Questions tagged [risk]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
21
votes
7answers
13k views

Is malware distributed with pirated software actually common?

An often-repeated piece of conventional wisdom goes like the following. Don't download pirated software, they often contain malware. I'm curious to know if there are any hard facts to backup this ...
18
votes
3answers
3k views

How to convince my management of a physical security risk?

While I do not claim to be an expert in all things security based, I'd think that I have a good grounded knowledge of what is acceptable and what is not in regards to digital security. After giving ...
18
votes
7answers
4k views

Can I trust DNS servers?

If I use my own VPN and use third party DNS - can I trust it? For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...
15
votes
5answers
11k views

When registering for most websites, why do you need to confirm your email address?

I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
14
votes
7answers
2k views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
13
votes
5answers
841 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...
13
votes
7answers
1k views

Looking for Information security / risk management table top or card games [closed]

I am looking for table top or card games related to risk management or information security. A kind of "serious" game that can be used as a teaching tool of infosec/risk management. I know only about ...
11
votes
4answers
2k views

Are short usernames a security concern?

I was somewhat suprised that the sysadmin approved a one-letter username like "m" and my username is also short ("nik"). I think that if usernames are brute force attacked then the username should ...
11
votes
1answer
840 views

Security risks replying to emails using a personal account

I happen to have a very common name. I own the corresponding gmail account @gmail.com and I regularly receive emails meant for someone else. Because they very often seem to contain important ...
9
votes
2answers
11k views

What are PHP allow_url_fopen security risk?

Recently I was reading an article about file_get_contents and HTTPS. One part that caught my attention is: Of course, the allow_url_fopen setting also carries a separate risk of enabling Remote ...
7
votes
3answers
1k views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
7
votes
3answers
3k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
6
votes
1answer
1k views

How big is the risk of hash fixed points/cycles?

It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
6
votes
2answers
813 views

What are the security benefits or risks of HTTP/2?

Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
6
votes
2answers
3k views

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
5
votes
4answers
662 views

Security of Cloud Storage

What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
4
votes
3answers
204 views

Are revealed personal emails a security risk?

I am a minor recently employed by a retail company, in the same batch as 10* other new recruits. I have not yet had the first day, however our manager has sent us all a warm welcoming email. The ...
4
votes
1answer
284 views

Is there a security risk using a Symmetric-key for both encryption and HMACing

I am proposing to use an AES key to encrypt some data to send to a third party and in a completely separate operation/flow use the same key to create a HMAC of a message to send to the same third ...
4
votes
3answers
167 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
4
votes
1answer
172 views

Should a user be able to reset his password if his email address has not been verified yet?

Please consider a scenario where a user signs up for a web application with his email and password. After registration the user is sent a confirmation email which requires a login/session to confirm ...
4
votes
3answers
2k views

Why is it dangerous to let an internal server talk to the internet (to a specific IP)?

Sort of a basic question, but if we have an internal server and want it to talk externally, for example to get new packages. This environment normally does not have access to the internet. I've heard ...
4
votes
1answer
125 views

How can I do a maintainable and significant risk assessment in an organisation with thousands of assets?

The problems I see with the typical risk assessment are as follows: Maintaining the list of assets updated Maintaining the status of the treatments updated and the risk level coherent with that. ...
4
votes
2answers
3k views

What is the security risk of enabling persistent connection (HTTP Keep-Alive)?

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is ...
4
votes
0answers
104 views

What are the security implication of implementing an IVR functionality in my application?

I am planning to implement an Interactive Voice Recognition (IVR) functionality in my python-based application. I will be using IVR as a backup verification method or when a user is going to setup her ...
3
votes
1answer
7k views

Relationship between CVSS and Risk Level in Nessus output data

In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have? Thank yo
3
votes
2answers
4k views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
3
votes
1answer
388 views

Is allow_url_fopen always a security risk?

Is allow_url_fopen always a security risk or only when you let others to insert URL? like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
3
votes
1answer
203 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
3
votes
2answers
904 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
3
votes
1answer
157 views

What is the risk of reusing the ATM Pin elsewhere when they tie to EMV cards?

What is the risk in the following scenario: A bank wants to use an ATM pin (debit card and/or credit card) as an additional form of authentication after the customer logs in to her online/mobile ...
2
votes
2answers
2k views

Do high-level programming languages have more vulnerabilities or security risks than low-level languages? [closed]

Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why? Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/...
2
votes
3answers
2k views

Can risk mitigation controls bring down the impact?

While doing a Risk Assessment, I found that in some old RA documents, after controls have been placed, the Impact in the forcasted value was changed that did not make sense to me. To me the impact ...
2
votes
4answers
2k views

Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)

How do I express non-compliance to ISO 27002 chapter 5 as a risk? The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
2
votes
1answer
877 views

Can information security risks essentially only be triaged according to the CIA triangle?

Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
2
votes
1answer
123 views

What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?

There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
2
votes
4answers
949 views

Is there more of a security risk by providing an email when creating a new account?

With all of these recent breaches, I have been thinking about security best practices. One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
2
votes
3answers
3k views

Business process based risk assessment methodology for iso 27001:2013 [closed]

I am working on an isms implementation for iso 27001:2013. So far whatever risk assessment approaches i have used asset based in which methodology focuses on asset value evaluation, threats, ...
2
votes
1answer
52 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
2
votes
2answers
93 views

What is the boundary between Information Security and Quality Control regarding Integrity?

I was in a recent dispute with the CIO regarding this (I work as an InfoSec Officer). There was an issue when one of our devs published erroneous code in production due to user error (copy-paste sort ...
2
votes
1answer
43 views

Classifying risk associated with specific users

I understand the concept of classifying our data and associating degrees of risk with different classes of data. My question is this - is there a precedent for classifying users the same way? ...
2
votes
1answer
1k views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
2
votes
1answer
66 views

Any risks of reading arbitrary emails in HTML format?

Emails can be sent with email software (via corresponding setting of a parameter in the software) in HTML format instead of the normal text format. Are there any risks of reading arbitrary (malicious) ...
2
votes
1answer
285 views

How to overcome the risk of account being compromised using OTP when mobile device is stolen

What is the preferred way to provide a "password reset" functionality for an application installed on a mobile device? In mobile applications, generally password reset works by sending OTP to the ...
2
votes
2answers
36 views

What are the risks of running Team Fundation Server on HTTP?

if TFS is installed using HTTP but only accessible from inside a LAN with Windows authentication, is it possible that a user impersonate someone else? what are other risks?
2
votes
0answers
47 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
2
votes
0answers
67 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network.
2
votes
0answers
148 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
1
vote
1answer
141 views

How could one determine if a web page is vulnerable?

Suppose that we have a web page. This page could be vulnerable to any attack such as SQLI. By looking the HTML code of the page, we can find some input elements that could be used by attackers to ...
1
vote
2answers
96 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
1
vote
3answers
1k views

Security Risk Register

Does anyone know of any good Risk Registers to start logging security risk that are found on the fly? The problem that I am having is that we find so much in a day, things start to get lost in ...