Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or ...
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
6
votes
2answers
2k views
How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?
Practically speaking, how easy difficult is it to spoof DNS?
What scenarios are more risky than others? For example:
A phishing email or twitter link that attracts users to click a hyperlink
A ...
17
votes
5answers
737 views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
18
votes
4answers
716 views
How do you manage security-related OCD (i.e. paranoia)?
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though.
As society has crossed into ...
10
votes
3answers
261 views
What risk analysis methodologies should I use?
I've heard of FAIR, and that seems pretty great.
What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?
...
35
votes
5answers
5k views
How do you destroy an old hard drive?
How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
7
votes
2answers
148 views
How does one properly assess risk?
Security is never 100%. There is a need to balance risk and cost. Risk assessments need to be performed to determine the cost-effectiveness of preventive measures.
There are a few questions I would ...
3
votes
1answer
161 views
Fraud Mitigation - Card Present Transactions
When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent ...
5
votes
2answers
126 views
What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?
In many organizations these days, employee IDs are very mutli-functional. They can serve as:
Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
3
votes
1answer
76 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
5
votes
2answers
590 views
Secure hard drive disposal: How to erase confidential information
When it comes to disposing of hardware that may contain PII, confidential, or other sensitive material, how do you determine what needs special handling? What process do you use?
I'd like to expand ...
3
votes
2answers
504 views
What risk does commoditized dedicated SHA256 processors pose to IT Operations?
With the advent of GPU-based computing, and now commoditized/dedicated SHA256 processors, what risk does this hardware pose to cryptography?
What security algorithms should be closely watched or ...
