Questions tagged [risk]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
63 views

What is the impact of someone accidentally getting my IMEI number from my Android phone? [duplicate]

I have a concern regarding how risky it is if someone knows or has the copy of my 2 IMEI numbers. As we all know, on Android phones, the IMEI are at the back cover of the phone like a sticker. So, my ...
0
votes
1answer
44 views

Safety assessment vs. Security assessment. What's the difference?

The safety requirement confuses me when I look at security risk assessment methodologies. Looking at safety alone, it usually is related to the physical aspect and the physical interactions between a ...
0
votes
1answer
61 views

Risk Assessment of Windows Cert Store

We all know that SmartCards protect private keys much better than any software-based solution. However, when it comes to the Windows Cert Store to be compared to SmartCards: how difficult is it for ...
0
votes
1answer
89 views

What are the risks of allowing general users to add printers to their company laptops?

I work for a company with a large user base. There is a requirement to allow users to add printers to their laptops e.g. when working from home. What are the security risks? Is their a bad actor can ...
1
vote
0answers
45 views

Do i place this service in the DMZ or datacentre(internal)?

I have setup a VM on our internal network and it is assigned an internal IP address. The VM requires connectivity to a couple of internet sites mainly Microsoft and ports are generally 80 and 443. ...
1
vote
2answers
123 views

A 3rd party supplier is asking us to install their VPN client onto our corporate machines to enable access to their environment, is this a good idea?

As per the question what are the risks? if we did go ahead with this and some of our users installed a supplier's VPN client on to our corporate machines, once the connection is establish can a threat ...
3
votes
2answers
202 views

How to estimate threat and risk associated with that threat and not only vulnerability severity?

Having this simple formula Risk = Threat x Vulnerability x Information Value it is quite difficult to estimate risks quantitatively because of threat estimation seems to me the most difficult part. I ...
1
vote
1answer
90 views

What is the risk of using Windows Phone 8.1 now?

My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the ...
39
votes
14answers
7k views

How to safely save passwords for a future administrator?

I am the volunteer IT administrator for a local non-profit organization. The organization has a few systems - specifically security cameras, network hardware, and telephones - that have local ...
1
vote
1answer
96 views

Font risk in unopened email in inbox

This is obviously not from PayPal, but the font in the word account displayed using odd looking font, is this a security risk to me that Outlook.com displayed this font? See below, Outlook has preview ...
3
votes
1answer
91 views

Why are full port scans more susceptible to being logged than half-open port scans?

Many resources I come across state that one major advantage of full-port scans (e.g. SYN scans) is the fact that there is a lower risk of being logged. But why? In my opinion, the sequence of ...
0
votes
0answers
49 views

Risk, threat, vulnerability with an example

Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate: Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
-2
votes
1answer
109 views

Upgrading Software Version: risk of an unknown vs known vulnerabilities

Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software? For example, with every software ...
1
vote
1answer
282 views

vulnerability management, risk mitigation vs risk acceptance

I was involved in a conversation concerning the in-house vulnerability management program. One the statements made was that the management is generally not willing to accept risk and it should be ...
1
vote
2answers
143 views

Security of using DHCP and non-standard ports for medical devices

I recently came across this comment written in a journal article. Lastly, medical apparatus are expected to use Dynamic Host Configuration Protocol (DHCP) for the allocation of their IP ...
2
votes
2answers
319 views

CVSS and chained vulnerabilities

Let's say a website has two vulnerabilities: Information Disclosure reflected XSS Their impact by themselves is limited on the specific site, but when chained together, the impact is raised too high ...
2
votes
1answer
72 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
0
votes
2answers
353 views

risk threat vulnerability

From ENISA - Threat and Risk Management Identification, analysis and evaluation of these threats and vulnerabilities are the only way to understand and measure the impact of the risk involved ...
2
votes
1answer
357 views

Sqlmap, update query and risk param

I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
4
votes
1answer
5k views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
1
vote
2answers
263 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
1
vote
1answer
407 views

Risk assessment Struggling with scenario

I have been given a situation (see below),The question i need to answer to complete the task is: What is the ALE for phishing emails for the company, in pounds; e.g. 203,760? When i multiply the ...
1
vote
0answers
89 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
-1
votes
1answer
143 views

Does Bloatware on a brand new PC create security risks?

Some new computers come with software I don't need or want. It is not advertised as part of the product I am purchasing. Generally this is called Bloatware. Bloatware 1.(n) Software that comes pre-...
0
votes
2answers
218 views

Risk of infecting the host OS if the guest OS is out of date [duplicate]

I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...
1
vote
2answers
176 views

Storing customer data securely (compliance)

I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do. ...
0
votes
1answer
85 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
0
votes
1answer
129 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
4
votes
1answer
138 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
1
vote
3answers
3k views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
3
votes
0answers
61 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
3
votes
1answer
823 views

Is allow_url_fopen always a security risk?

Is allow_url_fopen always a security risk or only when you let others to insert URL? like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
2
votes
1answer
137 views

What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?

There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
2
votes
4answers
4k views

Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)

How do I express non-compliance to ISO 27002 chapter 5 as a risk? The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
11
votes
1answer
1k views

Security risks replying to emails using a personal account

I happen to have a very common name. I own the corresponding gmail account @gmail.com and I regularly receive emails meant for someone else. Because they very often seem to contain important ...
2
votes
2answers
126 views

What is the boundary between Information Security and Quality Control regarding Integrity?

I was in a recent dispute with the CIO regarding this (I work as an InfoSec Officer). There was an issue when one of our devs published erroneous code in production due to user error (copy-paste sort ...
3
votes
1answer
209 views

What is the risk of reusing the ATM Pin elsewhere when they tie to EMV cards?

What is the risk in the following scenario: A bank wants to use an ATM pin (debit card and/or credit card) as an additional form of authentication after the customer logs in to her online/mobile ...
4
votes
3answers
460 views

Are revealed personal emails a security risk?

I am a minor recently employed by a retail company, in the same batch as 10* other new recruits. I have not yet had the first day, however our manager has sent us all a warm welcoming email. The ...
1
vote
1answer
55 views

Does a PC with many NIC's can create vulnerabilities for each network wihich it is connected?

I wonder if installing 2 more (USB to Ethernet) NICs to my PC can be risky if I need that only my PC can access to the three networks, and no any other host in these networks... Could my PC act like a ...
1
vote
0answers
26 views

Recommended number of ssytems under an ISSO

Is there an optimum number of systems an ISSO should be responsible for? I realize system size and complexity come into play but assuming most are large and of moderate risk, etc. is there a number ...
0
votes
2answers
3k views

Hardware / firmware backdoors : TPM as a security risk - How to turn it into security advantage?

--- Question: What are the exact risks of using TPM 2.0 or owning this integrated chip? In what circumstances? What are the solutions to minimize risks? Details: My primary goal was to try to find ...
2
votes
1answer
2k views

What does the EC_POINT_FORMAT TLS extension protect against and what is the risk of not using it?

The SSL test of htbridge pointed out that the server supports the elliptic curves but not the EC_POINT_FORMAT TLS extension. What does that TLS extension protect against? What is the (potential) risk ...
0
votes
1answer
90 views

Debug every process to reduce the risk of successful malware attack?

I've seen that quite a bit of malware (particularly ransomware) checks for a debugger and bails if one is found. Would it (a) be practical and (b) reduce the risk of a successful malware attack if ...
-1
votes
3answers
163 views

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
3
votes
1answer
334 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
1
vote
1answer
511 views

Security risks of multitenancy

Is there a security risk of using same firewall hardware as the company perimeter firewall device (providing multi-tenancy) which is already shared by other companies? Is there a possibility of being ...
0
votes
1answer
2k views

I used 10minutemail and my own phone number, is there a risk?

I created a twitter account and used 10minuteemail, then twitter said my account was having automated behaviour, so I searched a temporary fake number to use but for the sake of lazyness I just put my ...
6
votes
2answers
915 views

What are the security benefits or risks of HTTP/2?

Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
2
votes
1answer
85 views

Any risks of reading arbitrary emails in HTML format?

Emails can be sent with email software (via corresponding setting of a parameter in the software) in HTML format instead of the normal text format. Are there any risks of reading arbitrary (malicious) ...
1
vote
1answer
165 views

How does someone conduct a risk assessment of a B2B Integration?

I'm not very familiar with B2B integrations. No one in our small organization is, but we need to conduct some assessments. How does one assess a B2B integration? It seems like there would be gaps ...