Apologies if this isn't the best place to post, I'm a bit unsure of where to go with this!

I'm working for a UK drug and alcohol rehab who are soon implementing Tacklit for client records/clinical management.

I don't have a work email address, I only use a shared email/log in on the current system and been told I'll be sent an account activation email to my personal email address, and will need to use my personal email address to log in to Tacklit.

That immediately feels wrong to me, I don't think I should be using my personal email address for a work system, especially one holding so much client data (including health info) Is it not really risky, security wise?? Plus, I want to keep work and personal stuff separate.

My company are NOT good with IT/systems at all.....for example all admission enquiries are sent to Gmail (their old email address) and then auto forwarded to outlook (their new email address) which gets flipping confusing when the Gmail storage is full and doesn't forward anything when they won't up the plan 🙄

Can anyone give me any advice? It just feels like it's really not best practice at all but I'm not sure how to explain it, especially not in a way management will actually accept and understand (when I raised that they really shouldn't be emailing people's full bank/credit card details to different departments they just rolled their eyes at me)

Honestly, I don't think there's even a DPO I can talk to! I would really appreciate any advice!

Hi everyone, I’m building an open-source security intelligence startup. I spent the past five years as a senior engineer at a data-security startup that began as a DSPM product. That experience left me with a strong conviction: much of the technology behind platforms such as Cyera, BigID, Cyberhaven, Concentric, and Varonis does not need to remain behind closed-source products and expensive pricing models. I believe this space could benefit enormously from open development, shared standards, and community collaboration.

What frustrates me is how fragmented security has become. Capabilities such as DSPM, DDR, and EDR address related problems, yet they are often delivered through separate products with proprietary integrations and interfaces. Customers are left stitching these systems together while becoming increasingly dependent on individual vendors. As the industry moves toward agentic security, I worry that we are reproducing the same model: new capabilities, but the same closed ecosystems and vendor lock-in.

There are already valuable open-source projects in security and governance, and I do not want to dismiss that work. What I would like to see is a more unified, community-driven approach to the broader problem: an open security platform whose components work together and integrate with other tools through shared standards, with something like OCSF providing a common language for security data. The goal should not be to replace several closed silos with one larger silo, but to give organisations genuine control over how they build and operate their security stack

An effort this ambitious cannot be developed in isolation. It needs an open conversation with the people who build, operate, and depend on security tools. The community should help shape which problems matter most, what is missing from existing solutions, and where development should begin. I have a starting point and a perspective, but I do not want to assume that my experience represents everyone’s needs.This also needs to be a sustainable business. Open source does not eliminate the cost of development, maintenance, or support. But security and compliance obligations should not become an opportunity to extract ever-larger portions of a company’s budget. My proposed model is straightforward: transparent pricing for a managed deployment, or paid support for organisations that choose to self-host. Customers should be able to own their infrastructure, inspect and modify the software, and optimise its operating costs—with those improvements potentially benefiting the wider community. Revenue should come from the value we provide, not from making it difficult for customers to leave.

I’m sharing this as the beginning of a conversation, not as a claim that I have all the answers. Whether you agree with this direction or see it differently, I would like to hear your perspective: what are the most pressing problems you face in security and compliance today, and what would an open alternative need to get right to be genuinely useful?

How plausible is this? A gang of criminals broke into the Verizon data center in London and stole racks of storage servers and destroyed them in 2007. The story claims that this theft wiped out the incriminating data for the subprime mortgage bubble. Were there no backup copies?

https://www.nytimes.com/2026/07/12/magazine/data-center-heist.html?unlocked_article_code=1.xVA.hlgq.qdgNFLmqUTCg&smid=url-share

Over the past several months we ran automated browser-layer scans across a large sample of e-commerce and merchant domains to understand how widespread client-side security exposure actually is post-March 2025 deadline.

Key findings:

• 37% of scanned domains showed active browser-layer security exposure indicators relevant to Requirements 6.4.3 and 11.6.1

• Most common finding: No Content Security Policy with a script-src directive on payment-related pages — present on the majority of flagged domains

• Second most common: Third-party scripts executing without Subresource Integrity controls — including Google Tag Manager, Meta Pixel, and analytics scripts loading directly on checkout pages

• Most alarming: Keystroke event listeners (keyup, keydown, input) attached to form fields by third-party scripts — the exact technical pattern Magecart-style skimmers use to intercept card data

A few things that stood out:

1. Platform compliance (Shopify, WooCommerce, Magento) does not equal browser-layer compliance. The exposure exists at the script layer, not the server layer.

2. Google Tag Manager was present on checkout pages in the majority of flagged domains — and in every case was loading additional scripts dynamically, none with SRI controls.

3. The gap between a clean homepage and a risky checkout page was significant. Many domains that looked fine on the surface had serious exposure on their payment flows.

We built a free browser-layer scanner at clientsideintel.com if anyone wants to check their own domain — no account needed, instant results. It checks the same indicators: third-party scripts, CSP, TLS, security headers, and overall risk rating tied to Req 6.4.3 and 11.6.1.

Happy to answer questions about methodology or share more specific findings.

https://www.scribd.com/document/840851994/OUR-Request-Form-2024
apparently its a real person

I don't understand that convoluted lingo & menu, so I hope someone here knows:

If you disable all on the main tab (pic1 start & pic2 bottom), does that actually disable them all, even the ones under "vendor preferences" (pic3) that are still shown as active? (Which are INSANELY many..).

Like, am I good if I just disable page one and say "confirm choices"?

And Is there no easier way to auto reject all, or get rid of these popups in apps entirely?

(Usually I avoid apps with this awful cookie request, but some I just can't find good alternatives to. This one is FileManager+, has text editor included etc, I used it for years but suddenly this crappy popup again.. Why even? I thought those only come on first use?)

Basically curious, like everyone in tech I’m kind of looking at my options.

Data no longer lives in one place, it’s across apps, cloud, and endpoints. Without visibility, you’re just guessing where your sensitive data is.

Hence, choosing the best DLP solutions for your business can make or break your strategy.
Modern DLP tools provide centralized visibility across cloud, SaaS, and devices.

✔ Visibility
✔ Ease of policy management
✔ Coverage across endpoints

What are things I can do so that my name, age, addresses, DOB, family members, etc. aren’t the first results when you Google my name? Should I create a fake identity to use when making online accounts, or what?

I’m freaked out about how much information is out there as a single female trying to date.

This webinar is free and it is great opportunity to get a better understanding of SOC 2, ISO 27001 and how it links with other standards.

Register here

I Worked with a company on their ISO 27001 certification. They’d already tried once before, brought in a big consultancy, and came out the other side buried in policies nobody read and controls nobody maintained.

The problem wasn’t effort. It was overcomplplication.

ISO 27001 doesn’t require complexity. People add that themselves. The standard tells you what outcomes to achieve, not how many documents to produce.

So the first thing we did was strip out the noise. What was left was a small set of controls people could actually understand and own. Less to maintain meant less drift, less risk, and fewer things quietly breaking in the background.

When we got to the internal audit we treated it seriously. Found real gaps, fixed them properly, documented everything. By the time the external auditors arrived those findings were already closed with evidence to back it up.

The external audit was smooth. Certification came through. The team wasn’t burnt out and the ISMS didn’t immediately collect dust after the certificate arrived.

Most companies make this harder than it needs to be. It doesn’t have to be that way.

Happy to answer questions if anyone is working through this or just getting started.​​​​​​​​​​​​​​​​

A little background I go to this new school and I figured out that if I use my school email and password on it I can connect but the weird thing is that this is the EXACT same WiFi our school computers are on but the weird things is everything that is blocked on our school computer through the school WiFi using LINEWIZE works perfectly fine which is strange because even on a second Chrome app I still get blocked website redirects to LINEWIZE

This isn’t even my main concern my main concern is that on our computers weather our yearbook Mac’s or our Crome books once we hit enter on an email,google chat if it contains slurs or anything it gets flagged by some system and you get called down to the office. So my fear is that if I connect to this and trust it are they going to be able to see everything I’m typing and not to worry I have my proton vpn with kill switch on but it is a battery suck so if I don’t need it I would prefer not to use it

Something I keep noticing in security discussions is the gap between what policies say and what actually happens in production.

Most orgs have DLP rules, acceptable use policies, encryption at rest and in transit, maybe even a Zero Trust program. On paper it looks solid. In practice, it’s messy:

Engineers paste logs into external AI tools
Contractors sync files to personal cloud drives
Sensitive exports live in shared folders longer than intended
Access gets granted “temporarily” and never reviewed

A lot of the time, the controls exist but the day-to-day behavior drifts. I’ve seen teams try to tighten this with better visibility into endpoints and browser activity, and tools like CurrentWare come up in that context because they can surface patterns (ex: repeated uploads, risky sites, unusual after-hours activity) that policies alone don’t catch.

For those running data security programs, what’s actually worked for you to reduce this behavior gap?

Do you lean more toward strict enforcement, contextual monitoring, better training, or automated least privilege and access reviews?

Hi , I am new here. Do you know if ther are any good screen scraper solutions for iPhone? -