Questions tagged [business-risk]

The probability of loss inherent in an organization's operations and environment (such as competition and adverse economic conditions) that may impair its ability to provide returns on investment. Business risk plus the financial risk arising from use of debt (borrowed capital and/or trade credit) equal total corporate risk.

Filter by
Sorted by
Tagged with
1
vote
2answers
117 views

How to create non-generic security requirements for an idea phase?

Our manager often asks us for a quick understanding of what the risks will be based on some idea that the department has been working on during the ideation phase (the business requirements are ...
1
vote
3answers
780 views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
0
votes
0answers
38 views

What to do after a social engineering attack was used to trick utility services at my hypothetical business? How to close the security hole?

Business Attack Scenario Standard information that was ubiquitous through my chain-businesses was exploited by a rogue group of former employees to sabotage. They considered manipulating all ...
7
votes
4answers
254 views

Why should small and medium-sized businesses care about security?

Pretext I'm not a security expert, just a web dev with an interest in "security". I've been tasked by my employer with giving an internal talk on security (specifically web application security) and ...
15
votes
5answers
436 views

Business founder wants access to database but has no DB skills

Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
5
votes
2answers
3k views

ISO 27001 - procedures templates for ISMS at small companies? [closed]

Is anybody use publicly available (or relatively cheap) templates of procedures for ISO 27001 for build own information security management system capable to be conform standard. Any recommendation? ...
2
votes
1answer
65 views

Should we change risk appetite when we go on a digital transformation journey?

Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms. There are arguments in our Information Security team regarding 'Risk ...
2
votes
0answers
47 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
1
vote
1answer
187 views

API Security - Mutual TLS vs TLS with shared secret .

When setting up the security for business to business API integration. We are discussion 2 option Mutual TLS with IP Filtering TLS with a Shared secret and IP Filtering. Which is the more secure ...
2
votes
4answers
602 views

What standard alternative to ISO 27001 can be used for a small business?

The business in question has high requirements for information security due to the sensitive nature of their work. The company has 5 people on staff and work with consultants from time to time. Is ...
4
votes
2answers
830 views

What personal traits and characteristics do you look for in a IT Security pro? [closed]

IT Security Pros are very smart people who need to give your environment with the respect and care that the business requires. Part 1 What are the traits you look for in an employee before ...
1
vote
0answers
16 views

Recommended number of ssytems under an ISSO

Is there an optimum number of systems an ISSO should be responsible for? I realize system size and complexity come into play but assuming most are large and of moderate risk, etc. is there a number ...
77
votes
15answers
17k views

How to write an email regarding IT Security that will be read, and not ignored by the end user?

I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications. The problem seems to be among people ...
3
votes
2answers
95 views

What kind of completely online business can I run doing infosec/cyber security? [closed]

I have been working in the field the past 2-3 years and I have a total of 10 years experience with computer science. I want something I could do part time from any country in the world. I would rather ...
1
vote
1answer
85 views

How to justify a Vulnerability Research function at a company

From a business standpoint, how would you express the need for a vulnerability research team? In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
1
vote
2answers
195 views

Distance between main site and Disaster recovery site

i couldn't find any specific requirements for distance between main site and DR at the regulations or best practices only descriptions as “safe distance” can any one provide reference to something ...
97
votes
10answers
10k views

How to create a company culture that cares about information security?

Hardened Servers, IPS, firewalls and all kinds of defenses cannot solve security problems if people leak information without knowing simply because they're misguided. I already tried to instruct them ...
1
vote
2answers
75 views

What app owners need to do while they resolve XSS to minimize risk?

I have submitted a pentest report in which I have reported XSS at a few locations in an application. The management agreed to the risk. They have planned to remediate the issue in the next thirty days....
2
votes
2answers
793 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
2
votes
1answer
135 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
7
votes
2answers
467 views

How often do security patches break business applications [closed]

Are there any statistics on how reliable security patches are? Such as the fraction recalled or corrected? Part of keeping a computer secure is applying security patches to it. The period between a ...
1
vote
2answers
315 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
27
votes
7answers
7k views

Is ignoring a threat you cannot defend from a valid strategy?

Given that you sometimes can not defend from a form of threat, is it then valid to ignore said threat? Instead of defending from the threat, just mitigate the symptom. An example of this comes from ...
5
votes
1answer
57 views

What are best practices for secure admin access management to critical 3rd party cloud application in big companies?

I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate: The administrator might leave the company without ...
5
votes
1answer
126 views

How can I objectively evaluate trust in a person? (Systems Admin, or other)

When recruiting for positions that require a level of integrity and trust, I'm looking for objective ways of accessing that, either positively or negatively. Is there any any guidance one should use ...
3
votes
2answers
206 views

What parameters define information sensitivity?

Since information is generally consumed by different parties for various reasons, what parameters define information sensitivity? For example marketing may define "customer" data such as name and ...
36
votes
5answers
3k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
145
votes
8answers
16k views

How should I set up emergency access to business-critical secrets in case I am “hit by a bus”?

I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
4
votes
0answers
99 views

What business identifiers are considered non-public, and should not be disclosed?

I am setting up a corporation in the US and UK and am presented with a EIN for the US, and VAT Reg. Number. for the EU. Somewhere in the piles of documentation I have been reading, I read that the D&...
0
votes
2answers
75 views

How to decide software flow / business process is secure enough

Most of the time when we develop a software flow to implement a business logic often we are giving some decision that effecting safe and comfortable usage of the system and maybe success of the ...
1
vote
1answer
44 views

Supply chain risks

I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department ...
-5
votes
1answer
910 views

Received emails from China Company about my Business name and they want to use it [closed]

Email 1: Dear CEO, (If you are not the person who is in charge of this, please forward this to your CEO, because this is urgent, Thanks) We are a Network Service Company which is the domain name ...
2
votes
3answers
768 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
11
votes
3answers
832 views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
5
votes
3answers
1k views

What benefits are there for security architecture being a separate discipline to enterprise architecture?

Had this question at Owasp Scotland this evening, and didn't get useful answers. Is there too much specialisation in security now which means that enterprise architects can't know enough to delivery ...
2
votes
3answers
151 views

Moving Services to the Cloud

Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...
18
votes
4answers
7k views

Good, simple list of reasons that email is inherently insecure

I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
10
votes
3answers
815 views

How can I promote good password practices in an organization that doesn't currently care about that?

I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
1
vote
1answer
196 views

How to prepare a report on security weakness in our software [closed]

I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
10
votes
2answers
480 views

How do you compare risks from your websites, physical perimeter, staff etc

In assigning budget rationally - ie proportionally to the risk in a particular area, how can you calculate the relative risks? I can think of examples where clients of mine have secured their ...
14
votes
3answers
11k views

How much does a security audit cost? [closed]

For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC ("Lines of Code") and I would probably use a North American company for ...
7
votes
1answer
277 views

What's the best duration for storing e-mail? [closed]

We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the ...
1
vote
3answers
281 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
5
votes
3answers
858 views

What are the problems with bring-your-own-device related to smartphones?

What are the problems with bring-your-own-device related to smartphones? Companies see this more and more everyday, people want to use their personal devices on the corporate network or even use them ...
13
votes
9answers
732 views

What do you see as the emerging threats for 2011

As we move in to the new year, what do you see as the emerging threats for organisational security? I see more chat around; Advanced Persistent Threat (APT) from foreign states. More fines from the ...
2
votes
6answers
360 views

What are possible approaches and arguments for securing corporate IT systems with most computers being portable?

I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
3
votes
1answer
208 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
4
votes
3answers
571 views

Where can I find a collection of Threat Models?

I found a very nice SSL Threat model on this web page and would like to find more on different topics. How would I go about locating more images like these? Is there an organisation or website I ...
26
votes
3answers
2k views

Help me find a lightweight threat modeling framework

We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there ...
6
votes
3answers
371 views

Can you provide loss values on security breaches?

When someone says "why do we need to spend so much money and effort on security, we need to focus on market share first and once someone finds a problem we will fix it", I would like to have a list ...