9

This has been asked, but this will be a list rather than a question (hence I recommend everyone CW's their responses).

Regarding this: What about Physical Security?

What specific topics and types of questions should we cover? Not just from Physical Security, but in general, as this topic may come up again under Social Engineering, Digital Curation, IT Disaster Recovery, Resilience, Backup Planning etc etc?

This was all brought on from this: https://area51.meta.stackexchange.com/questions/2370/rename-security-physical-security/2374#2374

  • 1
    And when you comment on this, please do not talk about site scope expansion without examples... provide examples of on topic items which any expansion of the scope should cover. – Thomas Ward Aug 3 '11 at 15:21
11

The CISSP CBK includes the following:

  • Access Control
  • Application Development Security
  • Business Continuity and Disaster Recovery Planning
  • Cryptography
  • Information Security Governance and Risk Management
  • Legal, Regulations, Investigations and Compliance
  • Operations Security
  • Physical (Environmental) Security
  • Security Architecture and Design
  • Telecommunications and Network Security

Now there are aspects of each of those that are out of scope (eg we aren't planning on giving legal advice, but questions about regulations seem to fit) but as a broad overview we do expect an IT security professional to have a reasonable grasp of these disciplines as the CISSP is a de facto global cert in security.

My specific thoughts:

On topic

  • Social Engineering
  • Vetting
  • IT Disaster Recovery
  • Disaster Planning
  • Data Centre security
  • CCTV
  • Electronic locks
  • Biometrics
  • Lock Picking
  • Intelligence
  • The implementation aspects of crypto, and the application of the correct algorithm for the job
  • spoofing geolocation etc

Off topic

  • Personal Protection
  • Nightclub door staff
  • The mathematics of crypto
  • flood/earthquake/volcano defences - despite sort of coming under physical environmental security

I reserve the right to add more:-)

  • +1 - in 100% agreement with the above. – Thomas Ward Aug 3 '11 at 15:20
  • And regarding Crypto... i think that having Crypto.SE (in private beta now) as the mathematics behind it, and having implementation here, is a good idea. – Thomas Ward Aug 3 '11 at 15:25
  • 2
    Agree with most, though lockpicking still feels incongruous - even though our local defcon group (DC9723) had a great talk on that a few months back... I would add to offtopic things like national security, "door staff" for other organizations, and the like. I'm on the fence wrt airport security... – AviD Aug 3 '11 at 18:33
  • Crypto.SE is actually now in public beta – Rory Alsop Aug 3 '11 at 20:47
  • @RoryAlsop wasnt when I checked, but okay. :) – Thomas Ward Aug 4 '11 at 12:55
4

This proposition has reach is critical mass with regard to the "IT Security" scope. All the site is now branded over this specific topic, design as well as some other support (I don't know if they already planned T-Shirt, business-cards, etc). This makes me worry on two things about the scope broadening.

  1. We shall change our identity, from "IT Security" to "Security"

    • Does this mean we shall drop all the work done? Design, communications, ...
    • What does change of identity means for us right now? I mean we had one year of beta and we did not include physical security. Why now? Does it mean we did not work our scope well enough? That may impact the image of the site badly. Take care!
  2. How will the community react to it.

    • People here may not be ready to support an expanded scope such as what @Gilles is porposing. We do not want question to be left unanswered because of lack of expertise. Unfortunately I understand that beta(s) on physical security already failed. That is also a major issue in scope broadening with regard to the current statement.
    • Would this scare existing users? We can't possibly begin to push "beta-like" question right in the question list of [security.se]. We need to separate the "beta" process, from the already launched site.

With this in mind, it triggers an idea. But it may be a bit early to do that because we have to take care of ourselves in this first year of independence. Though, would it be possible to babysit a proposition within our garden? I mean some thing that would be like a three way StackExchange site: InfoSec / Sec / Meta. It may require a bit of work from devs I guess, but we may enrich the Area51 staging place with a new system. This would be a way to push smaller proposition, that did not fit [all] the beta critters, into existing sites, with merging objective. In this context, requirements for visit/day, high-rep user ratio or question per-day ratio can be ignored or reduced, because of the mother-site influence. Reputation would be shared across mother-site and baby-site, giving it the power of the community management from ITSec and reward new-comers with reputation for ITSec when participating in the baby-site.

At the end, if the experience is successful enough, merging - rescoping - renaming etc would be possible. In case of failure, people from the baby site would just be part of the main site, and the proposition dropped.

  • 1
    I'm not sure whether the "beta-within-a-graduated-site" idea is so good, but I agree completely with points 1 and 2 as well as their bullets. – Iszi Aug 4 '11 at 20:17
4

The site already covers the topics you ask about since they are all related to IT security. In particular it covers many aspects of physical security. Covering physical security is critical to IT security - how do you protect servers, laptops, disks, remote backups, transit etc without physical control over them? How do you get physical control without good knowledge of locks, id procedures, etc? And has been discussed before, all this holds together because the same "cat-and-mouse" mindset is critical to these various security questions.

During the IT Security beta period, we had meta discussion of What about Physical Security? - IT Security Meta - Stack Exchange, and the high-voted, selected answer was to be inclusive. Physical questions were happily asked, tagged and answered during beta.

The aspects which this site presumably doesn't cover (e.g. political rants about the TSA, personal questions about martial arts training and weapons, etc.) are generally not covered because of our focus on being professional and rooted in IT matters, not because we don't do physical security.

1

Information Technology Security is the documenting of requirements, design, implementation, integration, test, certification, deployment, accreditation, operation, maintenance, repair, and retirement of the security for an Information Technology system.

Information Technology is technology intended to make collection, acquisition, transmission, transformation, presentation, organization, display, storage, retrieval, reception, etc of information easier, faster, and less expensive (or resource intensive).

Availability of Information

Methods and techniques exist to make information available or unavailable. These techniques modify how information is stored, retrieved, displayed, and transmitted. Positive availability of information is the ability to provide access to the information even when there are errors, noise, reduced functionality, low available bandwidth, degraded capacity, and reduced resources. Negative availability of information is the ability to prevent unauthorized subjects from gaining access to information even when exposed and under threat.

Integrity of Information

Methods and techniques exist to check the integrity of information. These techniques augment the information with data describing the information at a given point in time. There are algorithms which create the integrity data and check the current state of the information against the integrity data.

0

This is not a list item, by design, because I think the site definition should be inclusive rather than defined by a list.

I think this site should expand to cover all questions germane to security professionals. This includes IT systems, software applications, building , locksmithing, accounting procedures, and any similar topic, as long as the question is intrinsically about security. “Professionals” means that this is a place primarily intended for people whose job is about security; nothing prevents amateurs from posting, but the onus is on them to rise to the professionals' level.

In other words, I am pushing to change the first sentence in the FAQ to

Security - Stack Exchange is for security professionals to discuss protecting assets from threats and vulnerabilities.

Or, to put it in a different way: if it's good enough for Bruce Schneier, it's good enough for Security Stack Exchange. (I'm willing to compromise on squids.)


There have been precedents, of broadening the scope of a Stack Exchange site during the beta period. Science fiction broadened to Science fiction and Fantasy after about a month in beta, with general agreement (more details upon request). Audio Recording and Production broadened to Audio-Video Production (I don't know the details). Changing now, after launch, is a bit late, but not impossible. I'm not concerned so much with the existing IT security community, but with physical security and other communities who might have a difficult start on an existing site. This is a surmountable difficulty, in my mind a much lesser evil than not having direct contact between IT security and other security fields.

  • On the chat, in the DMZ, we discussed expanding into InfoSec rather than just be ITSec... but the issue with this was what specifically we would cover, hence the question of specific items that would be covered in that umbrella. So before we talk about expansion... let's discuss what we can or can't cover first in ITSec. – Thomas Ward Aug 3 '11 at 14:52
  • As a member of the AVP and the Music Practice and Performance sites, I can testify to the fact that it does work well - if there are areas you really aren't interested in you pop them in your 'ignored' tags. That said, however, I think some areas will still be very offtopic, so I'll pop an answer below with my thoughts. – Rory Alsop Aug 3 '11 at 15:03
  • 4
    I disagree with the inclusion of locksmithing, accounting, etc. This site began as "Application Security" and was expanded to "IT Security". Moving to "Information Security" seems a logical-ish step, but beyond that feels just a bit too far. – Iszi Aug 3 '11 at 15:06
  • As a quick datum point, I visit the gaming SE site, but I have no interest in the vast majority of games on there. My solution - 41 tags ignored. So I never see them :-) – Rory Alsop Dec 20 '11 at 13:27
  • @RoryAlsop I visit Stack Overflow. – Gilles Dec 20 '11 at 15:18
  • @Gilles - I only use SO via favourite tags, as there is too much off-topic for me:-) – Rory Alsop Dec 20 '11 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .