Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or ...

learn more… | top users | synonyms

10
votes
6answers
166 views
+50

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
-2
votes
1answer
70 views

Security risk analysis software [closed]

I am looking for some risk assessment tools (preferably open source), which make the analysis of a system based on its hardware structure given as input and point out potential weaknesses of this ...
11
votes
5answers
2k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
12
votes
4answers
1k views

Carrying out a professional IT audit procedure

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
3
votes
0answers
33 views

How to mitigate risk of X11 buffer ghosting on window resize and X server shutdown

The Buffer "Ghosting" Phenomenon It is possible to observe contents of (old and currently used) graphics buffers on a monitor under certain circumstances, posing an information disclosure risk, when ...
1
vote
1answer
109 views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
96
votes
11answers
8k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
3
votes
1answer
166 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
2
votes
2answers
2k views

Exposure Factor when calculating SLE

I am studying for an exam and came across a question asking to find what the single loss expectance would be, but I am failing to understand exposure factor in the calculation. SLE = Asset Value * ...
1
vote
2answers
83 views

Deep Packet Inspection: Any real world examples of threat mitigation via DPI? [closed]

So I understand conceptually how DPI works, but I'm a little skeptical regarding the actual benefits of this technology. Considering the possible risks associated with deploying DPI, i.e., decrypting ...
3
votes
2answers
68 views

What parameters define information sensitivity?

Since information is generally consumed by different parties for various reasons, what parameters define information sensitivity? For example marketing may define "customer" data such as name and ...
0
votes
1answer
85 views

What is the best way to report IT Security risks to Executive management? [closed]

I am seeking your opinion on what is the best way to report/communicate IT security risks (risk register) to IT executive management in big organization?
4
votes
1answer
122 views

How are assets assessed for criticality?

Following on from the post regarding risks assessments and critical assets, how are assets assessed for criticality be it infrastructure, processes, people (possibly), etc? If using the security ...
6
votes
1answer
568 views

Industry best practices for vulnerability scanning and management?

I am looking for reference documents or talks as to the end results for a vulnerability assessment, scanning, and management process at a fully matured "impressive" level for a large organization that ...
33
votes
5answers
2k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
21
votes
5answers
2k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
8
votes
2answers
10k views

Is the service join.me actually a huge security risk?

In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page. Until I encountered this service, I had no ...
0
votes
1answer
58 views

Difference between Threat Impact and Business Impact

I'm using SecureAware by Neupart/Lightwave as ISMS. This, otherwise fine program, asks me to fill in Threat Impact for all threads in the usual categories of Confidentiality, Integrity and ...
3
votes
1answer
80 views

SOMAP for risk assessment methodology or other Open Source IT Risk Management

Is SOMAP good for risk assessment or it is not in use any more? Is there any other Open Source IT Risk Management?
3
votes
1answer
57 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
2
votes
3answers
245 views

Risk assessment scope and critical assets

We've started implementing ISMS in our organization. The scope is IT dept and all users of the company who are connected to our WAN. but our risk assessment scope is only Data center and Network ...
1
vote
0answers
64 views

Why don't more servers use HTTPS to secure executable downloads? [duplicate]

I actually check for TLS before I use any exe files. I've been trying to download a bootable usb creator tool for windows. However, I can't find a single one that actually uses any form of TLS (or ...
1
vote
3answers
2k views

The difference between risk assessment and risk analysis [duplicate]

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the ...
6
votes
2answers
1k views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
15
votes
4answers
250 views

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
1
vote
1answer
147 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
11
votes
2answers
358 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
2
votes
2answers
155 views

Connection between “Security Requirements Engineering”, “Risk Analysis” and “Threat Modeling”

I am trying to figure out how the above concepts fit in together. As i understood it Security Requirements Engineering (SRE), Risk Analysis (RA) and Threat Modeling (TM) are methods that ultimately ...
2
votes
1answer
48 views

Are Ad-hoc security testing beneficial to small business?

While reflecting on enterprise scale security program, I had this question if small scale businesses benefit at all from an ad-hoc security testing? What are some suggestions that will solve the ...
2
votes
2answers
39 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
4
votes
3answers
65 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
2
votes
0answers
46 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network.
65
votes
5answers
38k views

How do you destroy an old hard drive?

How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
2
votes
1answer
145 views

Is it secure to set default value for password field?

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
1
vote
1answer
33 views

Supply chain risks

I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department ...
4
votes
2answers
158 views

Estimating the cost of implementing security measures

Are there good resources or good practices on how to estimate the cost for implementing security measures in a company? My purpose is to justify to management that they need to spend this amount to ...
26
votes
5answers
3k views

DDOS - security or operational risk?

The chief security officer of a medium sized IT company (400-500 employees) recently released a bulletin in which he stated that DDOS attacks are not a security risk but an operational one. Also I was ...
2
votes
1answer
144 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
0
votes
1answer
68 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
2
votes
2answers
437 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
2
votes
2answers
216 views

How to protect iKvM, IPMI, KvM Interfaces from 0day and other exploits

In REF to http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack and the hacks of several companies and web hosts have been hit and had their servers wiped from ...
3
votes
1answer
2k views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
1
vote
0answers
99 views

Information Security classification [closed]

I've been interested in IT security for a bit (~1 year) and had a bit of experience with NSM as well as web security. I want to have an overview of the entire industry, with all relevant niches and ...
11
votes
2answers
270 views

How should I manage people/technicians during an incident/outbreak?

Assume there is an incident that requires immediate response, such as a virus outbreak over email, Cryptolocker actively encrypting files, or a DOS attack. How should I approach this in a way that ...
1
vote
0answers
441 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
2
votes
1answer
222 views

Historical events in terms of risk assessment

How can historical events be leveraged in terms of a risk assessment. I know you could for instance look at malware infections over the past x months to perform a better estimation of for your malware ...
5
votes
1answer
320 views

How to determine risk ratings for third party mobile apps

Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, ...
26
votes
6answers
17k views

Can a hard drive be destroyed by drowning?

These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart. Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some ...
3
votes
2answers
541 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected ...
2
votes
3answers
129 views

Moving Services to the Cloud

Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...