New answers tagged

4

@ThiefMaster's answer does a great job of enumerating the risks of using an externally controlled Content-- which basically fall under the category of executing or displaying arbitrary code and content on a user's browser. I will mainly focus on your last question: How are those risk mitigated? which was unaddressed-- a lot has since changed (in 4 years). ...


0

A little late to the party, but I just came across some other risk modeling frameworks today in this pdf, so I thought I'd add here them here just in case. Some of them seem useful, but as always YMMV. Department of Homeland Security NIST CMS Octave


3

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation. If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by ...


1

There is also CWSS. The documentation also describes the differences with CVSS: CVSS assumes that a vulnerability has already been discovered and verified; CWSS can be applied earlier in the process, before any vulnerabilities have been proven. CVSS scoring does not account for incomplete information, but CWSS scoring has built-in support for ...


1

Have a look at the following risk rating models: Sans Comodo Wasc osstmm Cvss PCI



Top 50 recent answers are included