The probability of loss inherent in an organization's operations and environment (such as competition and adverse economic conditions) that may impair its ability to provide returns on investment. Business risk plus the financial risk arising from use of debt (borrowed capital and/or trade credit) ...
2
votes
6answers
112 views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
3
votes
1answer
61 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
3
votes
4answers
124 views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
3
votes
3answers
146 views
Where can I find a collection of Threat Models?
I found a very nice SSL Threat model on this web page and would like to find more on different topics.
How would I go about locating more images like these? Is there an organisation or website I ...
51
votes
15answers
2k views
How to write an email regarding IT Security that will be read, and not ignored by the end user?
I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.
The problem seems to be among people ...
19
votes
3answers
1k views
Help me find a lightweight threat modeling framework
We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there ...
19
votes
15answers
2k views
Is there a strong challenge to be made against the startup executive that believes security must be delayed?
A common statement start-up executives make regarding security is that they are in a race to market and if they consciously choose to build in security from the get-go it may slow them down so much as ...
15
votes
4answers
487 views
How would you reason with and work with the security paranoiac on your team?
The question of how to balance pragmatism with an absolutist view of security has been discussed here already. But I need the answer to a concrete variant of that question.
You're the security expert ...
7
votes
2answers
155 views
How do you compare risks from your websites, physical perimeter, staff etc
In assigning budget rationally - ie proportionally to the risk in a particular area, how can you calculate the relative risks?
I can think of examples where clients of mine have secured their ...
12
votes
4answers
426 views
How do you manage security-related OCD (i.e. paranoia)?
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though.
As society has crossed into ...
6
votes
3answers
226 views
Can you provide loss values on security breaches?
When someone says "why do we need to spend so much money and effort on security, we need to focus on market share first and once someone finds a problem we will fix it", I would like to have a list ...
6
votes
4answers
319 views
What is your process for wiping a lost Blackberry or similar device?
For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
8
votes
4answers
363 views
What is an appropriate auditing standard for a law firm?
I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
6
votes
2answers
158 views
dealing with small businesses and security issues
I am dealing with a small business that I have no choice right now but to deal with. I do not work for this business but my personal life dictates that I use them right now. I noticed a few months ago ...
12
votes
9answers
461 views
What do you see as the emerging threats for 2011
As we move in to the new year, what do you see as the emerging threats for organisational security?
I see more chat around;
Advanced Persistent Threat (APT) from foreign states.
More fines from the ...
6
votes
3answers
998 views
How much does a security audit cost?
For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC and I would probably use a North American company for testing. I really ...
6
votes
2answers
202 views
What key metrics should a CIO rely on to gauge the extent of IT risk exposure?
Note - This was originally asked in another Area51 proposal, which has since been deleted.
6
votes
3answers
184 views
What risk analysis methodologies should I use?
I've heard of FAIR, and that seems pretty great.
What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?
...
8
votes
6answers
434 views
What are a few good lists of threats to use to kick-off conversations with others about what worries them?
To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
