Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [risk-analysis]

Risk Analysis is a practice used to identify and assess factors that may jeopardize the success of a project or achieving a goal. Security Risk Analysis or Risk Assessment could be Quantitative and Qualitative

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

Cyber Risk Management Strategy Implementation

I’m developing a Risk Management Implementation strategy for my small SaaS organization, and I’d appreciate your feedback on the soundness of the approach outlined below. We’re hosted in the cloud, ...
karan bhandari's user avatar
3 votes
2 answers
392 views

Why would one use radio instead of the Internet for secure communications?

This question is inspired by someone's comment on this question elsewhere In the modern era of Internet and encryption it's quite surprising that countries like Russia still regularly use coded radio ...
mustaccio's user avatar
  • 182
0 votes
1 answer
167 views

Threat and risk analysis of Microsoft Teams

I look on all the corporations and firms that have embraced Microsoft Teams in the past and I can not stop wondering if it is a disaster waiting to happen or if I am missing something important. We ...
Marek Puchalski's user avatar
1 vote
0 answers
95 views

How does a risk assessment for an EU project look like?

I have to add provide a draft of a risk assessment for a small EU project. As I've never done this, I struggle with identifying assets or vulnerabilities. I'm aware of very general lists, but I wonder ...
sk904861's user avatar
  • 111
0 votes
1 answer
146 views

Are there any downsides to publically available encrypted data?

I have a key-value database that uses asymmetric RSA-OAEP encryption to encrypt the data. The data is stored in tuples of (public key, encrypted data). The user identifies their data by the public key,...
willuhmjs's user avatar
2 votes
1 answer
231 views

Is it dangerous to publicly surf the web while my browser is being run in an IDE?

While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode: { // Use IntelliSense to learn about possible attributes. // Hover to ...
Nathan Goings's user avatar
1 vote
1 answer
148 views

Security Implications of Automatic Updates?

I have a custom Debian router installation which I'm trying to keep both secure and low-maintenance. I've therefore set some scripts which keep my Docker containers, blocklists, and OS (security ...
Synthetic Ascension's user avatar
1 vote
0 answers
313 views

What would be the security rationale for a hotel blocking only SSH traffic? [closed]

I recently stayed at a hotel where outbound SSH traffic (and seemingly only SSH traffic) was blocked on the guest WiFi network, and I'm trying to figure out what security-based rationale they might ...
Psychonaut's user avatar
-1 votes
1 answer
102 views

What is meant with "initial" in Initial Likelihood of risk scenario?

I m doing a Risk analysis according to an information security risk management guideline and in the risk assessement table there was a column called "initial Likelihood of risk scenario". ...
Zorghost's user avatar
2 votes
0 answers
97 views

To what extent should security measures be ignored for the sake of operational efficiency? [closed]

I have recently started creating an online Tetris type of game, and I was wondering what amount of security I should implement for an online match. I am in a conflict where I want to make my game as ...
Hentoad1's user avatar
2 votes
0 answers
239 views

Is using a second hand/grey market phone for banking security a credible risk?

I asked this question in money about telling my bank about using a second hand or grey market mobile phone. The the implication of some of the comments is that any worry is misplaced. It seems to me ...
User65535's user avatar
  • 151
4 votes
2 answers
292 views

Likelihoods for risk assessment

I have been looking at risk assessments lately and I am looking for a way to practically estimate likelihood. Most people recommend assessing based on historical precedent which sounds great to me, ...
Mattey's user avatar
  • 57
0 votes
1 answer
153 views

Safety assessment vs. Security assessment. What's the difference?

The safety requirement confuses me when I look at security risk assessment methodologies. Looking at safety alone, it usually is related to the physical aspect and the physical interactions between a ...
NoRel's user avatar
  • 1
0 votes
1 answer
151 views

How to use pre-existing threat catalogue to determine if a certain system is vulnerable?

There are many risk assessment guidelines such NIST800-30 and ISO 27005 that provide a catalogue of known threats as reference. Using a qualitative approach, I selected one threat events catalogue and ...
NoRel's user avatar
  • 1
0 votes
0 answers
130 views

How to understand risk of a hosting ISP private network?

I am trying to understand the security concerns related to using the private network provided by my hosting ISPs. The ISPs offer a private network feature that only my VPS instances are connected to. ...
Paul's user avatar
  • 131
7 votes
4 answers
578 views

Realistically, how likely it is to have a computer compromised from browsing random websites?

Another question inspired by a recent discussion in the 'The DMZ' chatroom. Long story short: IT guys are worried that accountants' workstations may become compromised because accountants watch cat ...
gaazkam's user avatar
  • 6,017
0 votes
1 answer
139 views

Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment

Background: We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer. Previous models had certs issued by a different CA and that CA cert was published, ...
AnyDev's user avatar
  • 103
0 votes
2 answers
274 views

What are the differences between "identifying threats and vulnerabilities" and "risk management"?

I am struggling to appreciate the differences between the 7 steps of the NIST Framework for Improving Critical Infrastructure, which should help an organisation implement it. Step 1: Prioritize and ...
Beginner's user avatar
1 vote
2 answers
182 views

Why practical risk analysis tutorials do not exists?

To says things simple ; when someone wants to learn offensive web application (or system) hacking, one could just download OWASP DVWA or register to Hackthebox and watch Ippsec videos to see "how ...
Jason Krs's user avatar
  • 379
1 vote
0 answers
189 views

Threat Modeling and Risk Assessment Effort Estimation [closed]

is there any way to have a good effort time estimation of a Threat Modeling and Risk Assessment activity for an internal infrastructure (about 30 active nodes)? In general, is it possible to find a &...
giper's user avatar
  • 11
0 votes
1 answer
114 views

can vulnerabilities be treated differently based on ceratin circumstances? [duplicate]

We are running vulnerability scans on our systems. I can see a few XSS vulnerabilities being reported, such as CVE-2020-14173. Let me quote: The file upload feature in Atlassian Jira Server and Data ...
cyzczy's user avatar
  • 1,588
0 votes
1 answer
226 views

Are security controls themselves considered assets (e.g., cryptographic keys)

Looking at a plain system (there are no security controls implemented yet), we need to think about its functions and derive appropriate assets which we'd like to protect in order to ensure the system ...
smoothware's user avatar
3 votes
2 answers
930 views

Preventing HTTPS Replay Attacks

I've read here that HTTPS replay attacks aren't possible from MITM attacks but I want to be sure that it's not saying that HTTPS replay attacks aren't possible at all. I want to know if I have to ...
user avatar
0 votes
2 answers
198 views

Measuring the Risk of Not Managing Risk

I've seen scenarios in which organizations don't invest enough in cybersecurity, are short-handed, and thus have a difficult time meeting the policy requirements defined within their Security Programs....
theoneandonly2's user avatar
-2 votes
1 answer
202 views

Upgrading Software Version: risk of an unknown vs known vulnerabilities

Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software? For example, with every software ...
8protons's user avatar
  • 218
3 votes
4 answers
498 views

Risk of web admin portal without extra authentication steps

more of a philosophical question, suppose there is one behavior which allows an attacker to do something with high impact but by itself cannot be used to cause that impact. For example, internet ...
thevpt's user avatar
  • 31
0 votes
2 answers
2k views

What are the risks from letting users share their own calendars?

I've worked for a variety of technologies companies. In working for startups I've noticed a wide variety of opinions about whether sharing calendars is a security risk. I can imagine that it would ...
chicks's user avatar
  • 145
1 vote
1 answer
214 views

How to protect network equipment in public spaces?

I'm curious whether there are standards or recommended best practices to protect network equipment that has to be left unattended and outside (of a secure data-center environment) for example for ...
bfloriang's user avatar
  • 205
1 vote
1 answer
278 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
Fire Quacker's user avatar
  • 2,432
2 votes
1 answer
512 views

Network with one possible unsecure device and one home assistant device

Background: I have a google home and I plan to buy 1 or 2 cheap cameras to monitor my home when I'm not in it. I plan to have the camera connected to a wifi plug, so I can switch it off via the app ...
Nigel Fds's user avatar
  • 463
2 votes
2 answers
437 views

Prey vs SSH for remote wipe of stolen laptop under Ubuntu

I have to be able to wipe a stolen laptop remotely (contractual obligation), and the only product I found that supports that on Ubuntu is Prey Project. (Also appears in some other stack exchange ...
Attilio's user avatar
  • 179
7 votes
1 answer
489 views

What theoretical risks are posed by compromised 5G infrastructure?

A certain large Asian company and leader in 5G infrastructure has recently been accused of being compromised by its authoritarian government. Aside from the fact that it's nearly impossible to audit ...
Jordan Rieger's user avatar
6 votes
3 answers
232 views

Security Testing Methods for Enterprise Level

I have been asked to perform risk assessment for a company. The scope covers about 100 applications and in various business units. Major task is to assess currently implemented security controls and ...
ray bash's user avatar
1 vote
2 answers
204 views

How to create non-generic security requirements for an idea phase?

Our manager often asks us for a quick understanding of what the risks will be based on some idea that the department has been working on during the ideation phase (the business requirements are ...
Filipon's user avatar
  • 1,294
-1 votes
2 answers
351 views

Potential risks per ISO 27002 clauses 5-18

I have a study project related to establishing of ISO 27001. I will do GAP analyses on "fictional" company over all ISO 27001 Annex A controls using ISO 27002. After I do that, I will detect the ...
OrangeSpider's user avatar
1 vote
1 answer
225 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
Jaya Anand V's user avatar
2 votes
1 answer
683 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
Hardik Modha's user avatar
1 vote
1 answer
2k views

Is this the correct way to calculate value of safeguards in risk management?

An investigation by the Information Security department has shown that the cost of rectifying a website damaged by a hacker is about Rs. 200k per incident. Available records (over the last ten ...
uma's user avatar
  • 183
1 vote
1 answer
272 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
sgres's user avatar
  • 129
1 vote
2 answers
969 views

CVSS3.0 impact score and exploitability score

I'm having some trouble calculating CVSS v3.0 scores in some findings I've encountered. In particular, one finding is a simple server information disclosure via default error pages. It is very ...
user1118764's user avatar
38 votes
8 answers
13k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
Ooker's user avatar
  • 1,591
11 votes
3 answers
536 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
Filipon's user avatar
  • 1,294
2 votes
1 answer
195 views

Should we change risk appetite when we go on a digital transformation journey?

Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms. There are arguments in our Information Security team regarding 'Risk ...
Sayan's user avatar
  • 2,031
1 vote
1 answer
307 views

Are unbranded home security camera secure? [closed]

I plan on buying a couple of cheap cameras for my home. I plan to put them just inside the doors like the laundry door, I won't be putting them in the bedroom or living room. My major concern is how ...
Nigel Fds's user avatar
  • 463
91 votes
15 answers
16k views

How to deal with low-probability high-impact risks?

There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this: There is a type of attack against our systems that can cause a lot of ...
David Bryant's user avatar
  • 1,139
9 votes
3 answers
3k views

Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?

The outdated DREAD risk model (wikipedia) lists Discoverability as a criteria for judging the severity of a vulnerability. The idea being that something which is not publicly known and you would be ...
Mike Ounsworth's user avatar
4 votes
1 answer
198 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
Forced Port's user avatar
1 vote
1 answer
160 views

Operation Prowli Malware Infects Over 40,000 Machines

Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected. Still no CVE data updated on CVE site regarding the relevant vulnerability. ...
Sayan's user avatar
  • 2,031
6 votes
2 answers
353 views

What is as CISOs job, exactly?

The company I work for (kind of a startup) can't afford a full-time chief information security officer (CISO). So the boss is asking the security aware people in the team to work together to do a ...
Bytemare's user avatar
  • 163
1 vote
3 answers
3k views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
Sublime1914's user avatar