Questions tagged [risk-management]

Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

0
votes
1answer
73 views

Cyber resilience scoring

What would be good assessments of cyber resilience? I imagined something like a score on different topics e.g.: Data Protection: HIGH RISK Malware defense: MEDIUM RISK Application/System Life Cycle: ...
1
vote
0answers
40 views

Addressing security issues for documenting internal systems

The Situation I'm presently a member of a healthcare records team that is sorely understaffed and has an incredibly low bus factor, with only two people with the majority of system knowledge, myself -...
0
votes
0answers
181 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
1
vote
1answer
66 views

Risk of removing the PIN from Bitlocker

Microsoft's implementation of BitLocker for hard drive encryption/protection and integrity supports multiple ways to boot into the system. I will list 3: TPM chip (those that support it) without Pre-...
0
votes
0answers
28 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
2
votes
1answer
66 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
1
vote
1answer
41 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
0
votes
1answer
55 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
7
votes
1answer
400 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
0
votes
1answer
154 views

How can I tell if a keyboard for android is safe?

Background: I am a normal smart phone user, with no experience in information security. I want to download a new keyboard for my Android 6 phone off Google Play, as my current keyboard is not great. I ...
7
votes
4answers
251 views

Why should small and medium-sized businesses care about security?

Pretext I'm not a security expert, just a web dev with an interest in "security". I've been tasked by my employer with giving an internal talk on security (specifically web application security) and ...
1
vote
0answers
49 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
0
votes
1answer
59 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
1
vote
1answer
117 views

Is this the correct way to calculate value of safeguards in risk management?

An investigation by the Information Security department has shown that the cost of rectifying a website damaged by a hacker is about Rs. 200k per incident. Available records (over the last ten ...
1
vote
1answer
49 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
11
votes
3answers
408 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
2
votes
1answer
59 views

Should we change risk appetite when we go on a digital transformation journey?

Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms. There are arguments in our Information Security team regarding 'Risk ...
2
votes
5answers
3k views

I have to write down credit card information on paper and send it. How can I minimize my risk?

I am filling out a form to set up a recurring payment with a local government building. The form requests that I put my credit card number, expiration date, and CVV number, which I'm a little hesitant ...
89
votes
15answers
15k views

How to deal with low-probability high-impact risks?

There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this: There is a type of attack against our systems that can cause a lot of ...
1
vote
2answers
191 views

Should TVRA be done physically by going to the datacenter?

As a SaaS provider, we would like to be compliant to the requirements of our Singapore based prospective clients. And the Monetary Authority of Singapore mandates a TVRA (Threat and Vulnerability Risk ...
4
votes
1answer
124 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
2
votes
1answer
165 views

owasp top 10 2017 automation

I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
1
vote
1answer
98 views

Operation Prowli Malware Infects Over 40,000 Machines

Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected. Still no CVE data updated on CVE site regarding the relevant vulnerability. ...
5
votes
2answers
233 views

What is as CISOs job, exactly?

The company I work for (kind of a startup) can't afford a full-time chief information security officer (CISO). So the boss is asking the security aware people in the team to work together to do a ...
1
vote
3answers
644 views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
2
votes
0answers
47 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
1
vote
1answer
87 views

What are the risks of having your data targeted precisely because you try to hide it?

I'm trying to be more careful about my personal data, that I plan to back up using some secure online storage service. I'm looking at several encrypted services that are a much better alternative than ...
4
votes
1answer
131 views

Which questions should be asked when evaluating the risk of a policy exception?

I've been tasked with updating my department's exception request form, and I am trying to come up with YES/NO questions that can be scored to determine the risk of the request. I am having trouble ...
34
votes
7answers
6k views

What are the real physical risks of casual social media publishing?

aka "how to scare my family into stopping publishing their life online?" I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
0
votes
1answer
218 views

Using OWASP Top 10 for assigning vulnerability severity in a security assessment

In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are ...
1
vote
1answer
28 views

How to determine and compare risk in methods for document exchange

Lets say you are talking to a representative of a bank or government institution on the phone, and the representative requests that you send some documents, e.g. document A, B, and C. You ask if you ...
2
votes
4answers
1k views

Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)

How do I express non-compliance to ISO 27002 chapter 5 as a risk? The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
4
votes
1answer
74 views

What asset details are the most relevant in a cyber security risk assessment procedure?

I am identifying organisation assets for a cyber security risk assessment. I am looking for guides or industry best practices for what asset details are actually useful for the risk assessment ...
2
votes
2answers
52 views

Web servers with different risk models in same network

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault). We are creating a network architecture and have 2 webservers. One ...
21
votes
6answers
6k views

Is there a security advantage or risk in removing disabled user accounts?

So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
68
votes
2answers
9k views

What are the risks of not patching a server or hypervisor for Meltdown?

The patch for Meltdown is rumoured to incur a 30% performance penalty, which would be nice to avoid if possible. So this becomes a Security vs Performance risk-assessment problem. I am looking for a ...
12
votes
1answer
852 views

What are the risks of not patching a workstation OS for Meltdown?

Assume the following: macOS (but not sure that matters that much) workstation, mostly gets new executables from the app store or open source repos through macports homebrew fair bit of loading JS, ...
3
votes
2answers
138 views

Granularity for data assets when determining risk during software development

We're currently constructing a security development lifecycle in our software development corporation. Our main idea is to have an asset-driven approach, where we: Enter assets into an asset ...
0
votes
1answer
94 views

When does a company need to hire a dedicated security specialist? [closed]

Currently, we don't have a specific dedicated penetration or security tester/specialist in the team. We've been scanned and audited by different companies specialized in internet security and we've ...
4
votes
3answers
164 views

Are revealed personal emails a security risk?

I am a minor recently employed by a retail company, in the same batch as 10* other new recruits. I have not yet had the first day, however our manager has sent us all a warm welcoming email. The ...
1
vote
0answers
16 views

Recommended number of ssytems under an ISSO

Is there an optimum number of systems an ISSO should be responsible for? I realize system size and complexity come into play but assuming most are large and of moderate risk, etc. is there a number ...
2
votes
3answers
699 views

How a risk assessment impacts information security policy?

I usually do the technical part of security, so I'm not familiar with security policy area. Risk assessment (measurement and evaluation) is always taken in an organization, such as to identify ...
1
vote
2answers
177 views

Referencing Software Standard Risk Severity List?

Is there any reference material out there for the severity of standard software security findings? E.g SQL Injection is severity 1, Missing header is severity 4? I understand risk assessment depends ...
4
votes
2answers
154 views

Way of categorising and organising types of security issues and areas

I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
-1
votes
3answers
140 views

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
-1
votes
1answer
81 views

Can browser emulation create vulnerabilities?

If a browser is not authorized on a network, can browser emulation within an authorized browser create vulnerabilities? For instance, Chrome is unauthorized but if I run IE, press F12 to get into ...
1
vote
1answer
321 views

Risk Assessment - Probability of theft of a physical location

Our security vendor just conducted a Risk Assessment for our organisation and has provided us with the report. One of the 'Threats' identified by the vendor is 'Theft', and our 4 office locations have ...
3
votes
1answer
178 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
2
votes
2answers
1k views

Is Segregation of Duties a Requirement?

In our environment. Developers have full rights and privileges in the dev, test, and production environments. This gives them the ability to create, manipulate, and promote code associated with ...
1
vote
1answer
321 views

Documentation for risk assessment in ISO 27001 structure

We are currently implementing the ISO27001, I have a question regarding the documentation of the risk assessement. We choose EBIOS to be our risk assessement method, and I found some templates of the ...