Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or ...

learn more… | top users | synonyms

3
votes
1answer
217 views

Fraud Mitigation - Card Present Transactions

When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent ...
4
votes
1answer
628 views

What are the security risks when using free Content delivery networks (CDNs)?

I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
11
votes
3answers
191 views

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
2
votes
4answers
355 views

Does outsourcing infrastructure services reduce risk (and improve security)?

I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...
2
votes
1answer
147 views

Industrial security — resources for ISO27k compliance, social-engineering trend reports

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
5
votes
5answers
537 views

What are all of the issues with storing a cleartext password?

I know, I know, cleartext passwords are terrible and you should always store a hash! However, I'm interested in all of the issues with storing cleartext passwords so I can make a reasonably secure ...
6
votes
1answer
106 views

Mitigating risk from electronic payments

When attempting to sell a product online (for instance, on craigslist) there is a very good chance you will be the target of a social engineer; this is especially true when you are selling high-value ...
3
votes
2answers
119 views

Someone else's cloud infrastructure too sketchy for large enterprise SaaS application?

I have a set of geared-to-enterprise SaaS services I will be trying to sell soon to a number of large companies. In IT and Security reviews for critical software in the past, as a vendor you were ...
5
votes
3answers
438 views

Should we store meeting minutes on an iPad?

Being employed in the infosec field I would like to set a good example. However I also do not believe in sweating the small stuff and would like to maximize my productivity. My current workplace, ...
3
votes
1answer
114 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
0
votes
2answers
180 views

Looking for information about the job from security consultants

I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
5
votes
4answers
1k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
5
votes
3answers
293 views

Certifiable standards for server security, besides PCI-DSS?

The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
15
votes
12answers
873 views

Is this much distrust really necessary?

In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount ...
3
votes
3answers
292 views

Where can I find a collection of Threat Models?

I found a very nice SSL Threat model on this web page and would like to find more on different topics. How would I go about locating more images like these? Is there an organisation or website I ...
3
votes
4answers
413 views

What is the purpose of EICAR?

For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places. Sometimes the AV solution is so far out of date, that its ...
11
votes
3answers
967 views

Carrying out a professional IT audit procedure

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
4
votes
1answer
7k views

Is the service join.me actually a huge security risk?

In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page. Until I encountered this service, I had no ...
5
votes
3answers
1k views

storing the third party credentials in the database/some secure place

This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user. Our system connect to the third party system using ...
-2
votes
1answer
685 views

Is there a need for a simple SAAS security risk assessment application?

Apologies if this is question is not quite right for this site, I have been working on a small startup simple security risk assessment application, mainly to scratch my own itch and am looking to get ...
9
votes
2answers
6k views

How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?

Practically speaking, how easy difficult is it to spoof DNS? What scenarios are more risky than others? For example: A phishing email or twitter link that attracts users to click a hyperlink A ...
6
votes
4answers
174 views

How to choose/compromise between data protection, and device recovery?

I'm sure many of you have probably seen (online or in-person) the DEFCON 18 presentation, demonstrating what can happen if you steal a hacker's computer. For those who haven't, the link is below. ...
4
votes
4answers
330 views

Data categorization: Critical or not

I need to provide two means for securing data within my application. First is using the Operating System sandboxing model (I am talking about Mobile Phones OS) and the second using the OpenSSL AES ...
7
votes
2answers
381 views

What key metrics should a CIO rely on to gauge the extent of IT risk exposure?

Note - This was originally asked in another Area51 proposal, which has since been deleted.
18
votes
5answers
1k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
11
votes
3answers
358 views

What risk analysis methodologies should I use?

I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...