Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [risk-analysis]

Risk Analysis is a practice used to identify and assess factors that may jeopardize the success of a project or achieving a goal. Security Risk Analysis or Risk Assessment could be Quantitative and Qualitative

0
votes
1answer
27 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
2
votes
1answer
46 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
1
vote
1answer
42 views

Is this the correct way to calculate value of safeguards in risk management?

An investigation by the Information Security department has shown that the cost of rectifying a website damaged by a hacker is about Rs. 200k per incident. Available records (over the last ten ...
1
vote
1answer
31 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
1
vote
2answers
64 views

CVSS3.0 impact score and exploitability score

I'm having some trouble calculating CVSS v3.0 scores in some findings I've encountered. In particular, one finding is a simple server information disclosure via default error pages. It is very ...
33
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
10
votes
3answers
368 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
2
votes
1answer
45 views

Should we change risk appetite when we go on a digital transformation journey?

Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms. There are arguments in our Information Security team regarding 'Risk ...
1
vote
1answer
134 views

Are unbranded home security camera secure? [closed]

I plan on buying a couple of cheap cameras for my home. I plan to put them just inside the doors like the laundry door, I won't be putting them in the bedroom or living room. My major concern is how ...
89
votes
15answers
14k views

How to deal with low-probability high-impact risks?

There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this: There is a type of attack against our systems that can cause a lot of ...
9
votes
3answers
2k views

Is “Discoverability = low” an acceptable reason to reduce the risk of a vulnerability?

The outdated DREAD risk model (wikipedia) lists Discoverability as a criteria for judging the severity of a vulnerability. The idea being that something which is not publicly known and you would be ...
2
votes
0answers
70 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
1
vote
1answer
90 views

Operation Prowli Malware Infects Over 40,000 Machines

Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected. Still no CVE data updated on CVE site regarding the relevant vulnerability. ...
5
votes
2answers
210 views

What is as CISOs job, exactly?

The company I work for (kind of a startup) can't afford a full-time chief information security officer (CISO). So the boss is asking the security aware people in the team to work together to do a ...
1
vote
1answer
273 views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
2
votes
0answers
41 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
3
votes
1answer
59 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
1
vote
1answer
83 views

What are the risks of having your data targeted precisely because you try to hide it?

I'm trying to be more careful about my personal data, that I plan to back up using some secure online storage service. I'm looking at several encrypted services that are a much better alternative than ...
4
votes
1answer
92 views

Which questions should be asked when evaluating the risk of a policy exception?

I've been tasked with updating my department's exception request form, and I am trying to come up with YES/NO questions that can be scored to determine the risk of the request. I am having trouble ...
33
votes
7answers
5k views

What are the real physical risks of casual social media publishing?

aka "how to scare my family into stopping publishing their life online?" I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
5
votes
2answers
1k views

WireGuard: what's wrong with this automatic IP assignment

WireGuard is extremely simple and fast kernel-space VPN based on modern cryptography. I want to use it in production and need automatic IP assignment for new peers. The project provides two short ...
0
votes
1answer
123 views

Using OWASP Top 10 for assigning vulnerability severity in a security assessment

In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are ...
6
votes
1answer
2k views

WireGuard VPN: how safe is it for production in its current state?

In our project we had to build a VPN to get through to computers residing behind NAT. I never did it before. While looking for suitable software I came across WireGuard which claimed to be very simple....
0
votes
2answers
71 views

Is there a CVE or CVSS for enumeration of ports?

Lets say that there is a company which does not have a firewall and it is possible to perform an enumeration of ports and services. Could it be considered a vulnerability if it provides ...
2
votes
2answers
48 views

Web servers with different risk models in same network

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault). We are creating a network architecture and have 2 webservers. One ...
1
vote
2answers
41 views

According to the risk assessment theory, is this expenditure appropriate?

Consider the following scenario: A company has a database server whose value, information and equipment, is approximately $200 000. When the manager has checked up the literature regarding this type ...
0
votes
2answers
349 views

Risks and challenges of an online voting system. Any recent updates? [closed]

I'm studying and preparing a document for implementing an online voting system (internet based system) which can be used for governmental voting purposes. I would like to ask for your advise and ...
0
votes
0answers
34 views

Risk to consider when using SNMP [duplicate]

I'd like to know what kind of risks are are arising from the following kind of connection and how to combat them: For testing purposes I'd need to connect via SNMP from a dedicated test VLAN(multiple ...
0
votes
0answers
50 views

Modeling for security analysis

I am doing a PhD in design for cybersecurity / safety domain and I am having troubles to put the correct words on an idea I had. Given some threats against a system, let's assume we have identified ...
1
vote
1answer
42 views

What are the risks associated with storing sensitive information inside of an encrypted container on a system without FDE?

Are there risks that are specific to working with an encrypted container on a system that does not have full disk encryption? Could programs running outside of that container cache or store parts of ...
6
votes
2answers
256 views

How to calculate the risk rating of a feature?

I'm working on a threat modeling/architectural risk analysis (ARA) methodology for the organization I work for. Our business consists of one major product (developed by ~500 developers over a decade). ...
-1
votes
3answers
123 views

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
0
votes
1answer
125 views

What are the most common security threats that have to be considered when dealing with RDP? [duplicate]

I'm dealing with a hypothetical infrastructure for enabling workers to use RDP for remote access to their work PCs. These would be virtualized Win7 machines within a VMWare vSphere environment. ...
-1
votes
1answer
73 views

Can browser emulation create vulnerabilities?

If a browser is not authorized on a network, can browser emulation within an authorized browser create vulnerabilities? For instance, Chrome is unauthorized but if I run IE, press F12 to get into ...
3
votes
1answer
130 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
2
votes
1answer
180 views

How likely is an attack for a known OTA ring 0 vulnerability in mobile devices?

Following on from this question about a WiFi OTA vulnerability: assume a popular computing platform has a known vulnerability that would allow creation of a worm with access to ring 0 (kernel). Then, ...
3
votes
1answer
496 views

How to Audit an Email System

I am working on an auditing process for my company's email system (Exchange 2010). From this process, we're hoping to expand it out to other systems and start to clean up the rampant security issues ...
56
votes
11answers
9k views

Why is it bad to connect internal systems to the Internet?

We have an intranet system we use to book, track and process invoices for our core business. My boss would like to move this system to the Internet to make it "accessible everywhere". However, I feel ...
4
votes
3answers
332 views

Information Security Risk Analytics

The company where I work at is evaluating different risk analytics solutions to purchase, but one of the security guys introduced the idea to actually build our own internal platform/engine. I have ...
2
votes
1answer
368 views

Can information security risks essentially only be triaged according to the CIA triangle?

Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
1
vote
1answer
70 views

Reducing risk from logging

I am following the OWASP Risk methodology and have the threat "Installed software exploitation". I've created this risk based on the idea that a risk is found in say phpMyAdmin which can be exploited. ...
0
votes
1answer
103 views

Dilbert's Pointy-Haired Boss & Influencing executive perspectives on Information Security

In Scott Adam's cartoon Dilbert the Pointy-haired Boss has no name because Scott Adam's wanted his readers to relate the boss character to bosses known to the readers. This is pointed out because (...
1
vote
2answers
360 views

Security vs Usability [closed]

When looking at the internet for ways to secure yourself, I normally see that people use weak security because the more secure you become, the lower the usability is. Weak passwords trump strong ...
5
votes
1answer
147 views

Attack tree file format?

Wikipedia lists five software packages for creating/editing/analysing attack trees. These software packages do not seem to have settled, between them, upon an agreed file format for attack trees. ...
0
votes
1answer
88 views

Iso 27K Implementation

Suppose we buy a new cisco router or any IT equipment. How can we employ ISO 27k/NIST 800-37/NIST 800-53 or any other related information security management standards technically? I mean what should ...
1
vote
2answers
309 views

Understanding risk analysis and threat modelling in practice

I am doing research in the security of cloud computing. The purpose of the following questions is to understand the relationship between "risk analysis" and "threat modeling": Do we usually analyze ...
97
votes
10answers
9k views

How to create a company culture that cares about information security?

Hardened Servers, IPS, firewalls and all kinds of defenses cannot solve security problems if people leak information without knowing simply because they're misguided. I already tried to instruct them ...
1
vote
2answers
401 views

Risk Assessment Methodology ISO 27001

I would like to apply ISO 27001 best practices for a company that has not completed its final online architecture yet and it is still under development phase. However, they pretty much know which ...
4
votes
1answer
208 views

Why doesn't CVSSv2 consider XSS to have a confidentiality impact?

From the CVSSv2 specification: SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...
4
votes
2answers
1k views

Why is XSS scored with partial impact to integrity in CVSS V2?

From CVSS v2 complete guide : "SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...