Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or ...

learn more… | top users | synonyms

6
votes
2answers
1k views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
2
votes
2answers
31 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
8
votes
2answers
224 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
-3
votes
1answer
49 views

Security risk analysis software [closed]

I am looking for some risk assessment tools (preferably open source), which make the analysis of a system based on its hardware structure given as input and point out potential weaknesses of this ...
3
votes
2answers
59 views

Connection between “Security Requirements Engineering”, “Risk Analysis” and “Threat Modeling”

I am trying to figure out how the above concepts fit in together. As i understood it Security Requirements Engineering (SRE), Risk Analysis (RA) and Threat Modeling (TM) are methods that ultimately ...
1
vote
2answers
116 views

Risk assessment scope and critical assets

We've started implementing ISMS in our organization. The scope is IT dept and all users of the company who are connected to our WAN. but our risk assessment scope is only Data center and Network ...
1
vote
3answers
39 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
2
votes
0answers
40 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network. ...
59
votes
5answers
32k views

How do you destroy an old hard drive?

How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
2
votes
1answer
100 views

Is it secure to set default value for password field?

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
1
vote
1answer
29 views

Supply chain risks

I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department ...
4
votes
2answers
75 views

Estimating the cost of implementing security measures

Are there good resources or good practices on how to estimate the cost for implementing security measures in a company? My purpose is to justify to management that they need to spend this amount to ...
26
votes
5answers
3k views

DDOS - security or operational risk?

The chief security officer of a medium sized IT company (400-500 employees) recently released a bulletin in which he stated that DDOS attacks are not a security risk but an operational one. Also I was ...
1
vote
1answer
129 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
0
votes
1answer
52 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
1
vote
2answers
168 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
1
vote
1answer
78 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
2
votes
2answers
168 views

How to protect iKvM, IPMI, KvM Interfaces from 0day and other exploits

In REF to http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack and the hacks of several companies and web hosts have been hit and had their servers wiped from ...
3
votes
1answer
474 views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
1
vote
0answers
82 views

Information Security classification [closed]

I've been interested in IT security for a bit (~1 year) and had a bit of experience with NSM as well as web security. I want to have an overview of the entire industry, with all relevant niches and ...
12
votes
2answers
249 views

How should I manage people/technicians during an incident/outbreak?

Assume there is an incident that requires immediate response, such as a virus outbreak over email, Cryptolocker actively encrypting files, or a DOS attack. How should I approach this in a way that ...
1
vote
0answers
179 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
2
votes
1answer
71 views

Historical events in terms of risk assessment

How can historical events be leveraged in terms of a risk assessment. I know you could for instance look at malware infections over the past x months to perform a better estimation of for your malware ...
2
votes
1answer
184 views

Exposure Factor when calculating SLE

I am studying for an exam and came across a question asking to find what the single loss expectance would be, but I am failing to understand exposure factor in the calculation. SLE = Asset Value * ...
75
votes
10answers
6k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
6
votes
1answer
130 views

How to determine risk ratings for third party mobile apps

Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, ...
26
votes
6answers
10k views

Can a hard drive be destroyed by drowning?

These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart. Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some ...
3
votes
2answers
427 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected ...
2
votes
3answers
111 views

Moving Services to the Cloud

Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...
5
votes
1answer
401 views

Can OSSTMM RAVs be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000?

The calculation of RAVs in OSSTMM seem very useful as a security metric but, can they be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000? ISO 27001:2013 ...
1
vote
4answers
247 views

If malware was detected in browser local storage does computer need to be nuked from orbit

I haven't used Windows partition since mid-June and I booted the system once again just a few days ago. My first action was as usual update all programs marked to be updated (including Windows ...
1
vote
1answer
81 views

Is it safe to put the output of 'strace' online?

For debugging purposes, one might be asked to put the output of strace for some process online, i.e. attached to a bug report. Is this safe in general? Under what circumstances is this safe or ...
1
vote
0answers
87 views

Preferred features of CDN with DDoS?

I am putting together a presentation comparing CDN services that also provide DDoS protection. I have to do a really good job on this and I'm not a security expert. For lack of direction, I've copied ...
1
vote
2answers
79 views

Automatic vs Manual

When it comes to technologies that directly affect information security, how do you determine when it is better to use an automatic option instead of a manual option, and vice versa? I already feel ...
1
vote
2answers
74 views

Ways to certify a SaaS for security [closed]

Is it common for small companies to get security certificates/compliance from audit agencies for their SaaS to present to customers for their assurance? If so what are the suggested certifications?
19
votes
9answers
1k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
1
vote
1answer
113 views

How to prepare a report on security weakness in our software [closed]

I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
2
votes
1answer
620 views

how are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
3
votes
4answers
312 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
4
votes
3answers
1k views

Are non-personal AD users a security risk?

After an IT audit of my company, the report said that our Active Directory contained too many non-personal user accounts. This caused a risk of misuse and unauthorized user access. I checked my ...
8
votes
3answers
421 views

How to estimate the cost of an application vulnerability?

I've seen data on the cost of a breach including lot of surveys and research by Verizon and the Ponemon Institute. But in terms of an actual vulnerability, what are the factors to consider to ...
6
votes
3answers
1k views

Secure hard drive disposal: How to erase confidential information

When it comes to disposing of hardware that may contain PII, confidential, or other sensitive material, how do you determine what needs special handling? What process do you use? I'd like to expand ...
24
votes
4answers
2k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
0
votes
1answer
135 views

How to Choose and adopt information security model [closed]

I would like to ask about how can someone adopt certain security model in the organizations what are the criteria that controls how I can pick the best security model for my organization For example ...
1
vote
1answer
262 views

What security risks are associated with DLP Systems?

Some high level risks with DLP that I can identify (with the monitoring componant): 1- Abuse of authority: people with access to the system can look into other users private data. 2- Loss of ...
0
votes
3answers
3k views

Is there a generic list of IT Risks that can be used as a reference to prepare an IT Risk Assessment report? [closed]

I am working on my first IT Risk Assessment assignment and even though I have the steps required and understanding of the system I am working on, I was wondering if there was a list of generic IT Risk ...
3
votes
1answer
499 views

Can Exchange/OWA still compress static images and be immune to HTTP compression attacks?

Microsoft Exchange / OWA (Outlook Web Access) allows for three different types of compression (link for Ex2010) Compression setting Description High Compresses both static and ...
2
votes
3answers
882 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
2
votes
2answers
3k views

What is more risky? Database Server in DMZ or Trusted Network?

Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently. Assume the following A web server is being used for ...
1
vote
1answer
370 views

Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?

Item 12.1.2 of PCI DSS requires that the company's security policy: 12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment. NIST ...