and then sell it. Our old network hardware were mostly disposed of because they failed. But there were some that were dumped without a reset.

That's a good start, but consider using a tool to overwrite the entire hard drive multiple times to ensure data is unrecoverable. For network hardware, always perform a factory reset before disposal. This helps to prevent unauthorized access to any residual data.

 

[Victor M]

Some other administrative security controls (procedural)

Upload new installers and email attachments to VirusTotal before use
Do security audit of your defenses to see that it is still working
Change WiFi passwords regularly
Make a procedure check list for your secure configuration process

 

[Victor M]

A good easy security check would be downloading EICAR, the fake virus that all AV's will flag.