Questions tagged [risk]
The risk tag has no usage guidance.
112
questions
41
votes
14
answers
8k
views
How to safely save passwords for a future administrator?
I am the volunteer IT administrator for a local non-profit organization. The organization has a few systems - specifically security cameras, network hardware, and telephones - that have local ...
- 1,370
26
votes
7
answers
33k
views
Is malware distributed with pirated software actually common?
An often-repeated piece of conventional wisdom goes like the following.
Don't download pirated software, they often contain malware.
I'm curious to know if there are any hard facts to backup this ...
- 8,844
20
votes
6
answers
17k
views
When registering for most websites, why do you need to confirm your email address?
I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
- 1,385
20
votes
7
answers
5k
views
Can I trust DNS servers?
If I use my own VPN and use third party DNS - can I trust it?
For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...
- 507
19
votes
3
answers
3k
views
How to convince my management of a physical security risk?
While I do not claim to be an expert in all things security based, I'd think that I have a good grounded knowledge of what is acceptable and what is not in regards to digital security.
After giving ...
- 473
15
votes
7
answers
3k
views
What risk rating models are used for calculating risk scores of web vulnerabilities?
What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
- 6,745
13
votes
5
answers
1k
views
What is the risk of giving USB drives as promotional items by a healthcare provider
There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010.
Besides this, if a healthcare company ...
- 131
13
votes
7
answers
1k
views
Looking for Information security / risk management table top or card games [closed]
I am looking for table top or card games related to risk management or information security. A kind of "serious" game that can be used as a teaching tool of infosec/risk management.
I know only about ...
- 599
12
votes
4
answers
3k
views
Are short usernames a security concern?
I was somewhat suprised that the sysadmin approved a one-letter username like "m" and my username is also short ("nik"). I think that if usernames are brute force attacked then the username should ...
11
votes
1
answer
1k
views
Security risks replying to emails using a personal account
I happen to have a very common name.
I own the corresponding gmail account @gmail.com and I regularly receive emails meant for someone else.
Because they very often seem to contain important ...
- 655
11
votes
3
answers
23k
views
What are PHP allow_url_fopen security risk?
Recently I was reading an article about file_get_contents and HTTPS.
One part that caught my attention is:
Of course, the allow_url_fopen setting also carries a separate risk of
enabling Remote ...
- 7,021
8
votes
5
answers
4k
views
Does "risk score" always have to be a numerical value?
In the context of organisational IT security, for a threat such as the insider threat, is it actually okay to report (in a risk assessment) as "Risk Score=Medium" or does "risk score&...
- 1,059
7
votes
3
answers
2k
views
What are the risk implications of not verifying referer header on login form?
Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
- 15.4k
7
votes
3
answers
3k
views
Does a working JTAG diagnostics port on Android phone add unnecessary risk?
Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.
...
- 381
7
votes
1
answer
2k
views
How big is the risk of hash fixed points/cycles?
It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
- 3,035
7
votes
1
answer
8k
views
What are the risks of exposing the Docker for Windows daemon on localhost?
A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab.
There is a warning:
Exposing daemon on TCP ...
- 201
7
votes
2
answers
1k
views
What are the security benefits or risks of HTTP/2?
Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
- 6,745
6
votes
4
answers
824
views
Security of Cloud Storage
What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
- 776
6
votes
2
answers
10k
views
How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?
Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)?
As well as converting ...
- 6,745
6
votes
2
answers
4k
views
Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data
I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
- 61
5
votes
2
answers
7k
views
What is the security risk of enabling persistent connection (HTTP Keep-Alive)?
By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is ...
4
votes
2
answers
3k
views
Do high-level programming languages have more vulnerabilities or security risks than low-level languages? [closed]
Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why?
Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/...
- 6,745
4
votes
3
answers
691
views
Are revealed personal emails a security risk?
I am a minor recently employed by a retail company, in the same batch as 10* other new recruits. I have not yet had the first day, however our manager has sent us all a warm welcoming email.
The ...
- 43
4
votes
1
answer
380
views
Is there a security risk using a Symmetric-key for both encryption and HMACing
I am proposing to use an AES key to encrypt some data to send to a third party and in a completely separate operation/flow use the same key to create a HMAC of a message to send to the same third ...
- 143
4
votes
3
answers
234
views
Does allowing everyone know when a server process was started pose a security risk?
I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
- 2,251
4
votes
1
answer
424
views
Should a user be able to reset his password if his email address has not been verified yet?
Please consider a scenario where a user signs up for a web application with his email and password. After registration the user is sent a confirmation email which requires a login/session to confirm ...
- 141
4
votes
3
answers
4k
views
Why is it dangerous to let an internal server talk to the internet (to a specific IP)?
Sort of a basic question, but if we have an internal server and want it to talk externally, for example to get new packages. This environment normally does not have access to the internet. I've heard ...
- 151
4
votes
1
answer
202
views
How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?
The problems I see with the typical risk assessment are as follows:
Maintaining the list of assets updated
Maintaining the status of the treatments updated and the risk level
coherent with that.
...
- 251
4
votes
0
answers
163
views
What are the security implication of implementing an IVR functionality in my application?
I am planning to implement an Interactive Voice Recognition (IVR) functionality in my python-based application. I will be using IVR as a backup verification method or when a user is going to setup her ...
- 310
3
votes
1
answer
9k
views
Relationship between CVSS and Risk Level in Nessus output data
In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have?
Thank yo
- 33
3
votes
1
answer
3k
views
What does the EC_POINT_FORMAT TLS extension protect against and what is the risk of not using it?
The SSL test of htbridge pointed out that the server supports the elliptic curves but not the EC_POINT_FORMAT TLS extension.
What does that TLS extension protect against? What is the (potential) risk ...
- 6,745
3
votes
1
answer
190
views
Why are full port scans more susceptible to being logged than half-open port scans?
Many resources I come across state that one major advantage of full-port scans (e.g. SYN scans) is the fact that there is a lower risk of being logged. But why?
In my opinion, the sequence of ...
- 45
3
votes
1
answer
1k
views
Is allow_url_fopen always a security risk?
Is allow_url_fopen always a security risk or only when you let others to insert URL?
like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
- 33
3
votes
1
answer
638
views
CVSS Score Remote or Local Scenario
I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
- 1,130
3
votes
2
answers
1k
views
Will a crossdomain.xml file reduce a potential security risk?
I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
- 6,745
3
votes
2
answers
1k
views
How to estimate threat and risk associated with that threat and not only vulnerability severity?
Having this simple formula Risk = Threat x Vulnerability x Information Value it is quite difficult to estimate risks quantitatively because of threat estimation seems to me the most difficult part.
I ...
- 131
3
votes
1
answer
312
views
What is the risk of reusing the ATM Pin elsewhere when they tie to EMV cards?
What is the risk in the following scenario:
A bank wants to use an ATM pin (debit card and/or credit card) as an additional form of authentication after the customer logs in to her online/mobile ...
3
votes
0
answers
119
views
What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?
We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
- 153
2
votes
3
answers
4k
views
Can risk mitigation controls bring down the impact?
While doing a Risk Assessment, I found that in some old RA documents, after controls have been placed, the Impact in the forcasted value was changed that did not make sense to me. To me the impact ...
- 707
2
votes
1
answer
1k
views
Can information security risks essentially only be triaged according to the CIA triangle?
Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
- 6,745
2
votes
1
answer
138
views
What are the dangers of extending my PATH?
Are there any dangers of extending my PATH, say by adding /Users/me/bin?
- 1,680
2
votes
1
answer
209
views
What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?
There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
2
votes
5
answers
5k
views
Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)
How do I express non-compliance to ISO 27002 chapter 5 as a risk?
The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
- 10.7k
2
votes
5
answers
2k
views
Is there more of a security risk by providing an email when creating a new account?
With all of these recent breaches, I have been thinking about security best practices.
One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
- 907
2
votes
3
answers
3k
views
Business process based risk assessment methodology for iso 27001:2013 [closed]
I am working on an isms implementation for iso 27001:2013. So far whatever risk assessment approaches i have used asset based in which methodology focuses on asset value evaluation, threats, ...
- 51
2
votes
2
answers
203
views
What is the boundary between Information Security and Quality Control regarding Integrity?
I was in a recent dispute with the CIO regarding this (I work as an InfoSec Officer).
There was an issue when one of our devs published erroneous code in production due to user error (copy-paste sort ...
- 94
2
votes
1
answer
109
views
Classifying risk associated with specific users
I understand the concept of classifying our data and associating degrees of risk with different classes of data. My question is this - is there a precedent for classifying users the same way? ...
- 23
2
votes
2
answers
585
views
CVSS and chained vulnerabilities
Let's say a website has two vulnerabilities:
Information Disclosure
reflected XSS
Their impact by themselves is limited on the specific site, but when chained together, the impact is raised too high ...
- 141
2
votes
1
answer
783
views
Sqlmap, update query and risk param
I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
- 23
2
votes
1
answer
260
views
Any risks of reading arbitrary emails in HTML format?
Emails can be sent with email software (via corresponding setting of a parameter in the software) in HTML format instead of the normal text format. Are there any risks of reading arbitrary (malicious) ...
- 1,229