Skip to main content

Questions tagged [risk-analysis]

Risk Analysis is a practice used to identify and assess factors that may jeopardize the success of a project or achieving a goal. Security Risk Analysis or Risk Assessment could be Quantitative and Qualitative

Filter by
Sorted by
Tagged with
5 votes
2 answers

Skype security concerns on an enterprise network

I am trying to write a security opinion that may influence policy in the future in the Enterprise-grade network which I work to protect regarding the use of Skype on the networks, and security risks ...
Thomas Ward's user avatar
3 votes
2 answers

How likely is an infection with an outdated skype on linux? [closed]

Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook: deb stable non-free Doesn't have the new version, ...
sfx's user avatar
  • 903
1 vote
1 answer

What would be good resources to conduct Technical Impact Analysis?

As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as: Similarly, CAPEC list impact in ...
Epoch Win's user avatar
  • 922
0 votes
2 answers

Looking for information about the job from security consultants

I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
gfppaste's user avatar
  • 191
6 votes
2 answers

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
jvff's user avatar
  • 61
16 votes
4 answers

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
Chris K's user avatar
  • 446
4 votes
1 answer

IP address filtering vs web application security

We have a web application behind a firewall that requires no user authentication. If we open up access to this application via the firewall to a small list of IP addresses what is the risk of ...
user avatar
4 votes
3 answers

Where can I find a collection of Threat Models?

I found a very nice SSL Threat model on this web page and would like to find more on different topics. How would I go about locating more images like these? Is there an organisation or website I ...
makerofthings7's user avatar
16 votes
12 answers

Is this much distrust really necessary?

In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount ...
TheLQ's user avatar
  • 1,239
1 vote
3 answers

List of notable security breaches [closed]

Is there a list of notable (i.e. those reported in the mainstream media) security issues such as hacks, viruses, worms and any other unauthorized or improper access or use of computers for malicious ...
7 votes
4 answers

How to choose/compromise between data protection, and device recovery?

I'm sure many of you have probably seen (online or in-person) the DEFCON 18 presentation, demonstrating what can happen if you steal a hacker's computer. For those who haven't, the link is below. It'...
Iszi's user avatar
  • 27.1k
11 votes
2 answers

Looking for an open risk assessment methodology

I'm looking for a fully open quantitative risk assessment methodology. Most of the methodologies have usage or licensing restrictions placed upon them. I define open as methodology covered by ...
Ben's user avatar
  • 615
12 votes
3 answers

Is CentOS a good choice from a security perspective?

How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
LanceBaynes's user avatar
  • 6,279
36 votes
5 answers

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
user1971's user avatar
  • 783
111 votes
13 answers

Why do sites implement locking after three failed password attempts?

I know the reasoning behind not letting infinite password attempts - brute force attempts is not a meatspace weakness, but a problem with computer security - but where did they get the number three ...
Bradley Kreider's user avatar
14 votes
3 answers

What risk analysis methodologies should I use?

I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...
AviD's user avatar
  • 73.4k

1 2 3