@RoryAlsop I see someone's handled QotW 4? Sorry, am in the middle of deployment for a product and like all deployments, it's a little bit crazy with 11th hour problems/bugs...
@Ninefingers no worries - @Thomas stepped in. Totally understand - all blog posts are from folks volunteering their spare time in between their day jobs:-)
Today we investigate the problem of disposing of hardware storage devices (say, hard disks) which may contain sensitive data. The question which prompted this discussion “Is it enough to only wipe a flash drive once” is about Flash disks (SSD) and received some very good answers; here, we will try to look at the wider picture. [...]
This proposal can't easily be called “security”, since the “IT Security” site is called security.stackexchange.com (security.SE for short).
I have long supported merging all the security proposals; the Security.SE community may now be open to broadening its scope.
they're trying to state that we'd be broadening our scope
which would encompass physical security in ITSec
and that's not true
me not being a mod here, I have no say. But if the ITSec mods comment and affirm my statement to that discussion answer...
Should this site merge with the Security proposal, and other security-related Stack Exchange site proposals such as Cryptography and Social engineering?
In spite of the previous merges, this site still has a narrow declared target audience (it's for “IT security professionals” only!) and a restr...
While I don't think crypto should be merged in (I liked @Thomas's perspective on where we stand relative to crypto) I am all for bringing in Social Eng and some physical aspects where relevant.
The merging of guitars and music has actually worked well - you just list all the tags you don't want to see (eg Oboe) and still get a very usable site, despite there being many many non-guitar questions on there now
@Iszi That is the key - we don't want this to be about door staff etc and those sorts of physical security, but we come into a lot of contact with things that aren't pure IT Security, but that are Information Security
I tend to err more on the side of being inclusive for anything that comes under the wider 'Information Security' banner for three reasons:
The other Area51 proposals covering physical security seem to have gone nowhere and it would be good to have a place for it which is at least in the right s...
A challenge, especially in the maturing world of Information Security, is that segregating IT security from the other disciplines makes it very difficult to manage a central risk register at board level.
While I got late to this beta, and I agree that this forum seems to be reasonably targeted,...
I think we've spent enough time in Public Beta that, if there's going to be a good amount of valid "Info Sec but not IT Sec" questions we should have seen it by now.
@TheEvilPhoenix a lot of the privacy stuff could - but there is an active privacy community which is quite separate from infosec, and it veers a lot over towards the legal side
I just don't want us to start accepting Physical Security and other non-IT-related privacy/security questions, and then have other proposals for those broader realms closed because they appear to be dupes of us.
@Iszi I guess the real scope of records management goes far further than this; but question will be raised if that should be included in our scope or not. The same way as all definitions of physical sec.
If you want to raise a q referencing meta.security.stackexchange.com/q/311/485 asking for lists of what people think should be in or out of scope, we can gain a consensus view from the answers
This has been asked, but this will be a list rather than a question (hence I recommend everyone CW's their responses).
Regarding this: What about Physical Security?
What specific topics and types of questions from Physical Security should we cover?
This was all brought on from this: http://dis...
This has been asked, but this will be a list rather than a question (hence I recommend everyone CW's their responses).
Regarding this: What about Physical Security?
What specific topics and types of questions should we cover? Not just from Physical Security, but in general, as this topic may co...
@JeffFerland That's always the challenge:-) I'm planning now for next year's Defcon, as I'll be leading a PwC team by then it should be a bit easier. (self employed right now, so any time away from paid work is a difficult decision)
For my two cents on the matter, I've never much liked IT Security as the site name anyway and would rather the 'T' be dropped if anything. However, the problem with rescoping now is the fact that we've graduated and are now a full public site.
The scoping and name changes should, probably, have happened during the beta period.
@ScottPack I completely agree. Although expanding to "Information Security" may just be a logical extension of "IT Security", going further than that is much too far to stretch post-graduation.
I started to read through the transcript, got to the part about the Physical Security bit, realized how much more scrolling was involved, and skipped to the end.
@Iszi Right, in my mind the distinction is more about semantics and how others view us. We are, after all, more concerned about the Information. The Technology, in my opinion, just happens to be where it's often stored.
I think if some of those otehr proposals had succeeded, then they obviously would have demonstrated the high enough level of interest, and that would have been fine. As they failed, they are obviously small sub-genres, and I think where relevant we may be able to incorporate them in here without damaging our existing site
I do agree with your assessment on lockpicking being a grey area. It is definitely a valid area of expertise for our field, but so is server management and programming.
@RoryAlsop It is the "vegetative reproduction" theory
The "mother" site spawns new sites out of parts which have grown enough to have a life of their own
The idea would be to have a mother site (security.SE) which encompasses security as a whole, and if some sub-themes emerge with significant traffic, new specific sites are created
hopefully through discussion we are likely to get some areas of security the majority agree can be included, some grey areas (maybe acceptable on a per question basis) and some definite no-nos
If we change the banner name I think we need to keep it somewhat descriptive. I'm not sure changing it beyond "Information Security" would be such a good idea. The name should at least tell something about what's acceptable and what's not, and just leave the FAW to be the authoritative source.
Ah, here we are I think: "The energy lies within ions contained in the sauce's high sodium content. These ions are used in cells to create voltage differences. Because the squid is served fresh, the cells inside are still active and when the sodium is applied, the signals across the nerve cell membranes are temporarily reactivated causing the squid to "dance.""
When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
There seems to be some feeling that all software related questions go to SU, but I tend to think of it as a home or power user site, not necessarily for Application Adminstrators
Does anybody have a book list focusing on security?
Not a topic-specific (like web or servers), but in general: which books do you recomend?
I think it would be good to have a list where anyone could check a recomended bibliography about security.
Hm, I really need to do X but I can't remember the syntax. I could either A) Brute force it, B) Google it, or C) go to my SF profile, and look through my answers until I find it.
Can't believe we've made it out of beta and still don't have an easter egg... RPG had one pretty much since the launch of chat, it seems, and they're still in beta.
I wonder if, since the merge of the chat system, easter eggs carry across all the sites?
When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
Does anybody have a book list focusing on security?
Not a topic-specific (like web or servers), but in general: which books do you recomend?
I think it would be good to have a list where anyone could check a recomended bibliography about security.
