Risk Analysis is a practice used to identify and assess factors that may jeopardize the success of a project or achieving a goal. Security Risk Analysis or Risk Assessment could be Quantitative and Qualitative

learn more… | top users | synonyms

11
votes
7answers
218 views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
1
vote
1answer
58 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...
-2
votes
1answer
71 views

Security risk analysis software [closed]

I am looking for some risk assessment tools (preferably open source), which make the analysis of a system based on its hardware structure given as input and point out potential weaknesses of this ...
1
vote
0answers
63 views

Risks of using UUID to identify user in mobile app

I've got an existing customer base. A customer has appointments. Currently they cannot access or change their appointments without contacting me directly. I want to offer them a way to access and ...
3
votes
2answers
65 views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
1
vote
1answer
28 views

What is the best way to get missing information used for risk analysis

The situation is that I am a software developer working for this company since last January and was asked to do information security for my business unit on the side. I don't have a lot of experience ...
82
votes
12answers
27k views

Why do sites implement locking after three failed password attempts?

I know the reasoning behind not letting infinite password attempts - brute force attempts is not a meatspace weakness, but a problem with computer security - but where did they get the number three ...
27
votes
7answers
7k views

Is ignoring a threat you cannot defend from a valid strategy?

Given that you sometimes can not defend from a form of threat, is it then valid to ignore said threat? Instead of defending from the threat, just mitigate the symptom. An example of this comes from ...
-2
votes
2answers
147 views

Why can't home internet users communicate with their peers? [closed]

As a home internet user, why does my ISP block my communication with any other client on the same subnet as mine? It is done for security obviously, but what is the risk? Update: as clarified by ...
1
vote
2answers
76 views

Ethical hacking requirements on a banking institution

If I would be required to do an ethic hacking research by a banking institution would I use my own bank account, ask for an account to the bank or open a new account and transfer some money and do ...
2
votes
2answers
2k views

Exposure Factor when calculating SLE

I am studying for an exam and came across a question asking to find what the single loss expectance would be, but I am failing to understand exposure factor in the calculation. SLE = Asset Value * ...
8
votes
1answer
422 views

Is exposing website performance data a security risk?

I am currently adding a subsite to some websites that allows me to monitor performance data live as the server software perceives it. The data is mostly stuff like amount of memory used, memory ...
41
votes
5answers
5k views

What's the danger of having some random, out of my control, JavaScript code running on my pages?

My website pages reference some JavaScript code from a third-party CDN (analytics, etc). So I don't control what code is there - the third party may change those scripts at any moment and introduce ...
2
votes
1answer
233 views

Web browser security comparison analysis

Secunia publishes an annual vulnerability review that covers web browsers and surprisingly Google Chrome leads the number of known vulnerabilities in comparison to the likes of Microsoft Internet ...
10
votes
0answers
77 views

Should the risk of antivirus products be reconsidered in light of the TrendMicro critical bug report [closed]

Tavis Ormandy of Google has recently discovered a critical TrendMicro design flaw identified in this bug report - TrendMicro node.js HTTP server listening on localhost can execute commands. The bug ...
36
votes
3answers
2k views

Evaluating the security of home security cameras

My parents have a vacation home out in the country and are looking to setup a home surveillance system for remote viewing. I've heard that there can be serious vulnerabilities in these products. What ...
33
votes
5answers
2k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
0
votes
1answer
60 views

Difference between Threat Impact and Business Impact

I'm using SecureAware by Neupart/Lightwave as ISMS. This, otherwise fine program, asks me to fill in Threat Impact for all threads in the usual categories of Confidentiality, Integrity and ...
3
votes
1answer
8k views

IPS fail close vs IPS fail open, what are the risks and benefits?

If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes: 1- ...
3
votes
1answer
83 views

SOMAP for risk assessment methodology or other Open Source IT Risk Management

Is SOMAP good for risk assessment or it is not in use any more? Is there any other Open Source IT Risk Management?
1
vote
3answers
2k views

The difference between risk assessment and risk analysis [duplicate]

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the ...
6
votes
2answers
2k views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
15
votes
4answers
250 views

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
-1
votes
1answer
34 views

Formal functional relationship between risk and CVSS

The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities. What is the functional relationship between a CVSS and the associated ...
3
votes
2answers
182 views

Calculating the time required to brute force a random code

Say we have amount random entry codes of length characters from an alphabet of size alphabet. The number of possible codes is then easily calculated as keyspace = alphabet ^ length. Now take an ...
6
votes
1answer
5k views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF (...
2
votes
1answer
144 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
0
votes
1answer
69 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
3
votes
1answer
106 views

Can you securely allow users to create VM's on their workstations

I've moved from a job where developers were encouraged to use technologies like docker and vagrant to create VM's on their workstations for testing and development. At my new job, the IT manager ...
3
votes
1answer
2k views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
2
votes
1answer
224 views

Historical events in terms of risk assessment

How can historical events be leveraged in terms of a risk assessment. I know you could for instance look at malware infections over the past x months to perform a better estimation of for your malware ...
0
votes
1answer
75 views

Security risks of allowing customer to use his own domain for a hosted SaaS application

As a SaaS hosting, we are considering allowing customer to use an alternative domain to access his SaaS environment. Default domain owned and hosted by us: customersubdomain.ourdomain.com ...
3
votes
2answers
545 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected ...
1
vote
0answers
209 views

Trying to GET “/iptac-xxxx” not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/iptac-[a long long string]/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
1
vote
0answers
50 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
2
votes
1answer
754 views

Formula Used in Qualitative Risk Scales

I am reviewing NIST SP800-30 rev 1 and I am having a hard time understanding how they determine the distribution of values within the risk matrix. In the document, they define semi-qualitative values –...
4
votes
1answer
122 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
1
vote
3answers
127 views

Are dialers obsolete?

My antivirus picked up an infection by Dialer/Coulomb. The definition of a dialer is a piece of malware that dials a number that charges money. How would it do this, is this from when modems were ...
0
votes
2answers
70 views

Dynamic analysis tools in windows

I'm sorry, i'm newbie in security, i'm looking for a software that detect changes in the whole operating system during its execution, that's helps analysing the behaviour of malicious software to know ...
0
votes
1answer
55 views

Applications of ODEs to Cybersecurity

My university's cybersecurity program allows one to take a course in ordinary differential equations as an elective. The course would be interesting to take, although I don't know how I'd apply it to ...
2
votes
1answer
282 views

Risk analysis Information Security Checklist

I wouldn't bother asking this question if it was easy to find. In the past I've used a risk-analysis-checklist which was split up in serveral factors. For example, there are Human factors, Hardware ...
1
vote
1answer
141 views

How to prepare a report on security weakness in our software [closed]

I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
2
votes
1answer
959 views

how are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
3
votes
4answers
391 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
3
votes
1answer
1k views

SCADA, ICS Specfic Testing Tools and Methodologies

I have been contracted to perform a security risk assessment that relates specifically to ICS and SCADA systems. I have performed many IT security risk assessments, however, I am new to assessing ...
6
votes
4answers
16k views

How can I detect backdoors?

I have a machine running Mac OS X and I suspect there may be a backdoor installed. I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
4
votes
1answer
142 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in /var/...
6
votes
2answers
564 views

Stolen Laptop - Next steps

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple ...
0
votes
1answer
663 views

What are the Security Risks of Disabling Reverse Path Filtering

Reverse Path Filters are generally used to disable asymmetric routing where an application has a different incoming and outgoing routes. So idea is to prevent packet entering from one interface ...
1
vote
2answers
94 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...