The probability of loss inherent in an organization's operations and environment (such as competition and adverse economic conditions) that may impair its ability to provide returns on investment. Business risk plus the financial risk arising from use of debt (borrowed capital and/or trade credit) ...
18
votes
4answers
713 views
How do you manage security-related OCD (i.e. paranoia)?
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though.
As society has crossed into ...
10
votes
6answers
640 views
What are a few good lists of threats to use to kick-off conversations with others about what worries them?
To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
10
votes
3answers
261 views
What risk analysis methodologies should I use?
I've heard of FAIR, and that seems pretty great.
What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?
...
5
votes
3answers
184 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
56
votes
15answers
3k views
How to write an email regarding IT Security that will be read, and not ignored by the end user?
I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.
The problem seems to be among people ...
7
votes
2answers
186 views
How do you compare risks from your websites, physical perimeter, staff etc
In assigning budget rationally - ie proportionally to the risk in a particular area, how can you calculate the relative risks?
I can think of examples where clients of mine have secured their ...
6
votes
3answers
2k views
How much does a security audit cost?
For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC and I would probably use a North American company for testing. I really ...
3
votes
1answer
76 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
2
votes
6answers
183 views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
8
votes
4answers
600 views
What is an appropriate auditing standard for a law firm?
I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
6
votes
4answers
517 views
What is your process for wiping a lost Blackberry or similar device?
For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
3
votes
4answers
186 views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
