Ellery Durgin

The purpose of this policy is to establish the minimum requirements for Source Code Review in production applications. General RequirementsAll source code must be reviewed by a minimum of two developers before being deployed on production systems or merged into a production branch within

Web application vulnerabilities account for the largest portion of attack vectors outside of malware. It is crucial that any web application be assessed for vulnerabilities and any vulnerabilities be remediated prior to production deployment. The purpose of this policy is to define web application

Unsecured and vulnerable servers continue to be a major entry point for malicious threat actors. Consistent server installation policies, ownership and configuration management are all about doing the basics well. The purpose of this policy is to establish standards for the base configuration of

Allowing employees to install software on company computing devices opens the organization up to unnecessary exposure. Conflicting file versions or libraries which can prevent programs from running, the introduction of malware from infected installation software, unlicensed software which could be discovered during audit, and

This policy establishes the information security requirements to help manage and safeguard lab resources and CrowdFiber networks by minimizing the exposure of critical infrastructure and information assets to threats that may result from unprotected hosts and unauthorized access. General Requirements Lab owning organizations are

Logging from critical systems, applications and services can provide key information and potential indicators of compromise. Although logging information may not be viewed on a daily basis, it is critical to have from a forensics standpoint. The purpose of this document is to address

Technology equipment often contains parts which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of CrowdFiber data, some of which

Database authentication credentials are a necessary part of authorizing applications to connect to internal databases. However, incorrect use, storage and transmission of such credentials could lead to compromise of very sensitive assets and be a springboard to wider compromise within the organization. This policy

With the mass explosion of smart p[hones and tablets, pervasive wireless connectivity is almost a given at any organization. Insecure wireless configuration can provide an easy open door for malicious threat actors. The purpose of this policy is to secure and protect the

This standard specifies the technical requirements that wireless infrastructure devices must satisfy to connect to a CrowdFiber network. Only those wireless infrastructure devices that meet the requirements specified in this standard or are granted an exception by the InfoSec Team are approved for connectivity

Bluetooth enabled devices are exploding on the Internet at an astonishing rate, and the range of connectivity has increased substantially. Insecure Bluetooth connections can introduce a number of potential serious security issues. Hence, there is a need for a minimum standard for connecting Bluetooth

Encryption Key Management, if not done properly, can lead to compromise and disclosure of private keys used to secure sensitive data and hence, compromise of the data. While users may understand it’s important to encrypt certain documents and electronic communications, they may not

A Security Response Plan (SRP) provides the impetus for security and business teams to integrate their efforts from the perspective of awareness and communication, as well as coordinated response in times of crisis (security vulnerability identified or exploited). Specifically, an SRP defines a product

Passwords are an important aspect of computer security. A poorly chosen password may result in unauthorized access and/or exploitation of our resources. All staff, including contractors and vendors with access to CrowdFiber systems, are responsible for taking the appropriate steps, as outlined below,

Passwords are a critical component of information security. Passwords serve to protect user accounts; however, a poorly constructed password may result in the compromise of individual systems, data, or network. This guideline provides best practices for creating secure passwords. GuidelinesStrong passwords are long -

Since disasters happen so rarely, management often ignores the disaster recovery planning process. It is important to realize that having a contingency plan in the event of a disaster gives CrowdFiber a competitive advantage. This policy requires management to financially support and diligently attend

A clean desk policy can be an import tool to ensure that all sensitive/confidential materials are removed from an end-user workspace and locked away when the items are not in use or an employee leaves his/her workstation. It is one of the

This document describes a required minimal security configuration for all routers and switches connecting to a production network or used in a production capacity at or on behalf of CrowdFiber. Router/Switch SecurityEvery router must meet the following configuration standards: 1.      No local user

Remote desktop software, also known as remote access tools, provide a way for computer users and support staff alike to share screens, access work computer systems from home, and vice versa. Examples of such software include LogMeIn, GoToMyPC, VNC (Virtual Network Computing), and Windows

Remote access to our corporate network is essential to maintain our team’s productivity, but in many cases this remote access originates from networks that may already be compromised or are at a significantly lower security posture than our corporate network. While these remote

CrowdFiber is committed to protecting employees, partners, vendors and the company from illegal or damaging actions by individuals, either knowingly or unknowingly. When CrowdFiber addresses issues proactively and uses correct judgment, it will help set us apart from competitors. CrowdFiber will not tolerate any

Electronic email is pervasively used in almost all industry verticals and is often the primary communication and awareness method within an organization. At the same time, misuse of email can pose many legal, privacy, and security risks; thus it’s important for users to

The purpose of this policy is to provide guidance on when digital signatures are considered accepted means of validating the identity of a signer in CrowdFiber electronic documents and correspondence, and thus a substitute for traditional “wet” signatures, within the organization. Because communication has

The purpose of the policy is to establish the goals and the vision for the breach response process. This policy will clearly define to whom it applies and under what circumstances, and it will include the definition of a breach, staff roles and responsibilities,

Infosec’s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to CrowdFiber’s established culture of openness, trust, and integrity. Infosec is committed to protecting CrowdFiber's employees, partners, and the company from illegal or damaging actions by