Questions tagged [business-risk]
The probability of loss inherent in an organization's operations and environment (such as competition and adverse economic conditions) that may impair its ability to provide returns on investment. Business risk plus the financial risk arising from use of debt (borrowed capital and/or trade credit) equal total corporate risk.
63
questions
1
vote
0
answers
46
views
Cyber Risk Management Strategy Implementation
I’m developing a Risk Management Implementation strategy for my small SaaS organization, and I’d appreciate your feedback on the soundness of the approach outlined below. We’re hosted in the cloud, ...
1
vote
0
answers
150
views
Is it secure that anyone could claim Google My Business ownership? [closed]
Today I found that Google has a funny feature that allows everyone to claim ownership of a particular business, and if the owner does not reject it in 3 days, then the business ownership is set to the ...
- 843
1
vote
3
answers
1k
views
Should I have another domain name for my company internal tools
My company has a domain name that we use to serve our customers, say company.com for the main website, app.company.com for the web application and api.company.com. These are all public domains that ...
- 785
0
votes
1
answer
327
views
What alternative standard for ISO 27001 can be used in Australia?
I am looking for alternatives, that are less strict and less time consuming, than ISO 27001. Australia is in the Commonwealth, so maybe Cyber Essentials Plus could work, but I do not know if that ...
0
votes
0
answers
114
views
What to do after a social engineering attack was used to trick utility services at my hypothetical business? How to close the security hole?
Business Attack Scenario
Standard information that was ubiquitous through my chain-businesses
was exploited by a rogue group of former employees to sabotage. They
considered manipulating all ...
- 149
7
votes
4
answers
428
views
Why should small and medium-sized businesses care about security?
Pretext
I'm not a security expert, just a web dev with an interest in "security".
I've been tasked by my employer with giving an internal talk on security (specifically web application security) and ...
- 307
1
vote
2
answers
208
views
How to create non-generic security requirements for an idea phase?
Our manager often asks us for a quick understanding of what the risks will be based on some idea that the department has been working on during the ideation phase (the business requirements are ...
- 1,294
16
votes
5
answers
563
views
Business founder wants access to database but has no DB skills
Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
- 2,117
2
votes
1
answer
204
views
Should we change risk appetite when we go on a digital transformation journey?
Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms.
There are arguments in our Information Security team regarding 'Risk ...
- 2,031
1
vote
3
answers
3k
views
Security Risk Register
Does anyone know of any good Risk Registers to start logging security risk that are found on the fly?
The problem that I am having is that we find so much in a day, things start to get lost in ...
- 31
3
votes
0
answers
119
views
What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?
We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
- 153
2
votes
1
answer
3k
views
API Security - Mutual TLS vs TLS with shared secret .
When setting up the security for business to business API integration. We are discussion 2 option
Mutual TLS with IP Filtering
TLS with a Shared secret and IP Filtering.
Which is the more secure ...
- 205
1
vote
0
answers
88
views
Recommended number of ssytems under an ISSO
Is there an optimum number of systems an ISSO should be responsible for? I realize system size and complexity come into play but assuming most are large and of moderate risk, etc. is there a number ...
- 11
3
votes
2
answers
174
views
What kind of completely online business can I run doing infosec/cyber security? [closed]
I have been working in the field the past 2-3 years and I have a total of 10 years experience with computer science. I want something I could do part time from any country in the world. I would rather ...
2
votes
1
answer
192
views
How to justify a Vulnerability Research function at a company
From a business standpoint, how would you express the need for a vulnerability research team?
In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
- 610
4
votes
5
answers
5k
views
What standard alternative to ISO 27001 can be used for a small business?
The business in question has high requirements for information security due to the sensitive nature of their work. The company has 5 people on staff and work with consultants from time to time. Is ...
- 41
1
vote
2
answers
605
views
Distance between main site and Disaster recovery site
i couldn't find any specific requirements for distance between main site and DR at the regulations or best practices only descriptions as “safe distance”
can any one provide reference to something ...
- 539
98
votes
10
answers
10k
views
How to create a company culture that cares about information security?
Hardened Servers, IPS, firewalls and all kinds of defenses cannot solve security problems if people leak information without knowing simply because they're misguided.
I already tried to instruct them ...
- 1,063
1
vote
2
answers
145
views
What app owners need to do while they resolve XSS to minimize risk?
I have submitted a pentest report in which I have reported XSS at a few locations in an application. The management agreed to the risk. They have planned to remediate the issue in the next thirty days....
- 1,831
8
votes
2
answers
1k
views
How often do security patches break business applications [closed]
Are there any statistics on how reliable security patches are? Such as the fraction recalled or corrected?
Part of keeping a computer secure is applying security patches to it. The period between a ...
- 508
1
vote
2
answers
573
views
Login attempt password logging and obfuscation
I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
- 432
27
votes
7
answers
7k
views
Is ignoring a threat you cannot defend from a valid strategy?
Given that you sometimes can not defend from a form of threat, is it then valid to ignore said threat? Instead of defending from the threat, just mitigate the symptom.
An example of this comes from ...
- 485
5
votes
1
answer
139
views
What are best practices for secure admin access management to critical 3rd party cloud application in big companies?
I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate:
The administrator might leave the company without ...
- 53
3
votes
2
answers
289
views
What parameters define information sensitivity?
Since information is generally consumed by different parties for various reasons, what parameters define information sensitivity?
For example marketing may define "customer" data such as name and ...
- 1,513
146
votes
8
answers
17k
views
How should I set up emergency access to business-critical secrets in case I am "hit by a bus"?
I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
- 1,479
2
votes
1
answer
234
views
Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?
One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
- 1,600
4
votes
0
answers
188
views
What business identifiers are considered non-public, and should not be disclosed?
I am setting up a corporation in the US and UK and am presented with a EIN for the US, and VAT Reg. Number. for the EU.
Somewhere in the piles of documentation I have been reading, I read that the D&...
- 51k
5
votes
1
answer
191
views
How can I objectively evaluate trust in a person? (Systems Admin, or other)
When recruiting for positions that require a level of integrity and trust, I'm looking for objective ways of accessing that, either positively or negatively.
Is there any any guidance one should use ...
- 51k
0
votes
2
answers
138
views
How to decide software flow / business process is secure enough
Most of the time when we develop a software flow to implement a business logic often we are giving some decision that effecting safe and comfortable usage of the system and maybe success of the ...
- 29
1
vote
1
answer
131
views
Supply chain risks
I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department ...
- 1,951
-5
votes
1
answer
1k
views
Received emails from China Company about my Business name and they want to use it [closed]
Email 1:
Dear CEO,
(If you are not the person who is in charge of this, please forward this to your CEO, because this is urgent, Thanks)
We are a Network Service Company which is the domain name ...
2
votes
2
answers
1k
views
What could be the scope of ISO 27000 standards?
If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
- 279
2
votes
3
answers
1k
views
Businesses Handling Credit Cards via Email
I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices.
Customers often email their CC number and expiry date in ...
user68527
2
votes
3
answers
220
views
Moving Services to the Cloud
Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...
- 139
5
votes
2
answers
4k
views
ISO 27001 - procedures templates for ISMS at small companies? [closed]
Is anybody use publicly available (or relatively cheap) templates of procedures for ISO 27001 for build own information security management system capable to be conform standard.
Any recommendation?
...
1
vote
1
answer
260
views
How to prepare a report on security weakness in our software [closed]
I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
- 123
7
votes
1
answer
375
views
What's the best duration for storing e-mail? [closed]
We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the ...
- 103
22
votes
4
answers
12k
views
Good, simple list of reasons that email is inherently insecure
I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
- 2,716
1
vote
3
answers
349
views
What day-to-day activities can compromise a person's information security [closed]
Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
- 465
11
votes
3
answers
1k
views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
- 51k
5
votes
3
answers
1k
views
What benefits are there for security architecture being a separate discipline to enterprise architecture?
Had this question at Owasp Scotland this evening, and didn't get useful answers.
Is there too much specialisation in security now which means that enterprise architects can't know enough to delivery ...
- 61.5k
5
votes
3
answers
981
views
What are the problems with bring-your-own-device related to smartphones?
What are the problems with bring-your-own-device related to smartphones?
Companies see this more and more everyday, people want to use their personal devices on the corporate network or even use them ...
- 54.6k
2
votes
6
answers
445
views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
11
votes
3
answers
943
views
How can I promote good password practices in an organization that doesn't currently care about that?
I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
- 812
4
votes
1
answer
272
views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
- 932
3
votes
4
answers
584
views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
- 51k
4
votes
3
answers
681
views
Where can I find a collection of Threat Models?
I found a very nice SSL Threat model on this web page and would like to find more on different topics.
How would I go about locating more images like these? Is there an organisation or website I ...
- 51k
77
votes
15
answers
21k
views
How to write an email regarding IT Security that will be read, and not ignored by the end user?
I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.
The problem seems to be among people ...
- 51k
28
votes
3
answers
3k
views
Help me find a lightweight threat modeling framework
We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there ...
- 591
25
votes
15
answers
2k
views
Is there a strong challenge to be made against the startup executive that believes security must be delayed?
A common statement start-up executives make regarding security is that they are in a race to market and if they consciously choose to build in security from the get-go it may slow them down so much as ...
- 13.8k