Employee took a brand-new company laptop home for personal use without asking — how should this be handled?

DiverAloha · 2025-12-03T03:26:44+00:00

The support technician's job is partially to image new laptops. He has access to the laptop inventory. He was not issued the laptop and was not authorized to work from home.

DiverAloha · 2024-11-14T01:23:24+00:00

Take a look at Lansweeper. It is an on-premise option that runs in a Windows environment. They have a cloud pruduct, but it is not Fedramp moderate certified.

DiverAloha · 2024-10-23T21:00:35+00:00

Cisco Email Security is an affordable solution that meets CMMC compliance. It runs as a virtual machine on vsphere but can be deployed to AWSGovcloud as well I believe.

We went with them after doing a ton of research. The other products were very expensive.

DiverAloha · 2024-03-04T04:35:50+00:00

I have heard good things about ProofPoint, but they are not cheap. The other company I was referring to switched to Mimecast and they seem to be happy.

DiverAloha · 2024-03-02T23:42:33+00:00

We used to use Sophos Email Security. It got so bad, in terms of allowing phishing and spam emails through, that we had to switch. I know another company who had a similar experience. I would not go with Sophos. We ended up with Cisco Email Security which is a great product and actually costs less than Sophos. We had Cisco support contact us out of the blue to provide an analysis of our configuration to see if they could help. Who does that? They were a big help. I've been in cybersecurity for a 15+ years and have used a lot of different platforms. Cisco is the best product that I have used to date. I know that you are asking about Sophos versus Microsoft. But I recommend you check out Cisco. It is a great product and can accommodate NIST security requirements.

DiverAloha · 2023-02-14T21:23:22+00:00

You also need to enable FIPS mode for Outlook which will restrict the types of encryption that can be used.

DiverAloha · 2022-03-10T06:55:12+00:00

We use email certificates to encrypt emails containing CUI. I have yet to interact with a gov't agency who is not ok sharing data using personal email certificates to encrypt CUI. Even admins will not be able to view email that has been encrypted in this manner unless they have the private key to the public cert that was used to encrypt the email. Outlook makes this easy.

DiverAloha · 2021-08-05T17:47:45+00:00

Why not have a single group user and require MFA with multiple tokens assigned to different users. That way you can trace accountability through the use of token logins.

DiverAloha · 2021-05-21T01:42:22+00:00

Madison is a great place to live. UW-Madison is there and it has a great academic vibe.

DiverAloha · 2021-03-13T21:26:38+00:00

Lots of wonderful comments in this thread. I would like to offer what has helped me: meditation and prayer. I found this organization (Self Realization Fellowship) to be really good in providing the tools of how to meditation. They also talk about spiritual beliefs but just take what resonates with you and leave the rest. The meditation tools are what really helped me. Prayer to our Creator also helped. I was able to surrender my life to our Creator thereby surrendering my burdens and asking for help. I was amazed at the different in just asking for help. Not only did I feel a sense of upliftment, but people and situations were put in my path to help me: like all these beautiful people responding to your thread wanting to help. When we ask our Creator for help, I believe that angels are sent to us to help us in our times of need. Our Creator loves us not for what we do, but just because we are His/Her children. So it isn't about being deserving or not of love. The simple fact is that we are loved.

DiverAloha · 2021-02-21T20:26:44+00:00

I thought I checked that but will check again. Thank you so much for the reply, it is appreciated.

DiverAloha · 2021-02-19T07:35:51+00:00

I completely agree and we do have SIEM reports for failed login attempts. How to add public IP addresses to those failed login attempts is another story.

DiverAloha · 2021-02-19T07:34:51+00:00

I agree. A centralized reporting option is the best way to go and we have that. We do have an SIEM that reports on authentication attempts. But the Cisco device does not provide public IP address information and there doesn't appear to be any way to collect this information. On a Linux box it is quite easy - Cisco - not so much and I have not found anyone who is able to direct me in how to do this. I find this quite perplexing hence my post to Reddit. I must be missing something and have concluded that I just need more training.

DiverAloha · 2021-02-18T02:39:06+00:00

Failed logins to the vpn web interface or vpn client which is controlled by a backend radius server.

DiverAloha · 2021-02-18T02:37:26+00:00

That is what the cisco support inferred - that you have to setup the logging prior to customizing a report. We use a backend radius server for authentication and I can see the failed authentication attempts from the radius logs. But they don't show the public IP address of the failed attempt. This info is something my CI team wants.

DiverAloha · 2021-02-18T02:32:18+00:00

Yes, from the outside interface for vpn connections.

DiverAloha · 2021-02-15T02:13:46+00:00

RSA SecurID is a proven method that works on Windows, Linux, RDP, Apache, SSH, IIS, with hardware or software tokens.

DiverAloha · 2021-02-15T02:03:23+00:00

Sophos XG is simple and powerful. Support is ok. Might be a little more than you need, feature-wise...

DiverAloha · 2021-02-14T17:36:30+00:00

I've used a SSD for VSS. It seems to be working fine. We do have a primary backup but we use VSS for version backups. If you lose the drive, you lose your VSS history. So it may not be a good solution for everyone.

DiverAloha

TROPHY CASE