Questions tagged [risk-management]
Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.
33
questions
165
votes
10
answers
25k
views
How do you explain the necessity of "nuke it from orbit" to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
98
votes
6
answers
48k
views
How do you destroy an old hard drive?
How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
15
votes
2
answers
11k
views
How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?
Practically speaking, how easy difficult is it to spoof DNS?
What scenarios are more risky than others? For example:
A phishing email or twitter link that attracts users to click a hyperlink
A ...
26
votes
5
answers
2k
views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
36
votes
5
answers
5k
views
How do you manage security-related OCD (i.e. paranoia)?
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though.
As society has crossed into ...
20
votes
9
answers
3k
views
How to get top management support for security projects?
I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
14
votes
3
answers
642
views
What risk analysis methodologies should I use?
I've heard of FAIR, and that seems pretty great.
What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?
...
33
votes
7
answers
54k
views
Can a hard drive be destroyed by drowning?
These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart.
Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some ...
15
votes
2
answers
4k
views
What are the security risks when using free Content delivery networks (CDNs)?
I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
14
votes
4
answers
5k
views
PCI-DSS - one application per server?
How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc?
I have a ...
7
votes
2
answers
2k
views
Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?
First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
6
votes
3
answers
4k
views
storing the third party credentials in the database/some secure place
This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user.
Our system connect to the third party system using ...
92
votes
15
answers
16k
views
How to deal with low-probability high-impact risks?
There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this:
There is a type of attack against our systems that can cause a lot of ...
68
votes
2
answers
10k
views
What are the risks of not patching a server or hypervisor for Meltdown?
The patch for Meltdown is rumoured to incur a 30% performance penalty, which would be nice to avoid if possible. So this becomes a Security vs Performance risk-assessment problem.
I am looking for a ...
34
votes
7
answers
6k
views
What are the real physical risks of casual social media publishing?
aka "how to scare my family into stopping publishing their life online?"
I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
18
votes
5
answers
6k
views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
12
votes
1
answer
953
views
What are the risks of not patching a workstation OS for Meltdown?
Assume the following:
macOS (but not sure that matters that much)
workstation, mostly gets new executables from the app store or open source repos through macports homebrew
fair bit of loading JS, ...
10
votes
2
answers
405
views
How does one properly assess risk?
Security is never 100%. There is a need to balance risk and cost. Risk assessments need to be performed to determine the cost-effectiveness of preventive measures.
There are a few questions I would ...
9
votes
2
answers
16k
views
Is the service join.me actually a huge security risk?
In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page.
Until I encountered this service, I had no ...
8
votes
3
answers
2k
views
Secure hard drive disposal: How to erase confidential information
When it comes to disposing of hardware that may contain PII, confidential, or other sensitive material, how do you determine what needs special handling? What process do you use?
I'd like to expand ...
5
votes
2
answers
382
views
What are the risk tradeoffs of all-in-one "smart" IDs vs. using a separate hardware authenticator?
In many organizations these days, employee IDs are very mutli-functional. They can serve as:
Visual identitiy verification. (Including employee photo, name, ID number, and other details on the face)...
5
votes
3
answers
972
views
What are the problems with bring-your-own-device related to smartphones?
What are the problems with bring-your-own-device related to smartphones?
Companies see this more and more everyday, people want to use their personal devices on the corporate network or even use them ...
5
votes
4
answers
1k
views
What is the purpose of EICAR?
For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places.
Sometimes the AV solution is so far out of date, that its ...
4
votes
1
answer
266
views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
3
votes
3
answers
2k
views
How important is patch management?
Problem
I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses:
We haven't had any ...
3
votes
2
answers
1k
views
Will a crossdomain.xml file reduce a potential security risk?
I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
3
votes
1
answer
403
views
Fraud Mitigation - Card Present Transactions
When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent ...
3
votes
1
answer
588
views
CVSS Score Remote or Local Scenario
I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
3
votes
2
answers
792
views
What risk does commoditized dedicated SHA256 processors pose to IT Operations?
With the advent of GPU-based computing, and now commoditized/dedicated SHA256 processors, what risk does this hardware pose to cryptography?
What security algorithms should be closely watched or ...
3
votes
1
answer
827
views
Can Exchange/OWA still compress static images and be immune to HTTP compression attacks?
Microsoft Exchange / OWA (Outlook Web Access) allows for three different types of compression (link for Ex2010)
Compression setting Description
High Compresses both static and ...
2
votes
3
answers
1k
views
Risk assessment scope and critical assets
We've started implementing ISMS in our organization. The scope is IT dept and all users of the company who are connected to our WAN. but our risk assessment scope is only Data center and Network ...
1
vote
2
answers
9k
views
Can my ISP know my passwords
If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
0
votes
1
answer
139
views
Software update process (dependencies) in organization
Wondering how other organizations manage software update process.
We are a startup, were we try to define components owners, which should update them (security updates etc).
This does not to seem to ...