Skip to main content

Questions tagged [metrics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3 votes
2 answers
1k views

CVSS3 score for XSS leading to account takeover

Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
mateleco's user avatar
  • 110
0 votes
0 answers
118 views

Identify hosts that are serving specific metric on Shodan

Using things like Shodan and Zoomeye we can find tens of thousands of exposed Prometheus endpoints with queries like service:prometheus port:9090 etc.. Now let's say we know that there are entities on ...
vl.b's user avatar
  • 1
2 votes
2 answers
238 views

Why do entropies of passwords significantly differ from site to site?

I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from ...
xk58945's user avatar
  • 21
0 votes
1 answer
286 views

Kubernetes user impersonation to obtain exec privileges

I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
SarahAlexa's user avatar
1 vote
2 answers
235 views

CVSS Temporal guidance

I've recently been given a set of guidance notes on CVSS; but the guidance isn't making sense. I've sent a query off, but got no response. So asking here. Say you have an exploit (can ignore base for ...
Amiga500's user avatar
  • 142
1 vote
1 answer
277 views

Malware Threat Hunting in Airport Systems - KPIs/Metrics to Track [closed]

I am trying to figure out how to detect potential threats from malwares in various systems installed in the airport. To be specific, my focus is on the following systems in airports: Baggage ...
SamRoy's user avatar
  • 111
2 votes
1 answer
156 views

Gather system metrics securely from infected VM

I intend to train an RNN on snapshots of the VM metrics to classify malware. I will, therefore, run hundreds of different pieces of malware inside that VM. It has been isolated from my host (as best ...
Cobalt Scales's user avatar
3 votes
2 answers
896 views

Why can't a Tor node simultaneously be a guard and an exit node?

By looking at probability graphs for nodes at metrics.torproject.org, it seems that exit nodes can't also be guards (they have 0.0000% probability of serving as guard) and vice versa. Why is that so?
white_poppy's user avatar
4 votes
2 answers
2k views

How do I measure compliance to Information security policies?

I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
Katlego M's user avatar
1 vote
0 answers
226 views

Quantifying security with metrics

I am working on a state-of-the-art quantification of security, meaning a numerical assessment of security for a system. In my research, most of the work is not recent (up to 2012 so far) and is ...
Ecterion's user avatar
  • 103
0 votes
3 answers
647 views

What are some metrics to be used to evaluate SaaS security?

What are some metrics to be used to evaluate a SaaS app's security? Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it ...
Blaze's user avatar
  • 374
5 votes
2 answers
5k views

"Triage an incident"

I have been trying to find a definition of triage in relation to Information Security but cannot find any online. From the different examples given online (i.e. medical world), it seems related to ...
user92592's user avatar
  • 554
1 vote
1 answer
180 views

why don't we measure the strength of crypto against the cost it would take to crack it? [closed]

I hear all the time how many hours it would take to break a certain type of encryption. I think this may be the wrong metric to look at ever since scaling became an easy to implement solution. Sure ...
codykochmann's user avatar
3 votes
2 answers
690 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected by ...
boos's user avatar
  • 1,066
6 votes
1 answer
1k views

Can OSSTMM RAVs be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000?

The calculation of RAVs in OSSTMM seem very useful as a security metric but, can they be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000? ISO 27001:2013 ...
kinunt's user avatar
  • 2,799
0 votes
1 answer
833 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?
QuachTT's user avatar
  • 11
5 votes
3 answers
2k views

security performance criteria in employee reviews

Have any of you security professionals been able to get security performance metrics into reviews that managers conduct for their employees? If so, are there any helpful resources you could share to ...
user35603's user avatar
9 votes
4 answers
3k views

How to estimate the cost of an application vulnerability?

I've seen data on the cost of a breach including lot of surveys and research by Verizon and the Ponemon Institute. But in terms of an actual vulnerability, what are the factors to consider to ...
Epoch Win's user avatar
  • 932
2 votes
2 answers
452 views

What fraction of software bugs are vulnerabilities?

What fraction of software bugs are security vulnerabilities? Obviously, software bugs can be security vulnerabilities -- but also obviously, many software bugs have little or no security impact. Is ...
D.W.'s user avatar
  • 100k
-1 votes
1 answer
159 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
dreftymac's user avatar
  • 371
3 votes
2 answers
285 views

Commonly observed attack patterns modelled in Honeypot configurations

(Judging by voting and answers, I failed rather badly at asking a question that in my head was superbly clear. Clearly I was wrong. I've since attempted to rephrase the original question to more ...
Christoffer's user avatar
  • 1,040
8 votes
2 answers
7k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
Jordan Reiter's user avatar
6 votes
2 answers
4k views

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
jvff's user avatar
  • 61
14 votes
4 answers
883 views

How do you estimate the costs of a security breach?

I'm a student and fairly new to the IT security field. Most articles and books say you should only patch a vulnerability if the costs of a breach are higher than the costs of patching the ...
StupidOne's user avatar
  • 2,822
7 votes
2 answers
653 views

What key metrics should a CIO rely on to gauge the extent of IT risk exposure?

Note - This was originally asked in another Area51 proposal, which has since been deleted.
AviD's user avatar
  • 73.4k