The risk-analysis tag has no wiki summary.
54
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
18
votes
4answers
742 views
How do you manage security-related OCD (i.e. paranoia)?
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though.
As society has crossed into ...
15
votes
12answers
764 views
Is this much distrust really necessary?
In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount ...
10
votes
3answers
263 views
What risk analysis methodologies should I use?
I've heard of FAIR, and that seems pretty great.
What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?
...
9
votes
3answers
127 views
How serious are security concerns of wireless healthcare devices?
Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
7
votes
2answers
544 views
Looking for an open risk assessment methodology
I'm looking for a fully open quantitative risk assessment methodology.
Most of the methodologies have usage or licensing restrictions placed upon them.
I define open as methodology covered by ...
6
votes
4answers
148 views
How to choose/compromise between data protection, and device recovery?
I'm sure many of you have probably seen (online or in-person) the DEFCON 18 presentation, demonstrating what can happen if you steal a hacker's computer. For those who haven't, the link is below. ...
5
votes
3answers
161 views
Risk Control - Ignored risks and accepted risks
Some say that ignored risks as part of an organization's behavior are much worse than accepted risks.
I would like to test that axiom (in the eyes of some).
When I am handling a risk and I choose to ...
5
votes
2answers
776 views
Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data
I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
4
votes
3answers
283 views
How to evaluate a password manager?
How can we quantify the trade-off between password aggregation and convenience?
Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
4
votes
1answer
178 views
Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?
First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
4
votes
1answer
393 views
IP address filtering vs web application security
We have a web application behind a firewall that requires no user authentication.
If we open up access to this application via the firewall to a small list of IP addresses what is the risk of ...
3
votes
3answers
198 views
Where can I find a collection of Threat Models?
I found a very nice SSL Threat model on this web page and would like to find more on different topics.
How would I go about locating more images like these? Is there an organisation or website I ...
3
votes
2answers
153 views
How likely is an infection with an outdated skype on linux? [closed]
Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook:
deb http://download.skype.com/linux/repos/debian/ stable non-free
Doesn't have the new version, ...
3
votes
2answers
772 views
Skype security concerns on an enterprise network
I am trying to write a security opinion that may influence policy in the future in the Enterprise-grade network which I work to protect regarding the use of Skype on the networks, and security risks ...
2
votes
4answers
425 views
How can I detect backdoors?
I have a machine running Mac OS X and I suspect there may be a backdoor installed.
I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
2
votes
2answers
435 views
how to identify p2p on network
Im trying to work out if the traffic in the below image is P2P file sharing?
If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
2
votes
3answers
367 views
Security Assessment vs. Risk Analysis
What the real difference between IT Security Assessment based on ISO 27001 (or in general other international standard) and qualitative risk analysis?
In some way the approach is much similar - ...
2
votes
3answers
306 views
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and ...
2
votes
1answer
96 views
Detecting Virtualization from web browser
is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and ...
1
vote
1answer
89 views
What would be good resources to conduct Technical Impact Analysis?
As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as:
https://www.owasp.org/index.php/Top_10_2010-A1
Similarly, CAPEC list impact in ...
0
votes
2answers
140 views
Looking for information about the job from security consultants
I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
0
votes
1answer
66 views
undetectable virtualization apps to spoof web browsers [closed]
monitoring web pages for malicious iframes (root kits) without VM is not safe. when its possible to detect virtualization just by javascript, which software provide undetectable VMs ? QEMU is safe?
-1
votes
3answers
266 views
List of notable security breaches [closed]
Is there a list of notable (i.e. those reported in the mainstream media) security issues such as hacks, viruses, worms and any other unauthorized or improper access or use of computers for malicious ...
