What should a security officer do in a company if his position has just opened and there is no basis for this?

Question

Information Security

I was hired by the firm as an information security specialist . There is no experience in this position, what exactly the employer needs is also unclear (in a nutshell, it was indicated to me: correspondence control, protection against hacker attacks).
I would be very grateful to you if you could suggest a short plan of action on what needs to be done first (to show the boss that I am not useful, and bring real benefits).
I will be glad for any information.

Answer 1

what to do first

Have a beer with the admin.

Answer 2

Classic
1) Set ptraffer
2) A week later you show your boss a "list of requests in Google" (of course, signing the necessary documents with the employees, etc.) and tell who really does what
3) You get a budget, then you make documents of the "concept" level IB", then enter instructions and rules, audit domain security settings, etc.
This is an algorithm if no one in the office has done anything on the topic.

Answer 3

First of all, write regulations, then introduce them, then follow them.

Answer 4

Raise proxy. And let people go only through it. Log all actions of people, transmitted information too. Cut off the ability to work from flash drives, floppy disks, disks, etc. boot stuff.
Sign a non-disclosure agreement with everyone, etc.
PS I'm not a security guard.

Answer 5

The simplest thing is to write an information security policy.
Password rules, password policy (length, complexity).
Try to think about security in such a way that it is as comfortable as possible for users. Because of the piling up, they can score on her.
And yes - be friends with the administrator.

Answer 6

There is a characteristic student handwriting in the question ... Only from the university?
I recommend that you study the job description, the available materiel, and, based on the information received, begin planning and implementing such things as "correspondence control, protection against hacker attacks."

Answer 7

Read 152 FZ.
There is only one documentation to develop for a month of work.

Answer 8

Take STO BR IBBS as an example of a policy (by throwing out ISMS and ISMS at the first stage, and 2/3 of the requirements for ISMS there as well).
Write a document on access, on the Internet, by mail, on antivirus (and, most importantly, approve them from the management).
Communicate the new rules to employees. Start to control performance.