Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or ...
21
votes
5answers
1k views
Can a hard drive be destroyed by drowning?
These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart.
Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some ...
2
votes
2answers
392 views
What is more risky? Database Server in DMZ or Trusted Network?
Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.
Assume the following
A web server is being used for ...
1
vote
1answer
79 views
Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?
Item 12.1.2 of PCI DSS requires that the company's security policy:
12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.
NIST ...
4
votes
1answer
179 views
Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?
First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
0
votes
2answers
331 views
Can my ISP know my passwords
If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
5
votes
3answers
162 views
Risk Control - Ignored risks and accepted risks
Some say that ignored risks as part of an organization's behavior are much worse than accepted risks.
I would like to test that axiom (in the eyes of some).
When I am handling a risk and I choose to ...
10
votes
4answers
382 views
PCI-DSS - one application per server?
How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc?
I have a collection of applications ...
4
votes
2answers
449 views
Is WordPress a security vulnerability inside a corporate intranet?
The company I work for had me develop a WordPress site for their intranet. Now they are saying that it poses security risks and they would like to shut it down and have me use another CMS (SharePoint ...
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
1
vote
2answers
92 views
Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?
Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination.
If we disable the account prior to wiping the device (or the device receiving the wipe ...
7
votes
2answers
149 views
How does one properly assess risk?
Security is never 100%. There is a need to balance risk and cost. Risk assessments need to be performed to determine the cost-effectiveness of preventive measures.
There are a few questions I would ...
3
votes
3answers
162 views
Can portable programs be exploited to steal information?
I work with sensitive information and there are clearly controls on what can and can't be made public. While I am not an IT security person, I believe I have found a vulnerability. When I was in ...
8
votes
2answers
162 views
How to mitigate the risk of a continuous integration service security breach?
We are using a Continuous Integration service to automatically run our product test suite. Every time we push code to our central Git repository production branch, the CI services is notified and ...
3
votes
2answers
511 views
What risk does commoditized dedicated SHA256 processors pose to IT Operations?
With the advent of GPU-based computing, and now commoditized/dedicated SHA256 processors, what risk does this hardware pose to cryptography?
What security algorithms should be closely watched or ...
4
votes
3answers
295 views
What are the problems with bring-your-own-device related to smartphones?
What are the problems with bring-your-own-device related to smartphones?
Companies see this more and more everyday, people want to use their personal devices on the corporate network or even use them ...
3
votes
2answers
220 views
Security concerns about my webapp
I read though OWASP very carefully, but I am not sure about some parts of my website.
I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
1answer
233 views
What are the security risks when using free Content delivery networks (CDNs)?
I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
2
votes
1answer
88 views
What's the benefit of using a specific implementation framework vs using the generic steps presented in most developed security frameworks?
Background Information: This post is for some research I’m working on for a course I’m taking at the University of Advancing Technology as a Network Security student. I’m researching some ...
5
votes
2answers
129 views
What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?
In many organizations these days, employee IDs are very mutli-functional. They can serve as:
Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
5
votes
3answers
467 views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
2
votes
1answer
125 views
Industrial security — resources for ISO27k compliance, social-engineering trend reports
I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
6
votes
1answer
90 views
Mitigating risk from electronic payments
When attempting to sell a product online (for instance, on craigslist) there is a very good chance you will be the target of a social engineer; this is especially true when you are selling high-value ...
5
votes
5answers
269 views
What are all of the issues with storing a cleartext password?
I know, I know, cleartext passwords are terrible and you should always store a hash!
However, I'm interested in all of the issues with storing cleartext passwords so I can make a reasonably secure ...
3
votes
2answers
109 views
Someone else's cloud infrastructure too sketchy for large enterprise SaaS application?
I have a set of geared-to-enterprise SaaS services I will be trying to sell soon to a number of large companies. In IT and Security reviews for critical software in the past, as a vendor you were ...
3
votes
1answer
76 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
0
votes
2answers
140 views
Looking for information about the job from security consultants
I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
39
votes
5answers
6k views
How do you destroy an old hard drive?
How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
4
votes
4answers
724 views
Security concerns from publicly visible Hudson & Jenkins servers?
A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
9
votes
3answers
128 views
How serious are security concerns of wireless healthcare devices?
Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
3
votes
4answers
260 views
What is the purpose of EICAR?
For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places.
Sometimes the AV solution is so far out of date, that its ...
5
votes
3answers
347 views
Should we store meeting minutes on an iPad?
Being employed in the infosec field I would like to set a good example. However I also do not believe in sweating the small stuff and would like to maximize my productivity. My current workplace, ...
3
votes
1answer
167 views
Fraud Mitigation - Card Present Transactions
When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent ...
4
votes
1answer
3k views
Is the service join.me actually a huge security risk?
In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page.
Until I encountered this service, I had no ...
3
votes
3answers
341 views
storing the third party credentials in the database/some secure place
This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user.
Our system connect to the third party system using ...
3
votes
3answers
198 views
Where can I find a collection of Threat Models?
I found a very nice SSL Threat model on this web page and would like to find more on different topics.
How would I go about locating more images like these? Is there an organisation or website I ...
15
votes
12answers
764 views
Is this much distrust really necessary?
In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount ...
10
votes
3answers
612 views
Carrying out a professional IT audit procedure
I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
6
votes
2answers
2k views
How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?
Practically speaking, how easy difficult is it to spoof DNS?
What scenarios are more risky than others? For example:
A phishing email or twitter link that attracts users to click a hyperlink
A ...
5
votes
3answers
243 views
Certifiable standards for server security, besides PCI-DSS?
The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
4
votes
4answers
298 views
Data categorization: Critical or not
I need to provide two means for securing data within my application. First is using the Operating System sandboxing model (I am talking about Mobile Phones OS) and the second using the OpenSSL AES ...
6
votes
4answers
149 views
How to choose/compromise between data protection, and device recovery?
I'm sure many of you have probably seen (online or in-person) the DEFCON 18 presentation, demonstrating what can happen if you steal a hacker's computer. For those who haven't, the link is below. ...
18
votes
4answers
743 views
How do you manage security-related OCD (i.e. paranoia)?
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though.
As society has crossed into ...
-2
votes
1answer
462 views
Is there a need for a simple SAAS security risk assessment application?
Apologies if this is question is not quite right for this site, I have been working on a small startup simple security risk assessment application, mainly to scratch my own itch and am looking to get ...
12
votes
4answers
479 views
How do you estimate the costs of a security breach?
I'm a student and fairly new to the IT security field. Most articles and books say you should only patch a vulnerability if the costs of a breach are higher than the costs of patching the ...
5
votes
2answers
608 views
Secure hard drive disposal: How to erase confidential information
When it comes to disposing of hardware that may contain PII, confidential, or other sensitive material, how do you determine what needs special handling? What process do you use?
I'd like to expand ...
17
votes
5answers
749 views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
2
votes
4answers
282 views
Does outsourcing infrastructure services reduce risk (and improve security)?
I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...
7
votes
2answers
238 views
What key metrics should a CIO rely on to gauge the extent of IT risk exposure?
Note - This was originally asked in another Area51 proposal, which has since been deleted.
10
votes
3answers
263 views
What risk analysis methodologies should I use?
I've heard of FAIR, and that seems pretty great.
What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?
...
