Questions tagged [risk-analysis]

Risk Analysis is a practice used to identify and assess factors that may jeopardize the success of a project or achieving a goal. Security Risk Analysis or Risk Assessment could be Quantitative and Qualitative

Filter by
Sorted by
Tagged with
-1
votes
1answer
92 views

Can browser emulation create vulnerabilities?

If a browser is not authorized on a network, can browser emulation within an authorized browser create vulnerabilities? For instance, Chrome is unauthorized but if I run IE, press F12 to get into ...
3
votes
1answer
297 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
2
votes
1answer
287 views

How likely is an attack for a known OTA ring 0 vulnerability in mobile devices?

Following on from this question about a WiFi OTA vulnerability: assume a popular computing platform has a known vulnerability that would allow creation of a worm with access to ring 0 (kernel). Then, ...
4
votes
1answer
2k views

How to Audit an Email System

I am working on an auditing process for my company's email system (Exchange 2010). From this process, we're hoping to expand it out to other systems and start to clean up the rampant security issues ...
56
votes
11answers
10k views

Why is it bad to connect internal systems to the Internet?

We have an intranet system we use to book, track and process invoices for our core business. My boss would like to move this system to the Internet to make it "accessible everywhere". However, I feel ...
4
votes
3answers
414 views

Information Security Risk Analytics

The company where I work at is evaluating different risk analytics solutions to purchase, but one of the security guys introduced the idea to actually build our own internal platform/engine. I have ...
2
votes
1answer
1k views

Can information security risks essentially only be triaged according to the CIA triangle?

Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
1
vote
1answer
86 views

Reducing risk from logging

I am following the OWASP Risk methodology and have the threat "Installed software exploitation". I've created this risk based on the idea that a risk is found in say phpMyAdmin which can be exploited. ...
0
votes
1answer
125 views

Dilbert's Pointy-Haired Boss & Influencing executive perspectives on Information Security

In Scott Adam's cartoon Dilbert the Pointy-haired Boss has no name because Scott Adam's wanted his readers to relate the boss character to bosses known to the readers. This is pointed out because (...
1
vote
2answers
598 views

Security vs Usability [closed]

When looking at the internet for ways to secure yourself, I normally see that people use weak security because the more secure you become, the lower the usability is. Weak passwords trump strong ...
6
votes
1answer
272 views

Attack tree file format?

Wikipedia lists five software packages for creating/editing/analysing attack trees. These software packages do not seem to have settled, between them, upon an agreed file format for attack trees. ...
0
votes
1answer
104 views

Iso 27K Implementation

Suppose we buy a new cisco router or any IT equipment. How can we employ ISO 27k/NIST 800-37/NIST 800-53 or any other related information security management standards technically? I mean what should ...
1
vote
2answers
399 views

Understanding risk analysis and threat modelling in practice

I am doing research in the security of cloud computing. The purpose of the following questions is to understand the relationship between "risk analysis" and "threat modeling": Do we usually analyze ...
99
votes
10answers
10k views

How to create a company culture that cares about information security?

Hardened Servers, IPS, firewalls and all kinds of defenses cannot solve security problems if people leak information without knowing simply because they're misguided. I already tried to instruct them ...
1
vote
3answers
618 views

Risk Assessment Methodology ISO 27001

I would like to apply ISO 27001 best practices for a company that has not completed its final online architecture yet and it is still under development phase. However, they pretty much know which ...
4
votes
1answer
552 views

Why doesn't CVSSv2 consider XSS to have a confidentiality impact?

From the CVSSv2 specification: SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...
3
votes
2answers
2k views

Why is XSS scored with partial impact to integrity in CVSS V2?

From CVSS v2 complete guide : "SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...
0
votes
1answer
171 views

Assess risk with or without exising countermeasures

I recently had a discussion with a coworker about the of a risk analysis. When doing a risk assessment you typically identify threats, assess them and then identify the countermeasures. I my opinion ...
-2
votes
1answer
448 views

Is ETSI TVRA a risk assessment or threat modeling tool? [closed]

Is ETSI TVRA TS 102 153 165-1 a risk assessment tool or threat modeling tool? And what's the justification? The purpose of the question is to be able to answer if TVRA is suitable to be mapped to ...
-3
votes
2answers
2k views

Business Impact Analysis vs Risk Assessment

I am so confused about Business Impact Analysis vs Risk Assessment Could you please explain to me the difference between them? Thanks.
3
votes
2answers
3k views

Do high-level programming languages have more vulnerabilities or security risks than low-level languages? [closed]

Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why? Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/...
0
votes
1answer
111 views

Is there a way to calculate the complexity of an XSS-vector?

Is there a way to calculate/estimate the complexity of an XSS vector? I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
1
vote
1answer
167 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...
3
votes
1answer
942 views

Risks of using UUID to identify user in mobile app

I've got an existing customer base. A customer has appointments. Currently they cannot access or change their appointments without contacting me directly. I want to offer them a way to access and ...
14
votes
7answers
2k views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
5
votes
2answers
6k views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
1
vote
1answer
58 views

What is the best way to get missing information used for risk analysis

The situation is that I am a software developer working for this company since last January and was asked to do information security for my business unit on the side. I don't have a lot of experience ...
27
votes
7answers
7k views

Is ignoring a threat you cannot defend from a valid strategy?

Given that you sometimes can not defend from a form of threat, is it then valid to ignore said threat? Instead of defending from the threat, just mitigate the symptom. An example of this comes from ...
1
vote
2answers
379 views

Ethical hacking requirements on a banking institution

If I would be required to do an ethic hacking research by a banking institution would I use my own bank account, ask for an account to the bank or open a new account and transfer some money and do ...
8
votes
1answer
443 views

Is exposing website performance data a security risk?

I am currently adding a subsite to some websites that allows me to monitor performance data live as the server software perceives it. The data is mostly stuff like amount of memory used, memory ...
44
votes
5answers
6k views

What's the danger of having some random, out of my control, JavaScript code running on my pages?

My website pages reference some JavaScript code from a third-party CDN (analytics, etc). So I don't control what code is there - the third party may change those scripts at any moment and introduce ...
3
votes
1answer
2k views

Web browser security comparison analysis

Secunia publishes an annual vulnerability review that covers web browsers and surprisingly Google Chrome leads the number of known vulnerabilities in comparison to the likes of Microsoft Internet ...
10
votes
0answers
101 views

Should the risk of antivirus products be reconsidered in light of the TrendMicro critical bug report [closed]

Tavis Ormandy of Google has recently discovered a critical TrendMicro design flaw identified in this bug report - TrendMicro node.js HTTP server listening on localhost can execute commands. The bug ...
41
votes
4answers
3k views

Evaluating the security of home security cameras

My parents have a vacation home out in the country and are looking to setup a home surveillance system for remote viewing. I've heard that there can be serious vulnerabilities in these products. What ...
0
votes
1answer
580 views

Difference between Threat Impact and Business Impact

I'm using SecureAware by Neupart/Lightwave as ISMS. This, otherwise fine program, asks me to fill in Threat Impact for all threads in the usual categories of Confidentiality, Integrity and ...
3
votes
2answers
390 views

SOMAP for risk assessment methodology or other Open Source IT Risk Management

Is SOMAP good for risk assessment or it is not in use any more? Is there any other Open Source IT Risk Management?
1
vote
3answers
11k views

The difference between risk assessment and risk analysis [duplicate]

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the ...
-2
votes
1answer
206 views

Security risk analysis software [closed]

I am looking for some risk assessment tools (preferably open source), which make the analysis of a system based on its hardware structure given as input and point out potential weaknesses of this ...
1
vote
1answer
173 views

Formal functional relationship between risk and CVSS

The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities. What is the functional relationship between a CVSS and the associated ...
3
votes
2answers
2k views

Calculating the time required to brute force a random code

Say we have amount random entry codes of length characters from an alphabet of size alphabet. The number of possible codes is then easily calculated as keyspace = alphabet ^ length. Now take an ...
0
votes
1answer
102 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
4
votes
1answer
11k views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
3
votes
1answer
146 views

Can you securely allow users to create VM's on their workstations

I've moved from a job where developers were encouraged to use technologies like docker and vagrant to create VM's on their workstations for testing and development. At my new job, the IT manager ...
2
votes
1answer
1k views

Historical events in terms of risk assessment

How can historical events be leveraged in terms of a risk assessment. I know you could for instance look at malware infections over the past x months to perform a better estimation of for your malware ...
2
votes
3answers
11k views

Exposure Factor when calculating SLE

I am studying for an exam and came across a question asking to find what the single loss expectance would be, but I am failing to understand exposure factor in the calculation. SLE = Asset Value * ...
0
votes
1answer
154 views

Security risks of allowing customer to use his own domain for a hosted SaaS application

As a SaaS hosting, we are considering allowing customer to use an alternative domain to access his SaaS environment. Default domain owned and hosted by us: customersubdomain.ourdomain.com ...
13
votes
3answers
20k views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF (...
3
votes
1answer
177 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
2
votes
1answer
525 views

Trying to GET "/iptac-xxxx" not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/**iptac-***[a long long string]*/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
1
vote
0answers
65 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...