Regarding Our Scope: What's Acceptable, What's Not

Question

This has been asked, but this will be a list rather than a question (hence I recommend everyone CW's their responses).

Regarding this: What about Physical Security?

What specific topics and types of questions should we cover? Not just from Physical Security, but in general, as this topic may come up again under Social Engineering, Digital Curation, IT Disaster Recovery, Resilience, Backup Planning etc etc?

This was all brought on from this: https://area51.meta.stackexchange.com/questions/2370/rename-security-physical-security/2374#2374

Answer 1

The CISSP CBK includes the following:

• Access Control
• Application Development Security
• Business Continuity and Disaster Recovery Planning
• Cryptography
• Information Security Governance and Risk Management
• Legal, Regulations, Investigations and Compliance
• Operations Security
• Physical (Environmental) Security
• Security Architecture and Design
• Telecommunications and Network Security

Now there are aspects of each of those that are out of scope (eg we aren't planning on giving legal advice, but questions about regulations seem to fit) but as a broad overview we do expect an IT security professional to have a reasonable grasp of these disciplines as the CISSP is a de facto global cert in security.

My specific thoughts:

On topic

• Social Engineering
• Vetting
• IT Disaster Recovery
• Disaster Planning
• Data Centre security
• CCTV
• Electronic locks
• Biometrics
• Lock Picking
• Intelligence
• The implementation aspects of crypto, and the application of the correct algorithm for the job
• spoofing geolocation etc

Off topic

• Personal Protection
• Nightclub door staff
• The mathematics of crypto
• flood/earthquake/volcano defences - despite sort of coming under physical environmental security

I reserve the right to add more:-)

Answer 2

This proposition has reach is critical mass with regard to the "IT Security" scope. All the site is now branded over this specific topic, design as well as some other support (I don't know if they already planned T-Shirt, business-cards, etc). This makes me worry on two things about the scope broadening.

1. We shall change our identity, from "IT Security" to "Security"

   • Does this mean we shall drop all the work done? Design, communications, ...
   • What does change of identity means for us right now? I mean we had one year of beta and we did not include physical security. Why now? Does it mean we did not work our scope well enough? That may impact the image of the site badly. Take care!

2. How will the community react to it.

   • People here may not be ready to support an expanded scope such as what @Gilles is porposing. We do not want question to be left unanswered because of lack of expertise. Unfortunately I understand that beta(s) on physical security already failed. That is also a major issue in scope broadening with regard to the current statement.
   • Would this scare existing users? We can't possibly begin to push "beta-like" question right in the question list of [security.se]. We need to separate the "beta" process, from the already launched site.

With this in mind, it triggers an idea. But it may be a bit early to do that because we have to take care of ourselves in this first year of independence. Though, would it be possible to babysit a proposition within our garden? I mean some thing that would be like a three way StackExchange site: InfoSec / Sec / Meta. It may require a bit of work from devs I guess, but we may enrich the Area51 staging place with a new system. This would be a way to push smaller proposition, that did not fit [all] the beta critters, into existing sites, with merging objective. In this context, requirements for visit/day, high-rep user ratio or question per-day ratio can be ignored or reduced, because of the mother-site influence. Reputation would be shared across mother-site and baby-site, giving it the power of the community management from ITSec and reward new-comers with reputation for ITSec when participating in the baby-site.

At the end, if the experience is successful enough, merging - rescoping - renaming etc would be possible. In case of failure, people from the baby site would just be part of the main site, and the proposition dropped.

Answer 3

The site already covers the topics you ask about since they are all related to IT security. In particular it covers many aspects of physical security. Covering physical security is critical to IT security - how do you protect servers, laptops, disks, remote backups, transit etc without physical control over them? How do you get physical control without good knowledge of locks, id procedures, etc? And has been discussed before, all this holds together because the same "cat-and-mouse" mindset is critical to these various security questions.

During the IT Security beta period, we had meta discussion of What about Physical Security? - IT Security Meta - Stack Exchange, and the high-voted, selected answer was to be inclusive. Physical questions were happily asked, tagged and answered during beta.

The aspects which this site presumably doesn't cover (e.g. political rants about the TSA, personal questions about martial arts training and weapons, etc.) are generally not covered because of our focus on being professional and rooted in IT matters, not because we don't do physical security.

Answer 4

Information Technology Security is the documenting of requirements, design, implementation, integration, test, certification, deployment, accreditation, operation, maintenance, repair, and retirement of the security for an Information Technology system.

Information Technology is technology intended to make collection, acquisition, transmission, transformation, presentation, organization, display, storage, retrieval, reception, etc of information easier, faster, and less expensive (or resource intensive).

Availability of Information

Methods and techniques exist to make information available or unavailable. These techniques modify how information is stored, retrieved, displayed, and transmitted. Positive availability of information is the ability to provide access to the information even when there are errors, noise, reduced functionality, low available bandwidth, degraded capacity, and reduced resources. Negative availability of information is the ability to prevent unauthorized subjects from gaining access to information even when exposed and under threat.

Integrity of Information

Methods and techniques exist to check the integrity of information. These techniques augment the information with data describing the information at a given point in time. There are algorithms which create the integrity data and check the current state of the information against the integrity data.

Answer 5

_{This is not a list item, by design, because I think the site definition should be inclusive rather than defined by a list.}

I think this site should expand to cover all questions germane to security professionals. This includes IT systems, software applications, building , locksmithing, accounting procedures, and any similar topic, as long as the question is intrinsically about security. “Professionals” means that this is a place primarily intended for people whose job is about security; nothing prevents amateurs from posting, but the onus is on them to rise to the professionals' level.

In other words, I am pushing to change the first sentence in the FAQ to

Security - Stack Exchange is for security professionals to discuss protecting assets from threats and vulnerabilities.

Or, to put it in a different way: if it's good enough for Bruce Schneier, it's good enough for Security Stack Exchange. (I'm willing to compromise on squids.)

---

There have been precedents, of broadening the scope of a Stack Exchange site during the beta period. Science fiction broadened to Science fiction and Fantasy after about a month in beta, with general agreement (more details upon request). Audio Recording and Production broadened to Audio-Video Production (I don't know the details). Changing now, after launch, is a bit late, but not impossible. I'm not concerned so much with the existing IT security community, but with physical security and other communities who might have a difficult start on an existing site. This is a surmountable difficulty, in my mind a much lesser evil than not having direct contact between IT security and other security fields.