Questions tagged [risk-management]

Risk management is the identification, assessment, and prioritization of risks - defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative - followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

Filter by
Sorted by
Tagged with
-1
votes
1answer
87 views

Can browser emulation create vulnerabilities?

If a browser is not authorized on a network, can browser emulation within an authorized browser create vulnerabilities? For instance, Chrome is unauthorized but if I run IE, press F12 to get into ...
1
vote
1answer
405 views

Risk Assessment - Probability of theft of a physical location

Our security vendor just conducted a Risk Assessment for our organisation and has provided us with the report. One of the 'Threats' identified by the vendor is 'Theft', and our 4 office locations have ...
3
votes
1answer
212 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
2
votes
2answers
2k views

Is Segregation of Duties a Requirement?

In our environment. Developers have full rights and privileges in the dev, test, and production environments. This gives them the ability to create, manipulate, and promote code associated with ...
1
vote
1answer
342 views

Documentation for risk assessment in ISO 27001 structure

We are currently implementing the ISO27001, I have a question regarding the documentation of the risk assessement. We choose EBIOS to be our risk assessement method, and I found some templates of the ...
0
votes
1answer
108 views

How does someone conduct a risk assessment of a B2B Integration?

I'm not very familiar with B2B integrations. No one in our small organization is, but we need to conduct some assessments. How does one assess a B2B integration? It seems like there would be gaps ...
1
vote
0answers
51 views

Multiple Frameworks for Risk Assessments?

My organization utilizes Risk Assessments as the catalyst for a lot of our Information Security efforts. Currently we assess applications using the cloud security alliance's CAIQ framework and ...
2
votes
1answer
904 views

Can information security risks essentially only be triaged according to the CIA triangle?

Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
1
vote
1answer
76 views

Reducing risk from logging

I am following the OWASP Risk methodology and have the threat "Installed software exploitation". I've created this risk based on the idea that a risk is found in say phpMyAdmin which can be exploited. ...
-5
votes
1answer
221 views

Why threat modelling and risk planning does not consider the sex of users? [closed]

Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
1
vote
1answer
153 views

What is the security risk of the Macbook Pro Touchbar?

The new MacBook Pro has a touch bar that has been banned for students taking the bar exam. What is the issue that would cause this response? Data leakage Cheat sheets Add in apps could alter the ...
1
vote
2answers
2k views

What are the risks for putting bank account details on a website?

If I want to accept donations on a website, what risk is there in showing bank account number and sort code?
0
votes
1answer
118 views

Dilbert's Pointy-Haired Boss & Influencing executive perspectives on Information Security

In Scott Adam's cartoon Dilbert the Pointy-haired Boss has no name because Scott Adam's wanted his readers to relate the boss character to bosses known to the readers. This is pointed out because (...
1
vote
1answer
44 views

The difference between Management and Configuration Policies

I am trying to find out the difference between management and configuration policies. Kindly, can someone elaborate that or showing an example so that I can understand each case.
3
votes
1answer
268 views

how to identify all packages in a Linux distribution which requires root access?

To help me to prioritize security issues and be compliance with a patch-management policy, and to reduce the exposure to risk, I would like to have a list of all packages in a Linux distribution (rpm ...
0
votes
1answer
94 views

Iso 27K Implementation

Suppose we buy a new cisco router or any IT equipment. How can we employ ISO 27k/NIST 800-37/NIST 800-53 or any other related information security management standards technically? I mean what should ...
0
votes
1answer
112 views

What security threats do tradesmen face in their use of IT?

I'm designing a system for tradesmen and doing research into the security issues. I have the basics covered and am now looking for more specific threats. What threats or vulnerabilities may be ...
1
vote
2answers
370 views

Understanding risk analysis and threat modelling in practice

I am doing research in the security of cloud computing. The purpose of the following questions is to understand the relationship between "risk analysis" and "threat modeling": Do we usually analyze ...
96
votes
10answers
10k views

How to create a company culture that cares about information security?

Hardened Servers, IPS, firewalls and all kinds of defenses cannot solve security problems if people leak information without knowing simply because they're misguided. I already tried to instruct them ...
2
votes
3answers
272 views

Risks involved in deploying staging environment externally

The users of the application will be the company employees who will access it over the company network and outside too. A penetration test needs to be done on the staging environment which will be ...
1
vote
2answers
77 views

What app owners need to do while they resolve XSS to minimize risk?

I have submitted a pentest report in which I have reported XSS at a few locations in an application. The management agreed to the risk. They have planned to remediate the issue in the next thirty days....
1
vote
1answer
572 views

Risks of using a root container to manage Docker daemon

My intention is to create/show/delete images and containers automatically with Docker. According to Docker's security guidelines exposing Docker's daemon to a port is a high security risk, because ...
10
votes
4answers
2k views

What are the risks of providing SSLv2 for additional device compatibility?

SSL 2 was deprecated in 2011. However many devices are manufactured before 2011 and still in use today, and it is impossible to upgrade the software in the device (e.g. cellphones, tablets, PDAs, ...
0
votes
1answer
62 views

What is the risk of unlimited email event triggering?

Let's say I can trigger a mail event in a few scenario's without any a limit on that trigger. For example at: Registration Password reset Newsletter subscription The "registration" and "newsletter ...
14
votes
7answers
2k views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
7
votes
1answer
429 views

How to mitigate risk of X11 buffer ghosting (palinopsia bug)

The Buffer "Ghosting" Phenomenon It is possible to observe contents of (old and currently used) graphics buffers on a monitor under certain circumstances, posing an information disclosure risk, when ...
2
votes
1answer
2k views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
3
votes
2answers
211 views

What parameters define information sensitivity?

Since information is generally consumed by different parties for various reasons, what parameters define information sensitivity? For example marketing may define "customer" data such as name and ...
2
votes
1answer
342 views

What is the best way to report IT Security risks to Executive management? [closed]

I am seeking your opinion on what is the best way to report/communicate IT security risks (risk register) to IT executive management in big organization?
4
votes
1answer
1k views

How are assets assessed for criticality?

Following on from the post regarding risks assessments and critical assets, how are assets assessed for criticality be it infrastructure, processes, people (possibly), etc? If using the security ...
7
votes
1answer
5k views

Industry best practices for vulnerability scanning and management?

I am looking for reference documents or talks as to the end results for a vulnerability assessment, scanning, and management process at a fully matured "impressive" level for a large organization that ...
0
votes
1answer
418 views

Difference between Threat Impact and Business Impact

I'm using SecureAware by Neupart/Lightwave as ISMS. This, otherwise fine program, asks me to fill in Threat Impact for all threads in the usual categories of Confidentiality, Integrity and ...
3
votes
1answer
352 views

SOMAP for risk assessment methodology or other Open Source IT Risk Management

Is SOMAP good for risk assessment or it is not in use any more? Is there any other Open Source IT Risk Management?
3
votes
1answer
81 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
1
vote
0answers
82 views

Why don't more servers use HTTPS to secure executable downloads? [duplicate]

I actually check for TLS before I use any exe files. I've been trying to download a bootable usb creator tool for windows. However, I can't find a single one that actually uses any form of TLS (or ...
1
vote
3answers
11k views

The difference between risk assessment and risk analysis [duplicate]

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the ...
1
vote
1answer
1k views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
2
votes
1answer
96 views

Are Ad-hoc security testing beneficial to small business?

While reflecting on enterprise scale security program, I had this question if small scale businesses benefit at all from an ad-hoc security testing? What are some suggestions that will solve the ...
3
votes
2answers
50 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
-2
votes
1answer
200 views

Security risk analysis software [closed]

I am looking for some risk assessment tools (preferably open source), which make the analysis of a system based on its hardware structure given as input and point out potential weaknesses of this ...
4
votes
3answers
93 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
2
votes
0answers
69 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network.
2
votes
1answer
217 views

Is it secure to set default value for password field?

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
1
vote
1answer
46 views

Supply chain risks

I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department ...
4
votes
2answers
410 views

Estimating the cost of implementing security measures

Are there good resources or good practices on how to estimate the cost for implementing security measures in a company? My purpose is to justify to management that they need to spend this amount to ...
27
votes
5answers
4k views

DDOS - security or operational risk?

The chief security officer of a medium sized IT company (400-500 employees) recently released a bulletin in which he stated that DDOS attacks are not a security risk but an operational one. Also I was ...
0
votes
1answer
97 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
14
votes
2answers
784 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
4
votes
2answers
363 views

Connection between “Security Requirements Engineering”, “Risk Analysis” and “Threat Modeling”

I am trying to figure out how the above concepts fit in together. As i understood it Security Requirements Engineering (SRE), Risk Analysis (RA) and Threat Modeling (TM) are methods that ultimately ...
4
votes
1answer
1k views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...