Questions tagged [risk]
The risk tag has no usage guidance.
109
questions
3
votes
1
answer
542
views
CVSS Score Remote or Local Scenario
I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
- 1,100
1
vote
1
answer
555
views
Security risks of multitenancy
Is there a security risk of using same firewall hardware as the company perimeter firewall device (providing multi-tenancy) which is already shared by other companies? Is there a possibility of being ...
- 11
0
votes
1
answer
2k
views
I used 10minutemail and my own phone number, is there a risk?
I created a twitter account and used 10minuteemail, then twitter said my account was having automated behaviour, so I searched a temporary fake number to use but for the sake of lazyness I just put my ...
7
votes
2
answers
1k
views
What are the security benefits or risks of HTTP/2?
Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
- 6,661
2
votes
1
answer
198
views
Any risks of reading arbitrary emails in HTML format?
Emails can be sent with email software (via corresponding setting of a parameter in the software) in HTML format instead of the normal text format. Are there any risks of reading arbitrary (malicious) ...
- 1,209
1
vote
1
answer
254
views
How does someone conduct a risk assessment of a B2B Integration?
I'm not very familiar with B2B integrations. No one in our small organization is, but we need to conduct some assessments. How does one assess a B2B integration? It seems like there would be gaps ...
- 71
1
vote
0
answers
106
views
Multiple Frameworks for Risk Assessments?
My organization utilizes Risk Assessments as the catalyst for a lot of our Information Security efforts. Currently we assess applications using the cloud security alliance's CAIQ framework and ...
- 71
2
votes
1
answer
1k
views
Can information security risks essentially only be triaged according to the CIA triangle?
Can information security risks essentially only be triaged according to the CIA triangle (Confidentiality, Integrity and Availability) or are there other possibilities?
- 6,661
1
vote
1
answer
165
views
Reducing risk from logging
I am following the OWASP Risk methodology and have the threat "Installed software exploitation". I've created this risk based on the idea that a risk is found in say phpMyAdmin which can be exploited.
...
- 115
5
votes
2
answers
6k
views
What is the security risk of enabling persistent connection (HTTP Keep-Alive)?
By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is ...
0
votes
1
answer
218
views
Dilbert's Pointy-Haired Boss & Influencing executive perspectives on Information Security
In Scott Adam's cartoon Dilbert the Pointy-haired Boss has no name because Scott Adam's wanted his readers to relate the boss character to bosses known to the readers.
This is pointed out because (...
- 503
1
vote
3
answers
686
views
Risk Assessment Methodology ISO 27001
I would like to apply ISO 27001 best practices for a company that has not completed its final online architecture yet and it is still under development phase. However, they pretty much know which ...
4
votes
1
answer
331
views
Should a user be able to reset his password if his email address has not been verified yet?
Please consider a scenario where a user signs up for a web application with his email and password. After registration the user is sent a confirmation email which requires a login/session to confirm ...
- 141
1
vote
1
answer
144
views
Risk in FTP connect
excuse me the question perhaps beginner, but came out a doubt. One person asked me to edit your site, but it was very strange story and did not know this person yet ... When I connect me by filezilla, ...
- 11
0
votes
1
answer
107
views
What is the risk of unlimited email event triggering?
Let's say I can trigger a mail event in a few scenario's without any a limit on that trigger. For example at:
Registration
Password reset
Newsletter subscription
The "registration" and "newsletter ...
- 6,661
4
votes
2
answers
3k
views
Do high-level programming languages have more vulnerabilities or security risks than low-level languages? [closed]
Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why?
Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/...
- 6,661
1
vote
1
answer
2k
views
How do companies deal with storing their source code on GitHub from a data-loss risk management point-of-view? [closed]
When it comes to storing my data "in the cloud" (aka: on someone else's server), I alway have kind of a bad feeling that something like "Google's deleted an artist's blog, along with 14 years of his ...
- 2,686
0
votes
1
answer
164
views
Is there a way to calculate the complexity of an XSS-vector?
Is there a way to calculate/estimate the complexity of an XSS vector?
I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
- 6,661
26
votes
7
answers
32k
views
Is malware distributed with pirated software actually common?
An often-repeated piece of conventional wisdom goes like the following.
Don't download pirated software, they often contain malware.
I'm curious to know if there are any hard facts to backup this ...
- 8,834
2
votes
5
answers
2k
views
Is there more of a security risk by providing an email when creating a new account?
With all of these recent breaches, I have been thinking about security best practices.
One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
- 907
2
votes
1
answer
406
views
How to overcome the risk of account being compromised using OTP when mobile device is stolen
What is the preferred way to provide a "password reset" functionality for an application installed on a mobile device?
In mobile applications, generally password reset works by sending OTP to the ...
- 21
0
votes
2
answers
245
views
Is exposing the default plesk page dangerous?
Is exposing the default plesk page on an IP dangerous? I can imagine it is somehow usable for fingerprinting a version maybe. But is it dangerous anyhow?
- 6,661
1
vote
1
answer
212
views
Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?
When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com):
Accepts Abuse Address
WARNING: Found mail servers which are not ...
- 6,661
15
votes
7
answers
3k
views
What risk rating models are used for calculating risk scores of web vulnerabilities?
What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
- 6,661
6
votes
2
answers
9k
views
How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?
Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)?
As well as converting ...
- 6,661
20
votes
7
answers
5k
views
Can I trust DNS servers?
If I use my own VPN and use third party DNS - can I trust it?
For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...
- 507
2
votes
1
answer
85
views
Classifying risk associated with specific users
I understand the concept of classifying our data and associating degrees of risk with different classes of data. My question is this - is there a precedent for classifying users the same way? ...
- 23
2
votes
3
answers
3k
views
Business process based risk assessment methodology for iso 27001:2013 [closed]
I am working on an isms implementation for iso 27001:2013. So far whatever risk assessment approaches i have used asset based in which methodology focuses on asset value evaluation, threats, ...
- 51
4
votes
3
answers
4k
views
Why is it dangerous to let an internal server talk to the internet (to a specific IP)?
Sort of a basic question, but if we have an internal server and want it to talk externally, for example to get new packages. This environment normally does not have access to the internet. I've heard ...
- 151
4
votes
1
answer
357
views
Is there a security risk using a Symmetric-key for both encryption and HMACing
I am proposing to use an AES key to encrypt some data to send to a third party and in a completely separate operation/flow use the same key to create a HMAC of a message to send to the same third ...
- 143
2
votes
2
answers
85
views
What are the risks of running Team Fundation Server on HTTP?
if TFS is installed using HTTP but only accessible from inside a LAN with Windows authentication, is it possible that a user impersonate someone else? what are other risks?
- 121
11
votes
3
answers
22k
views
What are PHP allow_url_fopen security risk?
Recently I was reading an article about file_get_contents and HTTPS.
One part that caught my attention is:
Of course, the allow_url_fopen setting also carries a separate risk of
enabling Remote ...
- 6,981
4
votes
0
answers
146
views
What are the security implication of implementing an IVR functionality in my application?
I am planning to implement an Interactive Voice Recognition (IVR) functionality in my python-based application. I will be using IVR as a backup verification method or when a user is going to setup her ...
- 310
1
vote
1
answer
296
views
How could one determine if a web page is vulnerable?
Suppose that we have a web page. This page could be vulnerable to any attack such as SQLI. By looking the HTML code of the page, we can find some input elements that could be used by attackers to ...
1
vote
0
answers
470
views
What are the risks of adding third-party Root CA certificate into NTAuth Store?
What are the risks associated with importing a third-party Root CA certificate into the Enterprise NTAuth Store in a Windows Active Directory domain?
(Except that the CA is then trusted to issue ...
2
votes
0
answers
121
views
Risks associated with switching ISPs/Telco providers
What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any?
This is in relation to a larger organisation with a wide area network.
- 459
2
votes
0
answers
196
views
Suspicious web-application requests containing encoded JavaScript function(?)
I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before.
The raw requests were variations of:
...
- 21
0
votes
1
answer
146
views
What is a good risk assessment for different types of online file references?
Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
- 6,661
12
votes
4
answers
3k
views
Are short usernames a security concern?
I was somewhat suprised that the sysadmin approved a one-letter username like "m" and my username is also short ("nik"). I think that if usernames are brute force attacked then the username should ...
3
votes
2
answers
1k
views
Will a crossdomain.xml file reduce a potential security risk?
I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
- 6,661
19
votes
3
answers
3k
views
How to convince my management of a physical security risk?
While I do not claim to be an expert in all things security based, I'd think that I have a good grounded knowledge of what is acceptable and what is not in regards to digital security.
After giving ...
- 473
3
votes
1
answer
9k
views
Relationship between CVSS and Risk Level in Nessus output data
In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have?
Thank yo
- 33
1
vote
4
answers
795
views
If malware was detected in browser local storage does computer need to be nuked from orbit
I haven't used Windows partition since mid-June and I booted the system once again just a few days ago. My first action was as usual update all programs marked to be updated (including Windows updates)...
- 125
1
vote
1
answer
1k
views
I left my debit card unattended -- how exposed am I?
I yesterday visited a restaurant I usually visit, but it seems that after paying with my debit card, I accidentally left it there. Today (almost 24 hours later) I had realized that I didn't have it ...
- 265
1
vote
3
answers
847
views
Is forwarding a port(s) a security risk to all computers on the network or just one?
I know forwarding ports can add some security risk, but if I forward a port to a computer, say running linux, would it add a security risk to all computers on my network or just the one?
logank9
-5
votes
1
answer
297
views
Is it possible to hack my encrypted session and hijack the session by electromagnetic waves? [closed]
I'm concerned about microwave technologies nowadays and suspicious matter happend.
So, I have several questions. Could you tell me about my question in below if you know.
Question:
Is it possible ...
- 107
2
votes
3
answers
3k
views
Can risk mitigation controls bring down the impact?
While doing a Risk Assessment, I found that in some old RA documents, after controls have been placed, the Impact in the forcasted value was changed that did not make sense to me. To me the impact ...
- 707
-1
votes
4
answers
230
views
Control over IT security
In pharmacy the safety of drugs is under fairly tight control by national authorities, e.g. FDA in US. The risks of patients taking drugs are thus very effectively minimized, though understandably ...
- 1,209
0
votes
1
answer
255
views
Risks of software backdoors [closed]
Risks of backdoors in software are evident ever since Ken Thompson's Turing Award Lecture "Reflections on Trusting Trust". Certainly this applies to hardware just as well.
Limiting ourselves here to ...
- 1,209
7
votes
3
answers
2k
views
What are the risk implications of not verifying referer header on login form?
Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
- 15.3k