I would like to know how the community basically defines the line between the IT Security SE and this one.

4 Answers 4


Sometimes the line can definitely be blurry and as such there will be no hard statements to judge what is on-topic where. What you can do is look at the FAQs and use that to guide what the sites are trying to do. In those cases where something is actually on-topic in both places what I try to determine is what kind of answer is desired. To quote from the Sec.SE FAQ:

IT Security - Stack Exchange is for Information Security professionals to discuss
protecting assets from threats and vulnerabilities. Topics include, but are not 
limited to:

web app hardening
network security
social engineering, including phishing
risk management
penetration testing
security tools
using cryptography
incident response

Questions on setting up your home PC antivirus may be more appropriate over at
superuser.com; and questions on the deeper aspects of cryptography belong on 

Compare that to the first bit of the ServerFault FAQ:

Server Fault is for Information Technology Professionals needing expert answers 
related to managing computer systems in a professional capacity.

If your question is about…

Server and Business Workstation operating systems, hardware, software and virtualization
Enterprise storage, backup, and disaster recovery
Network routing, switches, and firewalls
Operations, maintenance, and monitoring

To me, this shows that while there is an overlap, it's definitely the smaller part of either scope. Generally the overlap involves managing or using tools. As an example consider a question regarding configuring a PGP Universal Server. This is an operational role regarding managing an IT system for an enterprise which makes it on-topic for SF. It is, however, also a system generally defined as a "security tool" making it on-topic on Sec.SE. Definitely a sticky situation that results in a judgement call.

Another good example is related to firewalls. Consider the pedantic difference between "How do I manage, addition/deletions, of rules on a Cisco ASA 5540?" as opposed to "How do I construct a process for managing the collection and management of firewall rules?" The former is without question a SF question, even if a lot of Information Security Analysts would also have the expertise to do it. The second could easily be in-scope for IS as a policy regarding security assets.

My rule of thumb is, in the event of an overlap, ask yourself two questions:

  1. Where is the expertise more likely to reside?
  2. What kind of answer do you want to get?

The short answer is that it's blurry, which basically means you can ask it on either site and it's probably valid.

Generally, if a security question is asked on sf, but gets no love, we will migrate it, so there's nothing to lose.

Questions based around actual cryptography and functions etc are firmly security related.

  • 1
    For cryptography related questions there's crypto.stackexchange.com too... Commented Aug 14, 2012 at 15:04
  • 2
    @Hubert - we have agreed Crypto gets the questions about algorithms, maths, how crypto works and we get the implementation, what crypto you should use in your environment etc.
    – Rory Alsop
    Commented Aug 14, 2012 at 19:26
  • 1
    @RoryAlsop: Not that I don't like the fact, that SE is getting bigger (I love the site's format). But honestly, it's getting confusing... Commented Aug 15, 2012 at 13:18

The best definition you'll probably get is that SF concentrates on real problems people are facing, with known technical solutions, and the answers are essentially steps to enable "proper" functionality. IT Security can discuss real problems as well, but also hypothetical solutions and the reasoning behind them. SF is "harder", while ITSec is "softer" topics.

  • 1
    I don't know... I might call ITSec the "hard science" of the two. Commented Aug 14, 2012 at 17:07
  • 1
    Yeah, this is a crappy explanation overall... IT Security really overlaps heavily with SF, we weren't terribly amused when it was proposed. But we definitely needed a place for theory questions and topics that aren't currently a problem. Making exceptions for certain discussion points on SF didn't make sense, so IT Security it is.
    – Chris S
    Commented Aug 14, 2012 at 17:11
  • 1
    @ChrisS: I suspect the Information Security community tends to believe the overlap does exist, but is fairly small.
    – Scott Pack
    Commented Aug 14, 2012 at 17:21
  • @ScottPack Everyone's entitled to their own wrong opinion. =]
    – Chris S
    Commented Aug 14, 2012 at 17:33
  • 1
    @ChrisS: Which is exactly why I'm not correcting you. :)
    – Scott Pack
    Commented Aug 14, 2012 at 17:57
  • @chrisS, did you mean to say "SF is for the tactical discussion of security, whereas the IT security site is for the strategic discussion of security" ?
    – Sirex
    Commented Aug 15, 2012 at 1:43
  • @Sirex Sure. That's reasonable... Any way you shake it, there's a lot of overlap, but both sites have topics that are their own.
    – Chris S
    Commented Aug 15, 2012 at 2:26

If the security is system administration related it's on topic on both sites but not all security topics are system administration related, such as security issues related to a home network, so would be off topic for SF but still fine for SE, provided always that they fit within their defined parameters.

  • a home network is unlikely to be on topic for Security SE
    – Rory Alsop
    Commented Aug 14, 2012 at 19:17
  • From the faq: IT Security - Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities.
    – Rory Alsop
    Commented Aug 14, 2012 at 19:25
  • It appears I stand corrected on my example. Luckily I did qualify it. Commented Aug 15, 2012 at 6:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .