Questions tagged [risk-classification]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer

Cyber resilience scoring

What would be good assessments of cyber resilience? I imagined something like a score on different topics e.g.: Data Protection: HIGH RISK Malware defense: MEDIUM RISK Application/System Life Cycle: ...
kiara's user avatar
  • 701
1 vote
2 answers

How to create non-generic security requirements for an idea phase?

Our manager often asks us for a quick understanding of what the risks will be based on some idea that the department has been working on during the ideation phase (the business requirements are ...
Filipon's user avatar
  • 1,264
2 votes
1 answer

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
Vincent's user avatar
  • 23
1 vote
3 answers

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
Sublime1914's user avatar
-1 votes
3 answers

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
Kay's user avatar
  • 1
3 votes
1 answer

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
Marc Ruef's user avatar
  • 1,100
10 votes
3 answers

Are there any Common Weakness Entries (CWEs) applicable for hardware security weaknesses?

I can't seem to find a suitable CWE for classifying hardware-specific security weaknesses. Particularly, I'm looking for a CWE that applies to power glitching or clock glitching against a ...
Polynomial's user avatar
  • 135k
3 votes
3 answers

Risk classification of authenticated XSS

During a security test I was wondering what the risk classification would be in an authenticated XSS vulnerability. I understand that it depends on classification schemes, so the focus in this ...
Wealot's user avatar
  • 879
2 votes
1 answer

Can information security risks essentially only be triaged according to the CIA triangle?

Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
Bob Ortiz's user avatar
  • 6,661