The risk-analysis tag has no wiki summary.
50
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
18
votes
4answers
714 views
How do you manage security-related OCD (i.e. paranoia)?
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though.
As society has crossed into ...
10
votes
3answers
261 views
What risk analysis methodologies should I use?
I've heard of FAIR, and that seems pretty great.
What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?
...
4
votes
3answers
240 views
How to evaluate a password manager?
How can we quantify the trade-off between password aggregation and convenience?
Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
7
votes
2answers
535 views
Looking for an open risk assessment methodology
I'm looking for a fully open quantitative risk assessment methodology.
Most of the methodologies have usage or licensing restrictions placed upon them.
I define open as methodology covered by ...
2
votes
2answers
384 views
how to identify p2p on network
Im trying to work out if the traffic in the below image is P2P file sharing?
If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
