Questions tagged [risk-management]

Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

Filter by
Sorted by
Tagged with
4
votes
1answer
2k views

How are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
1
vote
1answer
41 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
17
votes
5answers
4k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
4
votes
1answer
124 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
0
votes
1answer
74 views

Cyber resilience scoring

What would be good assessments of cyber resilience? I imagined something like a score on different topics e.g.: Data Protection: HIGH RISK Malware defense: MEDIUM RISK Application/System Life Cycle: ...
4
votes
1answer
136 views

Which questions should be asked when evaluating the risk of a policy exception?

I've been tasked with updating my department's exception request form, and I am trying to come up with YES/NO questions that can be scored to determine the risk of the request. I am having trouble ...
1
vote
0answers
40 views

Addressing security issues for documenting internal systems

The Situation I'm presently a member of a healthcare records team that is sorely understaffed and has an incredibly low bus factor, with only two people with the majority of system knowledge, myself -...
0
votes
0answers
229 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
0
votes
1answer
62 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
21
votes
6answers
7k views

Is there a security advantage or risk in removing disabled user accounts?

So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
1
vote
1answer
76 views

Risk of removing the PIN from Bitlocker

Microsoft's implementation of BitLocker for hard drive encryption/protection and integrity supports multiple ways to boot into the system. I will list 3: TPM chip (those that support it) without Pre-...
8
votes
4answers
1k views

How to estimate the cost of an application vulnerability?

I've seen data on the cost of a breach including lot of surveys and research by Verizon and the Ponemon Institute. But in terms of an actual vulnerability, what are the factors to consider to ...
1
vote
3answers
707 views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
0
votes
0answers
28 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
2
votes
1answer
69 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
24
votes
5answers
2k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
0
votes
1answer
55 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
7
votes
1answer
451 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
0
votes
1answer
179 views

How can I tell if a keyboard for android is safe?

Background: I am a normal smart phone user, with no experience in information security. I want to download a new keyboard for my Android 6 phone off Google Play, as my current keyboard is not great. I ...
7
votes
4answers
254 views

Why should small and medium-sized businesses care about security?

Pretext I'm not a security expert, just a web dev with an interest in "security". I've been tasked by my employer with giving an internal talk on security (specifically web application security) and ...
1
vote
0answers
51 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
1
vote
2answers
211 views

Should TVRA be done physically by going to the datacenter?

As a SaaS provider, we would like to be compliant to the requirements of our Singapore based prospective clients. And the Monetary Authority of Singapore mandates a TVRA (Threat and Vulnerability Risk ...
1
vote
1answer
133 views

Is this the correct way to calculate value of safeguards in risk management?

An investigation by the Information Security department has shown that the cost of rectifying a website damaged by a hacker is about Rs. 200k per incident. Available records (over the last ten ...
11
votes
3answers
408 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
1
vote
1answer
53 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
2
votes
1answer
62 views

Should we change risk appetite when we go on a digital transformation journey?

Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms. There are arguments in our Information Security team regarding 'Risk ...
2
votes
2answers
1k views

Is Segregation of Duties a Requirement?

In our environment. Developers have full rights and privileges in the dev, test, and production environments. This gives them the ability to create, manipulate, and promote code associated with ...
2
votes
5answers
3k views

I have to write down credit card information on paper and send it. How can I minimize my risk?

I am filling out a form to set up a recurring payment with a local government building. The form requests that I put my credit card number, expiration date, and CVV number, which I'm a little hesitant ...
89
votes
15answers
15k views

How to deal with low-probability high-impact risks?

There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this: There is a type of attack against our systems that can cause a lot of ...
4
votes
2answers
154 views

Way of categorising and organising types of security issues and areas

I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
2
votes
1answer
167 views

owasp top 10 2017 automation

I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
34
votes
7answers
6k views

What are the real physical risks of casual social media publishing?

aka "how to scare my family into stopping publishing their life online?" I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
1
vote
1answer
98 views

Operation Prowli Malware Infects Over 40,000 Machines

Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected. Still no CVE data updated on CVE site regarding the relevant vulnerability. ...
5
votes
2answers
236 views

What is as CISOs job, exactly?

The company I work for (kind of a startup) can't afford a full-time chief information security officer (CISO). So the boss is asking the security aware people in the team to work together to do a ...
2
votes
0answers
47 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
6
votes
6answers
1k views

What are all of the issues with storing a cleartext password?

I know, I know, cleartext passwords are terrible and you should always store a hash! However, I'm interested in all of the issues with storing cleartext passwords so I can make a reasonably secure ...
1
vote
1answer
87 views

What are the risks of having your data targeted precisely because you try to hide it?

I'm trying to be more careful about my personal data, that I plan to back up using some secure online storage service. I'm looking at several encrypted services that are a much better alternative than ...
2
votes
3answers
725 views

How a risk assessment impacts information security policy?

I usually do the technical part of security, so I'm not familiar with security policy area. Risk assessment (measurement and evaluation) is always taken in an organization, such as to identify ...
0
votes
1answer
221 views

Using OWASP Top 10 for assigning vulnerability severity in a security assessment

In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are ...
2
votes
4answers
2k views

Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)

How do I express non-compliance to ISO 27002 chapter 5 as a risk? The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
1
vote
1answer
28 views

How to determine and compare risk in methods for document exchange

Lets say you are talking to a representative of a bank or government institution on the phone, and the representative requests that you send some documents, e.g. document A, B, and C. You ask if you ...
7
votes
1answer
369 views

How to mitigate risk of X11 buffer ghosting (palinopsia bug)

The Buffer "Ghosting" Phenomenon It is possible to observe contents of (old and currently used) graphics buffers on a monitor under certain circumstances, posing an information disclosure risk, when ...
4
votes
1answer
74 views

What asset details are the most relevant in a cyber security risk assessment procedure?

I am identifying organisation assets for a cyber security risk assessment. I am looking for guides or industry best practices for what asset details are actually useful for the risk assessment ...
2
votes
2answers
52 views

Web servers with different risk models in same network

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault). We are creating a network architecture and have 2 webservers. One ...
12
votes
1answer
853 views

What are the risks of not patching a workstation OS for Meltdown?

Assume the following: macOS (but not sure that matters that much) workstation, mostly gets new executables from the app store or open source repos through macports homebrew fair bit of loading JS, ...
68
votes
2answers
9k views

What are the risks of not patching a server or hypervisor for Meltdown?

The patch for Meltdown is rumoured to incur a 30% performance penalty, which would be nice to avoid if possible. So this becomes a Security vs Performance risk-assessment problem. I am looking for a ...
3
votes
2answers
142 views

Granularity for data assets when determining risk during software development

We're currently constructing a security development lifecycle in our software development corporation. Our main idea is to have an asset-driven approach, where we: Enter assets into an asset ...
0
votes
1answer
94 views

When does a company need to hire a dedicated security specialist? [closed]

Currently, we don't have a specific dedicated penetration or security tester/specialist in the team. We've been scanned and audited by different companies specialized in internet security and we've ...
2
votes
3answers
220 views

Risks involved in deploying staging environment externally

The users of the application will be the company employees who will access it over the company network and outside too. A penetration test needs to be done on the staging environment which will be ...
1
vote
1answer
330 views

Documentation for risk assessment in ISO 27001 structure

We are currently implementing the ISO27001, I have a question regarding the documentation of the risk assessement. We choose EBIOS to be our risk assessement method, and I found some templates of the ...