Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [risk]

The tag has no usage guidance.

1
vote
2answers
66 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
1
vote
1answer
138 views

Risk assessment Struggling with scenario

I have been given a situation (see below),The question i need to answer to complete the task is: What is the ALE for phishing emails for the company, in pounds; e.g. 203,760? When i multiply the ...
1
vote
0answers
47 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
-1
votes
1answer
91 views

Does Bloatware on a brand new PC create security risks?

Some new computers come with software I don't need or want. It is not advertised as part of the product I am purchasing. Generally this is called Bloatware. Bloatware 1.(n) Software that ...
0
votes
2answers
89 views

Risk of infecting the host OS if the guest OS is out of date [duplicate]

I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...
1
vote
2answers
62 views

Storing customer data securely (compliance)

I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do. ...
0
votes
1answer
49 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
0
votes
1answer
89 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
2
votes
0answers
91 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
1
vote
3answers
486 views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
2
votes
0answers
43 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
3
votes
1answer
258 views

Is allow_url_fopen always a security risk?

Is allow_url_fopen always a security risk or only when you let others to insert URL? like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
2
votes
1answer
118 views

What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?

There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
2
votes
4answers
1k views

Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)

How do I express non-compliance to ISO 27002 chapter 5 as a risk? The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
11
votes
1answer
802 views

Security risks replying to emails using a personal account

I happen to have a very common name. I own the corresponding gmail account @gmail.com and I regularly receive emails meant for someone else. Because they very often seem to contain important ...
2
votes
2answers
81 views

What is the boundary between Information Security and Quality Control regarding Integrity?

I was in a recent dispute with the CIO regarding this (I work as an InfoSec Officer). There was an issue when one of our devs published erroneous code in production due to user error (copy-paste sort ...
3
votes
1answer
146 views

What is the risk of reusing the ATM Pin elsewhere when they tie to EMV cards?

What is the risk in the following scenario: A bank wants to use an ATM pin (debit card and/or credit card) as an additional form of authentication after the customer logs in to her online/mobile ...
5
votes
3answers
149 views

Are revealed personal emails a security risk?

I am a minor recently employed by a retail company, in the same batch as 10* other new recruits. I have not yet had the first day, however our manager has sent us all a warm welcoming email. The ...
1
vote
1answer
38 views

Does a PC with many NIC's can create vulnerabilities for each network wihich it is connected?

I wonder if installing 2 more (USB to Ethernet) NICs to my PC can be risky if I need that only my PC can access to the three networks, and no any other host in these networks... Could my PC act like a ...
1
vote
0answers
16 views

Recommended number of ssytems under an ISSO

Is there an optimum number of systems an ISSO should be responsible for? I realize system size and complexity come into play but assuming most are large and of moderate risk, etc. is there a number ...
0
votes
2answers
998 views

Hardware / firmware backdoors : TPM as a security risk - How to turn it into security advantage?

--- Question: What are the exact risks of using TPM 2.0 or owning this integrated chip? In what circumstances? What are the solutions to minimize risks? Details: My primary goal was to try to find ...
1
vote
1answer
721 views

What does the EC_POINT_FORMAT TLS extension protect against and what is the risk of not using it?

The SSL test of htbridge pointed out that the server supports the elliptic curves but not the EC_POINT_FORMAT TLS extension. What does that TLS extension protect against? What is the (potential) risk ...
0
votes
1answer
77 views

Debug every process to reduce the risk of successful malware attack?

I've seen that quite a bit of malware (particularly ransomware) checks for a debugger and bails if one is found. Would it (a) be practical and (b) reduce the risk of a successful malware attack if ...
-1
votes
3answers
130 views

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
3
votes
1answer
156 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
1
vote
1answer
400 views

Security risks of multitenancy

Is there a security risk of using same firewall hardware as the company perimeter firewall device (providing multi-tenancy) which is already shared by other companies? Is there a possibility of being ...
0
votes
1answer
1k views

I used 10minutemail and my own phone number, is there a risk?

I created a twitter account and used 10minuteemail, then twitter said my account was having automated behaviour, so I searched a temporary fake number to use but for the sake of lazyness I just put my ...
6
votes
2answers
682 views

What are the security benefits or risks of HTTP/2?

Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
2
votes
1answer
65 views

Any risks of reading arbitrary emails in HTML format?

Emails can be sent with email software (via corresponding setting of a parameter in the software) in HTML format instead of the normal text format. Are there any risks of reading arbitrary (malicious) ...
0
votes
1answer
80 views

How does someone conduct a risk assessment of a B2B Integration?

I'm not very familiar with B2B integrations. No one in our small organization is, but we need to conduct some assessments. How does one assess a B2B integration? It seems like there would be gaps ...
1
vote
0answers
46 views

Multiple Frameworks for Risk Assessments?

My organization utilizes Risk Assessments as the catalyst for a lot of our Information Security efforts. Currently we assess applications using the cloud security alliance's CAIQ framework and ...
2
votes
1answer
480 views

Can information security risks essentially only be triaged according to the CIA triangle?

Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
1
vote
1answer
73 views

Reducing risk from logging

I am following the OWASP Risk methodology and have the threat "Installed software exploitation". I've created this risk based on the idea that a risk is found in say phpMyAdmin which can be exploited. ...
5
votes
2answers
2k views

What is the security risk of enabling persistent connection (HTTP Keep-Alive)?

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is ...
0
votes
1answer
105 views

Dilbert's Pointy-Haired Boss & Influencing executive perspectives on Information Security

In Scott Adam's cartoon Dilbert the Pointy-haired Boss has no name because Scott Adam's wanted his readers to relate the boss character to bosses known to the readers. This is pointed out because (...
1
vote
3answers
464 views

Risk Assessment Methodology ISO 27001

I would like to apply ISO 27001 best practices for a company that has not completed its final online architecture yet and it is still under development phase. However, they pretty much know which ...
4
votes
1answer
163 views

Should a user be able to reset his password if his email address has not been verified yet?

Please consider a scenario where a user signs up for a web application with his email and password. After registration the user is sent a confirmation email which requires a login/session to confirm ...
1
vote
1answer
77 views

Risk in FTP connect

excuse me the question perhaps beginner, but came out a doubt. One person asked me to edit your site, but it was very strange story and did not know this person yet ... When I connect me by filezilla, ...
0
votes
1answer
58 views

What is the risk of unlimited email event triggering?

Let's say I can trigger a mail event in a few scenario's without any a limit on that trigger. For example at: Registration Password reset Newsletter subscription The "registration" and "newsletter ...
2
votes
2answers
2k views

Do high-level programming languages have more vulnerabilities or security risks than low-level languages? [closed]

Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why? Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/...
1
vote
1answer
550 views

How do companies deal with storing their source code on GitHub from a data-loss risk management point-of-view? [closed]

When it comes to storing my data "in the cloud" (aka: on someone else's server), I alway have kind of a bad feeling that something like "Google's deleted an artist's blog, along with 14 years of his ...
0
votes
1answer
85 views

Is there a way to calculate the complexity of an XSS-vector?

Is there a way to calculate/estimate the complexity of an XSS vector? I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
21
votes
7answers
10k views

Is malware distributed with pirated software actually common?

An often-repeated piece of conventional wisdom goes like the following. Don't download pirated software, they often contain malware. I'm curious to know if there are any hard facts to backup this ...
2
votes
4answers
845 views

Is there more of a security risk by providing an email when creating a new account?

With all of these recent breaches, I have been thinking about security best practices. One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
2
votes
1answer
239 views

How to overcome the risk of account being compromised using OTP when mobile device is stolen

What is the preferred way to provide a "password reset" functionality for an application installed on a mobile device? In mobile applications, generally password reset works by sending OTP to the ...
0
votes
2answers
94 views

Is exposing the default plesk page dangerous?

Is exposing the default plesk page on an IP dangerous? I can imagine it is somehow usable for fingerprinting a version maybe. But is it dangerous anyhow?
1
vote
1answer
140 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...
13
votes
7answers
2k views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
3
votes
2answers
3k views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
18
votes
7answers
3k views

Can I trust DNS servers?

If I use my own VPN and use third party DNS - can I trust it? For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...