The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
0answers
65 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
0
votes
1answer
44 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
11
votes
4answers
2k views

Are short usernames a security concern?

I was somewhat suprised that the sysadmin approved a one-letter username like "m" and my username is also short ("nik"). I think that if usernames are brute force attacked then the username should ...
1
vote
2answers
114 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
16
votes
3answers
3k views

How to convince my management of a physical security risk?

While I do not claim to be an expert in all things security based, I'd think that I have a good grounded knowledge of what is acceptable and what is not in regards to digital security. After giving ...
0
votes
1answer
208 views

Relationship between CVSS and Risk Level in Nessus output data

In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have? Thank yo
1
vote
4answers
227 views

If malware was detected in browser local storage does computer need to be nuked from orbit

I haven't used Windows partition since mid-June and I booted the system once again just a few days ago. My first action was as usual update all programs marked to be updated (including Windows ...
1
vote
1answer
188 views

I left my debit card unattended — how exposed am I?

I yesterday visited a restaurant I usually visit, but it seems that after paying with my debit card, I accidentally left it there. Today (almost 24 hours later) I had realized that I didn't have it ...
1
vote
3answers
126 views

Is forwarding a port(s) a security risk to all computers on the network or just one?

I know forwarding ports can add some security risk, but if I forward a port to a computer, say running linux, would it add a security risk to all computers on my network or just the one?
-4
votes
1answer
149 views

Is it possible to hack my encrypted session and hijack the session by electromagnetic waves? [closed]

I'm concerned about microwave technologies nowadays and suspicious matter happend. So, I have several questions. Could you tell me about my question in below if you know. Question: Is it possible ...
2
votes
3answers
321 views

Can risk mitigation controls bring down the impact?

While doing a Risk Assessment, I found that in some old RA documents, after controls have been placed, the Impact in the forcasted value was changed that did not make sense to me. To me the impact ...
-6
votes
3answers
108 views

Download a data file, add it to the database only when certain it's clean [closed]

You need to download an essential data file but the act of downloading carries with it the risk of contamination from say, an embedded keylogger, or worse, that can ruin your day(s) if it takes up ...
0
votes
4answers
169 views

Control over IT security

In pharmacy the safety of drugs is under fairly tight control by national authorities, e.g. FDA in US. The risks of patients taking drugs are thus very effectively minimized, though understandably ...
0
votes
1answer
129 views

Risks of software backdoors [closed]

Risks of backdoors in software are evident ever since Ken Thompson's Turing Award Lecture "Reflections on Trusting Trust". Certainly this applies to hardware just as well. Limiting ourselves here to ...
7
votes
3answers
483 views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
4
votes
3answers
154 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
0
votes
1answer
112 views

WLFriends encrypted login risk

I recently had created on WLFriends.org which is presented by Wikileaks, I noticed a big thing there that the process of signing up at WLFriends was very distinct from the other normal sites. There, ...
4
votes
1answer
325 views

How big is the risk of hash fixed points/cycles?

It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
13
votes
5answers
3k views

When registering for most websites, why do you need to confirm your email address?

I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
13
votes
5answers
688 views

Looking for Information security / risk management table top or card games

I am looking for table top or card games related to risk management or information security. A kind of "serious" game that can be used as a teaching tool of infosec/risk management. I know only about ...
4
votes
4answers
453 views

Security of Cloud Storage

What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
5
votes
2answers
2k views

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
13
votes
5answers
563 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...