Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [risk-management]

Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

4
votes
1answer
119 views

Which questions should be asked when evaluating the risk of a policy exception?

I've been tasked with updating my department's exception request form, and I am trying to come up with YES/NO questions that can be scored to determine the risk of the request. I am having trouble ...
3
votes
1answer
79 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
1
vote
1answer
32 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
0
votes
1answer
57 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
2
votes
0answers
93 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
2
votes
0answers
46 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
2
votes
0answers
66 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network.
1
vote
0answers
49 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
1
vote
0answers
16 views

Recommended number of ssytems under an ISSO

Is there an optimum number of systems an ISSO should be responsible for? I realize system size and complexity come into play but assuming most are large and of moderate risk, etc. is there a number ...
1
vote
0answers
46 views

Multiple Frameworks for Risk Assessments?

My organization utilizes Risk Assessments as the catalyst for a lot of our Information Security efforts. Currently we assess applications using the cloud security alliance's CAIQ framework and ...
1
vote
0answers
99 views

Preferred features of CDN with DDoS?

I am putting together a presentation comparing CDN services that also provide DDoS protection. I have to do a really good job on this and I'm not a security expert. For lack of direction, I've copied ...
0
votes
0answers
61 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
0
votes
0answers
28 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
0
votes
0answers
84 views

Machine Learning based application vulnerability scoring

This question is related to an earlier questions: 1 & 2 about the limitations in web application vulnerability scoring/automated vulnerability scoring. Indeed, scoring vulnerabilities detected in ...