The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
1answer
26 views

Formal functional relationship between risk and CVSS

The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities. What is the functional relationship between a CVSS and the associated ...
3
votes
2answers
47 views

Calculating the time required to brute force a random code

Say we have amount random entry codes of length characters from an alphabet of size alphabet. The number of possible codes is then easily calculated as keyspace = alphabet ^ length. Now take an ...
0
votes
1answer
48 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
3
votes
1answer
337 views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
3
votes
1answer
86 views

Can you securely allow users to create VM's on their workstations

I've moved from a job where developers were encouraged to use technologies like docker and vagrant to create VM's on their workstations for testing and development. At my new job, the IT manager ...
2
votes
1answer
64 views

Historical events in terms of risk assessment

How can historical events be leveraged in terms of a risk assessment. I know you could for instance look at malware infections over the past x months to perform a better estimation of for your malware ...
2
votes
1answer
137 views

Exposure Factor when calculating SLE

I am studying for an exam and came across a question asking to find what the single loss expectance would be, but I am failing to understand exposure factor in the calculation. SLE = Asset Value * ...
0
votes
1answer
43 views

Security risks of allowing customer to use his own domain for a hosted SaaS application

As a SaaS hosting, we are considering allowing customer to use an alternative domain to access his SaaS environment. Default domain owned and hosted by us: customersubdomain.ourdomain.com ...
3
votes
1answer
1k views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
1
vote
1answer
128 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
1
vote
0answers
115 views

Trying to GET “/iptac-xxxx” not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/iptac-[a long long string]/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
1
vote
0answers
43 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
2
votes
1answer
265 views

Formula Used in Qualitative Risk Scales

I am reviewing NIST SP800-30 rev 1 and I am having a hard time understanding how they determine the distribution of values within the risk matrix. In the document, they define semi-qualitative values ...
4
votes
1answer
100 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
1
vote
3answers
108 views

Are dialers obsolete?

My antivirus picked up an infection by Dialer/Coulomb. The definition of a dialer is a piece of malware that dials a number that charges money. How would it do this, is this from when modems were ...
3
votes
2answers
407 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected ...
0
votes
2answers
55 views

Dynamic analysis tools in windows

I'm sorry, i'm newbie in security, i'm looking for a software that detect changes in the whole operating system during its execution, that's helps analysing the behaviour of malicious software to know ...
0
votes
1answer
43 views

Applications of ODEs to Cybersecurity

My university's cybersecurity program allows one to take a course in ordinary differential equations as an elective. The course would be interesting to take, although I don't know how I'd apply it to ...
2
votes
1answer
189 views

Risk analysis Information Security Checklist

I wouldn't bother asking this question if it was easy to find. In the past I've used a risk-analysis-checklist which was split up in serveral factors. For example, there are Human factors, Hardware ...
1
vote
1answer
108 views

How to prepare a report on security weakness in our software [closed]

I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
2
votes
1answer
585 views

how are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
3
votes
4answers
302 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
4
votes
1answer
109 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
3
votes
1answer
781 views

SCADA, ICS Specfic Testing Tools and Methodologies

I have been contracted to perform a security risk assessment that relates specifically to ICS and SCADA systems. I have performed many IT security risk assessments, however, I am new to assessing ...
0
votes
1answer
344 views

What are the Security Risks of Disabling Reverse Path Filtering

Reverse Path Filters are generally used to disable asymmetric routing where an application has a different incoming and outgoing routes. So idea is to prevent packet entering from one interface ...
6
votes
2answers
514 views

Stolen Laptop - Next steps

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple ...
1
vote
2answers
82 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
1
vote
1answer
190 views

Uses of Threat Modeling outside of application development?

Is threat modeling useful outside of application development? Is it a useful tool for doing operational assessments of information systems already in existence? I am confused how threat modeling ...
0
votes
1answer
79 views

Network and Security Associates v.s. CISCO Security Associates [closed]

My college is expanding the Information Technology department to include Networking and Security as well as the CISCO Security. In my research online I have found different information for each ...
0
votes
1answer
126 views

Security risks monitoring JMX

I am doing an internship at a big company wich create industrial automated systems for some big company's. They want me to design a way to monitor all the Java based control modules. Now I am going to ...
2
votes
1answer
4k views

IPS fail close vs IPS fail open, what are the risks and benefits?

If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes: 1- ...
-2
votes
2answers
105 views

Why do home internet users cant communicate with their peers? [closed]

As a home internet users, why does my ISP block my communication with any other client on the same subnet as mine? It is done for security obviously, but what is the risk? Update: as clarified by ...
1
vote
1answer
244 views

What security risks are associated with DLP Systems?

Some high level risks with DLP that I can identify (with the monitoring componant): 1- Abuse of authority: people with access to the system can look into other users private data. 2- Loss of ...
2
votes
3answers
331 views

Can risk mitigation controls bring down the impact?

While doing a Risk Assessment, I found that in some old RA documents, after controls have been placed, the Impact in the forcasted value was changed that did not make sense to me. To me the impact ...
3
votes
4answers
1k views

What are the risks associated with SSL interception in an Organization?

If an SSL interceptor is installed for security reasons in an Organization, and a certificate from intermediate CA is installed on all domain machines, what kind of risks this setup presents?
0
votes
1answer
123 views

What are the risk associated with granting full permission (Any) to DB Admin users to the Database?

Usually in a well controlled environment, Database Admins are granted specific rights like Read, Modify...etc. No one has the right (ANY) to perform on any Database. Certain requirements dictate to ...
0
votes
1answer
152 views

undetectable virtualization apps to spoof web browsers [closed]

monitoring web pages for malicious iframes (root kits) without VM is not safe. when its possible to detect virtualization just by javascript, which software provide undetectable VMs ? QEMU is safe?
2
votes
1answer
454 views

Detecting Virtualization from web browser

is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and ...
5
votes
4answers
9k views

How can I detect backdoors?

I have a machine running Mac OS X and I suspect there may be a backdoor installed. I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
8
votes
3answers
1k views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
6
votes
1answer
1k views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
7
votes
3answers
680 views

Risk Control - Ignored risks and accepted risks

Some say that ignored risks as part of an organization's behavior are much worse than accepted risks. I would like to test that axiom (in the eyes of some). When I am handling a risk and I choose to ...
2
votes
3answers
1k views

Security Assessment vs. Risk Analysis

What the real difference between IT Security Assessment based on ISO 27001 (or in general other international standard) and qualitative risk analysis? In some way the approach is much similar - ...
3
votes
3answers
569 views

How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)

After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
2
votes
2answers
4k views

how to identify p2p on network

Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
4
votes
2answers
3k views

Skype security concerns on an enterprise network

I am trying to write a security opinion that may influence policy in the future in the Enterprise-grade network which I work to protect regarding the use of Skype on the networks, and security risks ...
3
votes
2answers
267 views

How likely is an infection with an outdated skype on linux? [closed]

Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook: deb http://download.skype.com/linux/repos/debian/ stable non-free Doesn't have the new version, ...
1
vote
1answer
170 views

What would be good resources to conduct Technical Impact Analysis?

As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as: https://www.owasp.org/index.php/Top_10_2010-A1 Similarly, CAPEC list impact in ...
0
votes
2answers
187 views

Looking for information about the job from security consultants

I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
5
votes
2answers
2k views

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...