I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting for someone who is setting up their company with an account. What security questions should be used in this instance or are the usual security questions fine.
Note that these kinds of questions are not very secure to begin with. Much of the information asked for can often be found using public resources like Facebook or genealogy data. There are well-documented cases of hacks based on these 'personal security question'. Personally, if forced to give answers to such questions, I just fill them with random data.
Do you really need such a password-restore service that uses these questions, or would it suffice to just have the just personally drop by a support desk (or call in) and have their password reset that way if and when needed?