Please define the line between IT Security and topics for this site

Question

I would like to know how the community basically defines the line between the IT Security SE and this one.

Answer 1

Sometimes the line can definitely be blurry and as such there will be no hard statements to judge what is on-topic where. What you can do is look at the FAQs and use that to guide what the sites are trying to do. In those cases where something is actually on-topic in both places what I try to determine is what kind of answer is desired. To quote from the Sec.SE FAQ:

IT Security - Stack Exchange is for Information Security professionals to discuss
protecting assets from threats and vulnerabilities. Topics include, but are not 
limited to:

web app hardening
network security
social engineering, including phishing
risk management
policies
penetration testing
security tools
using cryptography
incident response

Questions on setting up your home PC antivirus may be more appropriate over at
superuser.com; and questions on the deeper aspects of cryptography belong on 
crypto.SE.

Compare that to the first bit of the ServerFault FAQ:

Server Fault is for Information Technology Professionals needing expert answers 
related to managing computer systems in a professional capacity.

If your question is about…

Server and Business Workstation operating systems, hardware, software and virtualization
Enterprise storage, backup, and disaster recovery
Network routing, switches, and firewalls
Operations, maintenance, and monitoring

To me, this shows that while there is an overlap, it's definitely the smaller part of either scope. Generally the overlap involves managing or using tools. As an example consider a question regarding configuring a PGP Universal Server. This is an operational role regarding managing an IT system for an enterprise which makes it on-topic for SF. It is, however, also a system generally defined as a "security tool" making it on-topic on Sec.SE. Definitely a sticky situation that results in a judgement call.

Another good example is related to firewalls. Consider the pedantic difference between "How do I manage, addition/deletions, of rules on a Cisco ASA 5540?" as opposed to "How do I construct a process for managing the collection and management of firewall rules?" The former is without question a SF question, even if a lot of Information Security Analysts would also have the expertise to do it. The second could easily be in-scope for IS as a policy regarding security assets.

My rule of thumb is, in the event of an overlap, ask yourself two questions:

1. Where is the expertise more likely to reside?
2. What kind of answer do you want to get?

Answer 2

The short answer is that it's blurry, which basically means you can ask it on either site and it's probably valid.

Generally, if a security question is asked on sf, but gets no love, we will migrate it, so there's nothing to lose.

Questions based around actual cryptography and functions etc are firmly security related.

Answer 3

The best definition you'll probably get is that SF concentrates on real problems people are facing, with known technical solutions, and the answers are essentially steps to enable "proper" functionality. IT Security can discuss real problems as well, but also hypothetical solutions and the reasoning behind them. SF is "harder", while ITSec is "softer" topics.

Answer 4

If the security is system administration related it's on topic on both sites but not all security topics are system administration related, such as security issues related to a home network, so would be off topic for SF but still fine for SE, provided always that they fit within their defined parameters.