New answers tagged

0

Ignore is a pretty strong word, but I can tell you it is standard procedure in a lot of companies to avoid doing anything that would bring to light a threat that would be difficult to deal with. The general policy in nearly all IT shops is to do "due diligence", which basically means to do the stuff you are supposed to be doing. Since very advanced attacks ...


1

Rather than ignore, I'd suggest you evaluate the threat, determine the losses, and determine the cost to defend against the threat. If the cost to defend is higher than the losses, it's valid to choose to accept the threat's losses without developing a strategy to deal with the threat. As others point out, though, there are many ways to manage threats that ...


1

You should not "ignore" a threat just because you cannot prevent it. Threats have two sides: the before, and the after. "After" still exists if you cannot do anything about "before". For example, Denial of Service is very difficult to prevent. If a determined attacker with enough resources (or a stupid determined attacker with some resources) decides to get ...


10

There are four basic strategies to control risks: Avoidance: Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability Transference: Shifting the risk to other areas or to outside entities Mitigation: Reducing the impact if the vulnerability is exploited Acceptance: Understanding the consequences and accepting the ...


13

TL;DR: NO (but we should define what "ignoring" means; from the text of the question I suspect we're actually of the same opinion). You do not "ignore" a threat. The ancient saw says that you do not fear a threat that you cannot avoid - stultum est timere quod vitare non potes, since fear will avail you nothing. But few threats are completely unavoidable ...


40

You would never ignore a threat, and perhaps that is semantics over your wording. You either accept, mitigate, or outsource the risk for the given threat. In this case, that would be: accept that there will be a $X loss, mitigate fix DRM or find DRM alternate to protect the product, or outsource using insurance or place the risk on someone else in the ...


3

If there is a risk it will not simply vanish if you ignore it. If the risk is small enough it is unlikely that it will happen and you can probably ignore it. This is part of the usual risk management, i.e. there is no fully secure system. But if the risk is large enough ignoring it will be a bad idea. So while ignorance is in this case still a valid ...



Top 50 recent answers are included