Questions tagged [risk-management]

Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

Is there a default assets grouping in order to perform Information Security Risk Assessment?

I am working on the implementation of an ISMS and aiming to get 27001 certification. While i was conducting the Risk Assessment, I found it difficult to match all those assets/asset components with ...
0
votes
0answers
44 views

Risk Management - Working out the EF

I've just started a risk management course at university and it is confusing the hell out of me. So, we have a question that states the following: "An online marketplace has monitored their risk ...
0
votes
1answer
54 views

Security test within a staging environment. Is SOAPUI sufficient as a test tool?

Currently I am working on a project in which I am supposed to define the following aspects as a test manager: Conception of a penetration test for a test staging environment Planning security ...
0
votes
1answer
79 views

Cyber resilience scoring

What would be good assessments of cyber resilience? I imagined something like a score on different topics e.g.: Data Protection: HIGH RISK Malware defense: MEDIUM RISK Application/System Life Cycle: ...
1
vote
0answers
42 views

Addressing security issues for documenting internal systems

The Situation I'm presently a member of a healthcare records team that is sorely understaffed and has an incredibly low bus factor, with only two people with the majority of system knowledge, myself -...
1
vote
0answers
380 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
1
vote
1answer
142 views

Risk of removing the PIN from Bitlocker

Microsoft's implementation of BitLocker for hard drive encryption/protection and integrity supports multiple ways to boot into the system. I will list 3: TPM chip (those that support it) without Pre-...
2
votes
2answers
144 views

How big should a blue team be?

Let's say I wanted to convince my management that my company needed a blue team. I have all the arguments ready and I'm sure I'll give a great presentation. At the end I will have to spell out what it ...
0
votes
0answers
31 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
2
votes
1answer
78 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
1
vote
1answer
52 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
0
votes
1answer
66 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
7
votes
1answer
554 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
0
votes
1answer
287 views

How can I tell if a keyboard for android is safe?

Background: I am a normal smart phone user, with no experience in information security. I want to download a new keyboard for my Android 6 phone off Google Play, as my current keyboard is not great. I ...
7
votes
4answers
256 views

Why should small and medium-sized businesses care about security?

Pretext I'm not a security expert, just a web dev with an interest in "security". I've been tasked by my employer with giving an internal talk on security (specifically web application security) and ...
1
vote
0answers
52 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
1
vote
1answer
69 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
1
vote
1answer
210 views

Is this the correct way to calculate value of safeguards in risk management?

An investigation by the Information Security department has shown that the cost of rectifying a website damaged by a hacker is about Rs. 200k per incident. Available records (over the last ten ...
1
vote
1answer
57 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
11
votes
3answers
417 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
2
votes
1answer
69 views

Should we change risk appetite when we go on a digital transformation journey?

Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms. There are arguments in our Information Security team regarding 'Risk ...
2
votes
5answers
4k views

I have to write down credit card information on paper and send it. How can I minimize my risk?

I am filling out a form to set up a recurring payment with a local government building. The form requests that I put my credit card number, expiration date, and CVV number, which I'm a little hesitant ...
89
votes
15answers
15k views

How to deal with low-probability high-impact risks?

There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this: There is a type of attack against our systems that can cause a lot of ...
1
vote
2answers
275 views

Should TVRA be done physically by going to the datacenter?

As a SaaS provider, we would like to be compliant to the requirements of our Singapore based prospective clients. And the Monetary Authority of Singapore mandates a TVRA (Threat and Vulnerability Risk ...
4
votes
1answer
125 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
2
votes
1answer
177 views

owasp top 10 2017 automation

I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
1
vote
1answer
98 views

Operation Prowli Malware Infects Over 40,000 Machines

Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected. Still no CVE data updated on CVE site regarding the relevant vulnerability. ...
5
votes
2answers
238 views

What is as CISOs job, exactly?

The company I work for (kind of a startup) can't afford a full-time chief information security officer (CISO). So the boss is asking the security aware people in the team to work together to do a ...
1
vote
3answers
932 views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...
2
votes
0answers
47 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
1
vote
1answer
89 views

What are the risks of having your data targeted precisely because you try to hide it?

I'm trying to be more careful about my personal data, that I plan to back up using some secure online storage service. I'm looking at several encrypted services that are a much better alternative than ...
4
votes
1answer
157 views

Which questions should be asked when evaluating the risk of a policy exception?

I've been tasked with updating my department's exception request form, and I am trying to come up with YES/NO questions that can be scored to determine the risk of the request. I am having trouble ...
34
votes
7answers
6k views

What are the real physical risks of casual social media publishing?

aka "how to scare my family into stopping publishing their life online?" I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
0
votes
1answer
267 views

Using OWASP Top 10 for assigning vulnerability severity in a security assessment

In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are ...
1
vote
1answer
28 views

How to determine and compare risk in methods for document exchange

Lets say you are talking to a representative of a bank or government institution on the phone, and the representative requests that you send some documents, e.g. document A, B, and C. You ask if you ...
2
votes
4answers
2k views

Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)

How do I express non-compliance to ISO 27002 chapter 5 as a risk? The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
4
votes
1answer
79 views

What asset details are the most relevant in a cyber security risk assessment procedure?

I am identifying organisation assets for a cyber security risk assessment. I am looking for guides or industry best practices for what asset details are actually useful for the risk assessment ...
2
votes
2answers
52 views

Web servers with different risk models in same network

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault). We are creating a network architecture and have 2 webservers. One ...
20
votes
6answers
7k views

Is there a security advantage or risk in removing disabled user accounts?

So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
68
votes
2answers
9k views

What are the risks of not patching a server or hypervisor for Meltdown?

The patch for Meltdown is rumoured to incur a 30% performance penalty, which would be nice to avoid if possible. So this becomes a Security vs Performance risk-assessment problem. I am looking for a ...
12
votes
1answer
856 views

What are the risks of not patching a workstation OS for Meltdown?

Assume the following: macOS (but not sure that matters that much) workstation, mostly gets new executables from the app store or open source repos through macports homebrew fair bit of loading JS, ...
3
votes
2answers
142 views

Granularity for data assets when determining risk during software development

We're currently constructing a security development lifecycle in our software development corporation. Our main idea is to have an asset-driven approach, where we: Enter assets into an asset ...
0
votes
1answer
94 views

When does a company need to hire a dedicated security specialist? [closed]

Currently, we don't have a specific dedicated penetration or security tester/specialist in the team. We've been scanned and audited by different companies specialized in internet security and we've ...
4
votes
3answers
195 views

Are revealed personal emails a security risk?

I am a minor recently employed by a retail company, in the same batch as 10* other new recruits. I have not yet had the first day, however our manager has sent us all a warm welcoming email. The ...
1
vote
0answers
16 views

Recommended number of ssytems under an ISSO

Is there an optimum number of systems an ISSO should be responsible for? I realize system size and complexity come into play but assuming most are large and of moderate risk, etc. is there a number ...
2
votes
3answers
815 views

How a risk assessment impacts information security policy?

I usually do the technical part of security, so I'm not familiar with security policy area. Risk assessment (measurement and evaluation) is always taken in an organization, such as to identify ...
1
vote
2answers
186 views

Referencing Software Standard Risk Severity List?

Is there any reference material out there for the severity of standard software security findings? E.g SQL Injection is severity 1, Missing header is severity 4? I understand risk assessment depends ...
4
votes
2answers
157 views

Way of categorising and organising types of security issues and areas

I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
-1
votes
3answers
145 views

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
-1
votes
1answer
86 views

Can browser emulation create vulnerabilities?

If a browser is not authorized on a network, can browser emulation within an authorized browser create vulnerabilities? For instance, Chrome is unauthorized but if I run IE, press F12 to get into ...