The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
21 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
2
votes
1answer
45 views

Formula Used in Qualitative Risk Scales

I am reviewing NIST SP800-30 rev 1 and I am having a hard time understanding how they determine the distribution of values within the risk matrix. In the document, they define semi-qualitative values ...
4
votes
1answer
53 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
1
vote
3answers
79 views

Are dialers obsolete?

My antivirus picked up an infection by Dialer/Coulomb. The definition of a dialer is a piece of malware that dials a number that charges money. How would it do this, is this from when modems were ...
2
votes
2answers
174 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected ...
0
votes
2answers
43 views

Dynamic analysis tools in windows

I'm sorry, i'm newbie in security, i'm looking for a software that detect changes in the whole operating system during its execution, that's helps analysing the behaviour of malicious software to know ...
0
votes
1answer
35 views

Applications of ODEs to Cybersecurity

My university's cybersecurity program allows one to take a course in ordinary differential equations as an elective. The course would be interesting to take, although I don't know how I'd apply it to ...
2
votes
1answer
107 views

Risk analysis Information Security Checklist

I wouldn't bother asking this question if it was easy to find. In the past I've used a risk-analysis-checklist which was split up in serveral factors. For example, there are Human factors, Hardware ...
1
vote
1answer
62 views

How to prepare a report on security weakness in our software [closed]

I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
2
votes
1answer
147 views

how are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
3
votes
4answers
183 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
4
votes
1answer
80 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
3
votes
1answer
391 views

SCADA, ICS Specfic Testing Tools and Methodologies

I have been contracted to perform a security risk assessment that relates specifically to ICS and SCADA systems. I have performed many IT security risk assessments, however, I am new to assessing ...
0
votes
1answer
89 views

What are the Security Risks of Disabling Reverse Path Filtering

Reverse Path Filters are generally used to disable asymmetric routing where an application has a different incoming and outgoing routes. So idea is to prevent packet entering from one interface ...
6
votes
2answers
422 views

Stolen Laptop - Next steps

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple ...
1
vote
2answers
64 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
1
vote
1answer
119 views

Uses of Threat Modeling outside of application development?

Is threat modeling useful outside of application development? Is it a useful tool for doing operational assessments of information systems already in existence? I am confused how threat modeling ...
0
votes
1answer
65 views

Network and Security Associates v.s. CISCO Security Associates [closed]

My college is expanding the Information Technology department to include Networking and Security as well as the CISCO Security. In my research online I have found different information for each ...
0
votes
1answer
66 views

Security risks monitoring JMX

I am doing an internship at a big company wich create industrial automated systems for some big company's. They want me to design a way to monitor all the Java based control modules. Now I am going to ...
2
votes
1answer
1k views

IPS fail close vs IPS fail open, what are the risks and benefits?

If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes: 1- ...
-2
votes
2answers
100 views

Why do home internet users cant communicate with their peers? [closed]

As a home internet users, why does my ISP block my communication with any other client on the same subnet as mine? It is done for security obviously, but what is the risk? Update: as clarified by ...
1
vote
1answer
94 views

What security risks are associated with DLP Systems?

Some high level risks with DLP that I can identify (with the monitoring componant): 1- Abuse of authority: people with access to the system can look into other users private data. 2- Loss of ...
3
votes
3answers
187 views

Can risk mitigation controls bring down the impact?

While doing a Risk Assessment, I found that in some old RA documents, after controls have been placed, the Impact in the forcasted value was changed that did not make sense to me. To me the impact ...
3
votes
4answers
720 views

What are the risks associated with SSL interception in an Organization?

If an SSL interceptor is installed for security reasons in an Organization, and a certificate from intermediate CA is installed on all domain machines, what kind of risks this setup presents?
0
votes
1answer
88 views

What are the risk associated with granting full permission (Any) to DB Admin users to the Database?

Usually in a well controlled environment, Database Admins are granted specific rights like Read, Modify...etc. No one has the right (ANY) to perform on any Database. Certain requirements dictate to ...
0
votes
1answer
116 views

undetectable virtualization apps to spoof web browsers [closed]

monitoring web pages for malicious iframes (root kits) without VM is not safe. when its possible to detect virtualization just by javascript, which software provide undetectable VMs ? QEMU is safe?
2
votes
1answer
266 views

Detecting Virtualization from web browser

is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and ...
4
votes
4answers
5k views

How can I detect backdoors?

I have a machine running Mac OS X and I suspect there may be a backdoor installed. I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
3
votes
3answers
781 views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
6
votes
1answer
664 views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
7
votes
3answers
500 views

Risk Control - Ignored risks and accepted risks

Some say that ignored risks as part of an organization's behavior are much worse than accepted risks. I would like to test that axiom (in the eyes of some). When I am handling a risk and I choose to ...
2
votes
3answers
726 views

Security Assessment vs. Risk Analysis

What the real difference between IT Security Assessment based on ISO 27001 (or in general other international standard) and qualitative risk analysis? In some way the approach is much similar - ...
3
votes
3answers
460 views

How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)

After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
2
votes
2answers
2k views

how to identify p2p on network

Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
4
votes
2answers
2k views

Skype security concerns on an enterprise network

I am trying to write a security opinion that may influence policy in the future in the Enterprise-grade network which I work to protect regarding the use of Skype on the networks, and security risks ...
3
votes
2answers
232 views

How likely is an infection with an outdated skype on linux? [closed]

Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook: deb http://download.skype.com/linux/repos/debian/ stable non-free Doesn't have the new version, ...
1
vote
1answer
156 views

What would be good resources to conduct Technical Impact Analysis?

As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as: https://www.owasp.org/index.php/Top_10_2010-A1 Similarly, CAPEC list impact in ...
0
votes
2answers
169 views

Looking for information about the job from security consultants

I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
5
votes
2answers
1k views

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
11
votes
3answers
168 views

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
3
votes
1answer
534 views

IP address filtering vs web application security

We have a web application behind a firewall that requires no user authentication. If we open up access to this application via the firewall to a small list of IP addresses what is the risk of ...
3
votes
3answers
246 views

Where can I find a collection of Threat Models?

I found a very nice SSL Threat model on this web page and would like to find more on different topics. How would I go about locating more images like these? Is there an organisation or website I ...
15
votes
12answers
836 views

Is this much distrust really necessary?

In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount ...
0
votes
3answers
344 views

List of notable security breaches [closed]

Is there a list of notable (i.e. those reported in the mainstream media) security issues such as hacks, viruses, worms and any other unauthorized or improper access or use of computers for malicious ...
6
votes
4answers
170 views

How to choose/compromise between data protection, and device recovery?

I'm sure many of you have probably seen (online or in-person) the DEFCON 18 presentation, demonstrating what can happen if you steal a hacker's computer. For those who haven't, the link is below. ...
8
votes
2answers
752 views

Looking for an open risk assessment methodology

I'm looking for a fully open quantitative risk assessment methodology. Most of the methodologies have usage or licensing restrictions placed upon them. I define open as methodology covered by ...
8
votes
3answers
3k views

Is CentOS a good choice from a security perspective?

How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
21
votes
4answers
1k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
65
votes
13answers
14k views

Why do sites implement locking after 3 failed password attempts?

I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
11
votes
3answers
324 views

What risk analysis methodologies should I use?

I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...