Questions tagged [risk-analysis]

Risk Analysis is a practice used to identify and assess factors that may jeopardize the success of a project or achieving a goal. Security Risk Analysis or Risk Assessment could be Quantitative and Qualitative

Filter by
Sorted by
Tagged with
107
votes
13answers
40k views

Why do sites implement locking after three failed password attempts?

I know the reasoning behind not letting infinite password attempts - brute force attempts is not a meatspace weakness, but a problem with computer security - but where did they get the number three ...
36
votes
5answers
4k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
15
votes
3answers
2k views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce security....
13
votes
3answers
19k views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF (...
14
votes
3answers
553 views

What risk analysis methodologies should I use?

I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...
5
votes
1answer
192 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
7
votes
2answers
2k views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
6
votes
1answer
358 views

What theoretical risks are posed by compromised 5G infrastructure?

A certain large Asian company and leader in 5G infrastructure has recently been accused of being compromised by its authoritarian government. Aside from the fact that it's nearly impossible to audit ...
89
votes
15answers
15k views

How to deal with low-probability high-impact risks?

There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this: There is a type of attack against our systems that can cause a lot of ...
34
votes
7answers
6k views

What are the real physical risks of casual social media publishing?

aka "how to scare my family into stopping publishing their life online?" I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
36
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
4
votes
3answers
4k views

Security Assessment vs. Risk Analysis

What the real difference between IT Security Assessment based on ISO 27001 (or in general other international standard) and qualitative risk analysis? In some way the approach is much similar - ...
10
votes
2answers
2k views

Looking for an open risk assessment methodology

I'm looking for a fully open quantitative risk assessment methodology. Most of the methodologies have usage or licensing restrictions placed upon them. I define open as methodology covered by ...
3
votes
1answer
228 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
4
votes
1answer
370 views

Why doesn't CVSSv2 consider XSS to have a confidentiality impact?

From the CVSSv2 specification: SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...
3
votes
2answers
2k views

Why is XSS scored with partial impact to integrity in CVSS V2?

From CVSS v2 complete guide : "SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...