Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or ...

learn more… | top users | synonyms

-1
votes
0answers
31 views

What could eventually be effectively done to mitigate the risks of errors and backdoors in IT-security software? [closed]

Software errors of programmers in composing the originals and later in updating them understandably can't be perfectly prevented. On the other hand there exist backdoors in IT-security software, which ...
3
votes
2answers
49 views

What parameters define information sensitivity?

Since information is generally consumed by different parties for various reasons, what parameters define information sensitivity? For example marketing may define "customer" data such as name and ...
0
votes
1answer
48 views

What is the best way to report IT Security risks to Executive management? [closed]

I am seeking your opinion on what is the best way to report/communicate IT security risks (risk register) to IT executive management in big organization?
4
votes
1answer
45 views

How are assets assessed for criticality?

Following on from the post regarding risks assessments and critical assets, how are assets assessed for criticality be it infrastructure, processes, people (possibly), etc? If using the security ...
6
votes
1answer
114 views

Industry best practices for vulnerability scanning and management?

I am looking for reference documents or talks as to the end results for a vulnerability assessment, scanning, and management process at a fully matured "impressive" level for a large organization that ...
0
votes
1answer
38 views

Difference between Threat Impact and Business Impact

I'm using SecureAware by Neupart/Lightwave as ISMS. This, otherwise fine program, asks me to fill in Threat Impact for all threads in the usual categories of Confidentiality, Integrity and ...
3
votes
1answer
46 views

SOMAP for risk assessment methodology or other Open Source IT Risk Management

Is SOMAP good for risk assessment or it is not in use any more? Is there any other Open Source IT Risk Management?
3
votes
1answer
51 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
1
vote
0answers
64 views

Why don't more servers use HTTPS to secure executable downloads? [duplicate]

I actually check for TLS before I use any exe files. I've been trying to download a bootable usb creator tool for windows. However, I can't find a single one that actually uses any form of TLS (or ...
0
votes
3answers
576 views

The difference between risk assessment and risk analysis [duplicate]

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the ...
1
vote
1answer
106 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
2
votes
1answer
41 views

Are Ad-hoc security testing beneficial to small business?

While reflecting on enterprise scale security program, I had this question if small scale businesses benefit at all from an ad-hoc security testing? What are some suggestions that will solve the ...
2
votes
2answers
36 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
-3
votes
1answer
64 views

Security risk analysis software [closed]

I am looking for some risk assessment tools (preferably open source), which make the analysis of a system based on its hardware structure given as input and point out potential weaknesses of this ...
3
votes
3answers
55 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
2
votes
0answers
44 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network. ...
2
votes
1answer
129 views

Is it secure to set default value for password field?

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
1
vote
1answer
31 views

Supply chain risks

I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department ...
4
votes
2answers
109 views

Estimating the cost of implementing security measures

Are there good resources or good practices on how to estimate the cost for implementing security measures in a company? My purpose is to justify to management that they need to spend this amount to ...
26
votes
5answers
3k views

DDOS - security or operational risk?

The chief security officer of a medium sized IT company (400-500 employees) recently released a bulletin in which he stated that DDOS attacks are not a security risk but an operational one. Also I was ...
0
votes
1answer
61 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
11
votes
2answers
318 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
2
votes
2answers
125 views

Connection between “Security Requirements Engineering”, “Risk Analysis” and “Threat Modeling”

I am trying to figure out how the above concepts fit in together. As i understood it Security Requirements Engineering (SRE), Risk Analysis (RA) and Threat Modeling (TM) are methods that ultimately ...
1
vote
1answer
103 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
2
votes
2answers
323 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
3
votes
1answer
1k views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
1
vote
0answers
92 views

Information Security classification [closed]

I've been interested in IT security for a bit (~1 year) and had a bit of experience with NSM as well as web security. I want to have an overview of the entire industry, with all relevant niches and ...
1
vote
0answers
323 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
2
votes
1answer
132 views

Historical events in terms of risk assessment

How can historical events be leveraged in terms of a risk assessment. I know you could for instance look at malware infections over the past x months to perform a better estimation of for your malware ...
2
votes
1answer
770 views

Exposure Factor when calculating SLE

I am studying for an exam and came across a question asking to find what the single loss expectance would be, but I am failing to understand exposure factor in the calculation. SLE = Asset Value * ...
12
votes
2answers
260 views

How should I manage people/technicians during an incident/outbreak?

Assume there is an incident that requires immediate response, such as a virus outbreak over email, Cryptolocker actively encrypting files, or a DOS attack. How should I approach this in a way that ...
2
votes
3answers
199 views

Risk assessment scope and critical assets

We've started implementing ISMS in our organization. The scope is IT dept and all users of the company who are connected to our WAN. but our risk assessment scope is only Data center and Network ...
6
votes
1answer
240 views

How to determine risk ratings for third party mobile apps

Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, ...
2
votes
1answer
139 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
2
votes
3answers
125 views

Moving Services to the Cloud

Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...
1
vote
4answers
284 views

If malware was detected in browser local storage does computer need to be nuked from orbit

I haven't used Windows partition since mid-June and I booted the system once again just a few days ago. My first action was as usual update all programs marked to be updated (including Windows ...
2
votes
2answers
194 views

How to protect iKvM, IPMI, KvM Interfaces from 0day and other exploits

In REF to http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack and the hacks of several companies and web hosts have been hit and had their servers wiped from ...
3
votes
2answers
514 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected ...
1
vote
1answer
88 views

Is it safe to put the output of 'strace' online?

For debugging purposes, one might be asked to put the output of strace for some process online, i.e. attached to a bug report. Is this safe in general? Under what circumstances is this safe or ...
1
vote
0answers
92 views

Preferred features of CDN with DDoS?

I am putting together a presentation comparing CDN services that also provide DDoS protection. I have to do a really good job on this and I'm not a security expert. For lack of direction, I've copied ...
1
vote
2answers
84 views

Automatic vs Manual

When it comes to technologies that directly affect information security, how do you determine when it is better to use an automatic option instead of a manual option, and vice versa? I already feel ...
1
vote
2answers
84 views

Ways to certify a SaaS for security [closed]

Is it common for small companies to get security certificates/compliance from audit agencies for their SaaS to present to customers for their assurance? If so what are the suggested certifications?
5
votes
1answer
467 views

Can OSSTMM RAVs be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000?

The calculation of RAVs in OSSTMM seem very useful as a security metric but, can they be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000? ISO 27001:2013 ...
20
votes
9answers
2k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
1
vote
1answer
133 views

How to prepare a report on security weakness in our software [closed]

I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
2
votes
1answer
805 views

how are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
3
votes
4answers
350 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
4
votes
3answers
2k views

Are non-personal AD users a security risk?

After an IT audit of my company, the report said that our Active Directory contained too many non-personal user accounts. This caused a risk of misuse and unauthorized user access. I checked my ...
0
votes
1answer
147 views

How to Choose and adopt information security model [closed]

I would like to ask about how can someone adopt certain security model in the organizations what are the criteria that controls how I can pick the best security model for my organization For example ...
1
vote
1answer
344 views

What security risks are associated with DLP Systems?

Some high level risks with DLP that I can identify (with the monitoring componant): 1- Abuse of authority: people with access to the system can look into other users private data. 2- Loss of ...