Questions tagged [risk]
The risk tag has no usage guidance.
109
questions
1
vote
1
answer
33
views
Business impact assessments and quantifying impact
I have been looking into business impact assessments and I am confused about the "Impact" part. I have been asked several times about what the impact would be when a system fails, and it ...
- 128k
0
votes
2
answers
38
views
Is "avert" a valid term in Risk Management?
I recently came across the term "avert" as an answer in a multiple choice question in an exam which has a module on risk management.
I am au fait with the terms "avoid", "...
- 128k
8
votes
5
answers
4k
views
Does "risk score" always have to be a numerical value?
In the context of organisational IT security, for a threat such as the insider threat, is it actually okay to report (in a risk assessment) as "Risk Score=Medium" or does "risk score&...
- 10.3k
1
vote
0
answers
60
views
How does a risk assessment for an EU project look like?
I have to add provide a draft of a risk assessment for a small EU project.
As I've never done this, I struggle with identifying assets or vulnerabilities. I'm aware of very general lists, but I wonder ...
- 111
1
vote
1
answer
425
views
vulnerability management, risk mitigation vs risk acceptance
I was involved in a conversation concerning the in-house vulnerability management program. One the statements made was that the management is generally not willing to accept risk and it should be ...
CommunityBot
- 1
0
votes
1
answer
62
views
Who has the authority to approve risk levels?
From a basic understanding of risk management, a risk register records the risks of an organization, its mitigating controls, etc. Who has the authority to approve residual risk level ratings after ...
- 26.5k
0
votes
1
answer
422
views
What are the risks of allowing general users to add printers to their company laptops?
I work for a company with a large user base. There is a requirement to allow users to add printers to their laptops e.g. when working from home.
What are the security risks?
Is their a bad actor can ...
- 1
2
votes
0
answers
63
views
To what extent should security measures be ignored for the sake of operational efficiency? [closed]
I have recently started creating an online Tetris type of game, and I was wondering what amount of security I should implement for an online match. I am in a conflict where I want to make my game as ...
- 128k
2
votes
5
answers
5k
views
Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)
How do I express non-compliance to ISO 27002 chapter 5 as a risk?
The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
- 11
0
votes
1
answer
447
views
What is the impact of someone accidentally getting my IMEI number from my Android phone? [duplicate]
I have a concern regarding how risky it is if someone knows or has the copy of my 2 IMEI numbers. As we all know, on Android phones, the IMEI are at the back cover of the phone like a sticker.
So, my ...
- 341
0
votes
1
answer
115
views
Safety assessment vs. Security assessment. What's the difference?
The safety requirement confuses me when I look at security risk assessment methodologies. Looking at safety alone, it usually is related to the physical aspect and the physical interactions between a ...
- 9,297
0
votes
1
answer
170
views
Risk Assessment of Windows Cert Store
We all know that SmartCards protect private keys much better than any software-based solution. However, when it comes to the Windows Cert Store to be compared to SmartCards: how difficult is it for ...
- 135k
1
vote
0
answers
83
views
Do i place this service in the DMZ or datacentre(internal)?
I have setup a VM on our internal network and it is assigned an internal IP address. The VM requires connectivity to a couple of internet sites mainly Microsoft and ports are generally 80 and 443. ...
- 651
20
votes
6
answers
16k
views
When registering for most websites, why do you need to confirm your email address?
I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
- 269
1
vote
2
answers
393
views
A 3rd party supplier is asking us to install their VPN client onto our corporate machines to enable access to their environment, is this a good idea?
As per the question what are the risks?
if we did go ahead with this and some of our users installed a supplier's VPN client on to our corporate machines, once the connection is establish can a threat ...
- 368
3
votes
2
answers
1k
views
How to estimate threat and risk associated with that threat and not only vulnerability severity?
Having this simple formula Risk = Threat x Vulnerability x Information Value it is quite difficult to estimate risks quantitatively because of threat estimation seems to me the most difficult part.
I ...
- 19k
11
votes
3
answers
22k
views
What are PHP allow_url_fopen security risk?
Recently I was reading an article about file_get_contents and HTTPS.
One part that caught my attention is:
Of course, the allow_url_fopen setting also carries a separate risk of
enabling Remote ...
- 128k
41
votes
14
answers
7k
views
How to safely save passwords for a future administrator?
I am the volunteer IT administrator for a local non-profit organization. The organization has a few systems - specifically security cameras, network hardware, and telephones - that have local ...
- 201
1
vote
1
answer
160
views
What is the risk of using Windows Phone 8.1 now?
My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the ...
- 111
2
votes
5
answers
2k
views
Is there more of a security risk by providing an email when creating a new account?
With all of these recent breaches, I have been thinking about security best practices.
One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
CommunityBot
- 1
1
vote
1
answer
130
views
Font risk in unopened email in inbox
This is obviously not from PayPal, but the font in the word account displayed using odd looking font, is this a security risk to me that Outlook.com displayed this font? See below, Outlook has preview ...
- 560
1
vote
3
answers
3k
views
Security Risk Register
Does anyone know of any good Risk Registers to start logging security risk that are found on the fly?
The problem that I am having is that we find so much in a day, things start to get lost in ...
- 128k
3
votes
1
answer
140
views
Why are full port scans more susceptible to being logged than half-open port scans?
Many resources I come across state that one major advantage of full-port scans (e.g. SYN scans) is the fact that there is a lower risk of being logged. But why?
In my opinion, the sequence of ...
- 72.7k
0
votes
0
answers
126
views
Risk, threat, vulnerability with an example
Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate:
Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
- 65.4k
-2
votes
1
answer
165
views
Upgrading Software Version: risk of an unknown vs known vulnerabilities
Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software?
For example, with every software ...
- 128k
1
vote
2
answers
254
views
Security of using DHCP and non-standard ports for medical devices
I recently came across this comment written in a journal article.
Lastly, medical apparatus are expected to use Dynamic Host Configuration Protocol (DHCP) for the allocation of their IP ...
- 184
2
votes
2
answers
497
views
CVSS and chained vulnerabilities
Let's say a website has two vulnerabilities:
Information Disclosure
reflected XSS
Their impact by themselves is limited on the specific site, but when chained together, the impact is raised too high ...
- 2,185
2
votes
1
answer
1k
views
Can information security risks essentially only be triaged according to the CIA triangle?
Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
CommunityBot
- 1
2
votes
1
answer
109
views
What are the dangers of extending my PATH?
Are there any dangers of extending my PATH, say by adding /Users/me/bin?
- 199k
13
votes
7
answers
1k
views
Looking for Information security / risk management table top or card games [closed]
I am looking for table top or card games related to risk management or information security. A kind of "serious" game that can be used as a teaching tool of infosec/risk management.
I know only about ...
- 1
7
votes
3
answers
2k
views
What are the risk implications of not verifying referer header on login form?
Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
CommunityBot
- 1
6
votes
1
answer
8k
views
What are the risks of exposing the Docker for Windows daemon on localhost?
A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab.
There is a warning:
Exposing daemon on TCP ...
- 62.1k
4
votes
1
answer
177
views
How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?
The problems I see with the typical risk assessment are as follows:
Maintaining the list of assets updated
Maintaining the status of the treatments updated and the risk level
coherent with that.
...
- 128k
0
votes
2
answers
605
views
risk threat vulnerability
From ENISA - Threat and Risk Management
Identification, analysis and evaluation of these threats and
vulnerabilities are the only way to understand and measure the impact
of the risk involved ...
- 1,832
2
votes
1
answer
695
views
Sqlmap, update query and risk param
I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
- 5,100
1
vote
1
answer
492
views
Risk assessment Struggling with scenario
I have been given a situation (see below),The question i need to answer to complete the task is: What is the ALE for phishing emails for the company, in pounds; e.g. 203,760? When i multiply the ...
1
vote
2
answers
425
views
Risk and probability from CVE
How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14),
The cost is derived from the attack tree, and risk and probability are
based on CVE
...
- 128k
1
vote
3
answers
687
views
Risk Assessment Methodology ISO 27001
I would like to apply ISO 27001 best practices for a company that has not completed its final online architecture yet and it is still under development phase. However, they pretty much know which ...
- 10.3k
1
vote
0
answers
138
views
Advice for carrying out risk identification in ISO27005:2011
I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
- 128k
0
votes
1
answer
2k
views
I used 10minutemail and my own phone number, is there a risk?
I created a twitter account and used 10minuteemail, then twitter said my account was having automated behaviour, so I searched a temporary fake number to use but for the sake of lazyness I just put my ...
- 65.4k
0
votes
2
answers
473
views
Risk of infecting the host OS if the guest OS is out of date [duplicate]
I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...
- 7,858
-1
votes
1
answer
224
views
Does Bloatware on a brand new PC create security risks?
Some new computers come with software I don't need or want. It is not advertised as part of the product I am purchasing. Generally this is called Bloatware.
Bloatware
1.(n) Software that comes pre-...
CommunityBot
- 1
3
votes
1
answer
279
views
What is the risk of reusing the ATM Pin elsewhere when they tie to EMV cards?
What is the risk in the following scenario:
A bank wants to use an ATM pin (debit card and/or credit card) as an additional form of authentication after the customer logs in to her online/mobile ...
CommunityBot
- 1
1
vote
2
answers
254
views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
- 1,766
0
votes
1
answer
166
views
Risks for implementing single sign on
I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
CommunityBot
- 1
0
votes
1
answer
123
views
HIPAA non-business associate for contract work
I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
- 1,843
3
votes
0
answers
96
views
What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?
We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
- 153
3
votes
1
answer
1k
views
Is allow_url_fopen always a security risk?
Is allow_url_fopen always a security risk or only when you let others to insert URL?
like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
- 33
2
votes
1
answer
183
views
What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?
There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
- 7,858
0
votes
1
answer
164
views
Is there a way to calculate the complexity of an XSS-vector?
Is there a way to calculate/estimate the complexity of an XSS vector?
I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
- 65.4k