Perhaps more so than for other Q&A sites it seems to me that context often matters a lot, as does the threat model envisioned by the questioner. Is there a good general way to ask for that sort of info near the top of the FAQ? We're getting a lot of very general questions that would require a long essay to cover variations based on low-threat environments vs high-value targets. Perhaps blending it into the the guidance on how we want practical questions to actual problems people are having?
I'm proposing a short addition to the FAW in this answer. I've made it community wiki (assuming I remember to hit the button) - if you want to improve it, please jump in and make edits :). I don't mind if not a single word from my version makes it into the final answer, as long as we agree what we want to say.
What background should I give in my question?
Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, and vice versa. Are you trying to protect something of global value against Advanced Persistent Threats? Or are you looking for a cost-effective approach for a low-profile small business? To get the most helpful answers you should tell us:
- what assets you are trying to protect
- who uses the asset you're trying to protect, and who you think might want to abuse it (and why)
- what steps you've already taken to protect that asset
- what risks you think you still need to mitigate
This is essentially a summary of your threat model, or risk profile, if you've already created one. Providing this information will also help you organize your own thoughts about your security issues.
Further information on the context is often also helpful. Does it involve a web app or desktop; employees or general public; Windows/Linux, Python/Java, Europe/Singapore, etc.
While we're at it, I'm going to propose updating the first line of the FAQ also. Feel free to edit this - it is "community wiki".
IT Security - Stack Exchange is for IT security professionals to discuss protecting assets from threats and vulnerabilities. Topics include web app hardening, network security, phishing, risk management, policies, penetration testing, tools and using cryptography. If you are a home user you may be better served by asking your question at superuser.com.
Sure, this is a good candidate for the type of topic-specific clarification that can go in the top of your /faq.
(this section of your faq is editable by diamond community mods, right now)
@nealmcb - excellent idea. Have you some thoughts on a paragraph or two on this?