Hot answers tagged

8

The cost is not from the vulnerability but from the risk. Namely: A vulnerability is that which can potentially be exploited to put at risk your information assets (e.g. a buffer overflow). A threat is a context element which will try to snoop on or damage your information assets (e.g. an existing group of attackers who would benefit from such actions in ...


6

I'd like to respectfully offer a different perspective from the perfectly valid answer and comments already here. I'm reading between the lines a lot, but I believe the original question is trying to achieve quite a good (and difficult) thing - prioritize security awareness at departmental level, with objective measurements of awareness. The effect being ...


6

Essentially yes it is risk. If you choose to use a third party hosted JavaScript (one example is Google Analytics) in a secure page you open the door for information to be collected. That may involve a maliciously forged certificates or simply a change in the ga.js script by Google. You could consider the flow of you web application to try and push people ...


5

I only have auditing & review experience for ISO 27001 compliance but not for 31000, so my answer will focus on this one. To summarize, the answers are: Is the matching correct? Yes. Is it possible to use OSSTMM as a risk assessment methodology for ISO 27001/31000 ? It depends, see below. Any fundamental requirement that makes it impossible? No. ISO ...


5

Say all the metrics you listed in your question report zero. Does that mean your software is secure? Does finding 0 bugs mean there are no bugs? The reason you're having a hard time finding software-only metrics is because software doesn't exist in a vacuum. Here's a question that's just as difficult: How much is a piece of software worth? There ...


4

Well, obviously any estimate is going to fairly hand-wavy, since if we knew the existence of all bugs and could enumerate them, then the bugs probably wouldn't have shipped. So these bug counts are based on bugs found after the fact. Scrutinized software will naturally have proportionally more of its bugs discovered than rarely used software, so our ...


4

Recommendations to management need to be framed in terms of effort, costs, and risks. 'Best Practices' and marketing-speak will not communicate well on their own, so defining the problem in terms of effort, costs, and risks will keep everyone focused on the realities of the situation. Your 'outsider' is not helping the discussion with tossing around a ...


4

A good information security policy should very clearly state a number of things. At least the following: The reason why it was implemented its goals its scope its boundaries (the things it does not apply to) clear requirements towards the assets that are part of the scope controls that meet these requirements responsibilities There are (at least) two kinds ...


3

In a SaaS model, you will likely not be able to perform code audits. This is because as stated, it is Software as a Service. Not software where you would be able to download the software itself, let alone the source code for the software. That task would be done at the discretion of the software vendor, and or provider. Please see "5 Problems with SaaS ...


3

Andy Ozment has proposed an interesting security metric for software in his paper Bug auctions: Vulnerability markets reconsidered (WEIS 2004). Roughly speaking, his idea is that a software vendor sets a prize for the next vulnerability to be found. The prize starts from a fixed amount (e.g. 100$) and grows every day (e.g. 10$/day). When a vulnerability ...


3

That's not what the examiner expects, but one can say that the main factors that influence information security effectiveness are apathy, incompetence and boredom. The "right" answer for the exam, though, is whatever is in the corresponding guide book. Unfortunately, anything which talks about "main" or "most important" factors is an arbitrary judgement, ...


2

The nature of the question is vague, and the word 'model' is undefined in this case. But, I will endeavour to talk about Honeypots as a potential response to the question. A Honeypot (or series of Honeypots) is designed to allow a breach to occur in a safe environment. From this resource, the attack vector can be determined as well as an inference as to the ...


2

While the question is a bit general - the answer is yes. That is the good news, the bad news is that you will have to work. What do I mean? There is an excellent threat modeling tool called PTA - Practical threat analysis (you can download it from our web site www.software.co.il). If you follow the methodology of mapping assets, threats (breaches..), ...


2

This is an answer simply because the comment system is too short. I agree with Panther that "Security performance metrics" is essentially meaningless. Your company should have a security policy and a way to enforce said policy. Your employee manual should be clear as to the repercussions of violating those policies. Whether it's a slap on the wrist or ...


2

I think you may find that this question is so huge in function and scope that you won't find such definitive lists (though I'd also love to see one.) Publicly, you are more likely to find mean-(time-to or between)-failure of hardware than for software simply because physical engineering will be concerned with those figures during the life-cycle. Of course, ...


2

Yes, it's not got a distinct meaning in information security - from dictionary.com: the determination of priorities for action So, deal with the most critical problems first, working down the list of known issues, trying to minimise the overall problems you can face. Usually goes something along the lines of: Make sure no-one else can get into the ...


1

I opted for Cuckoo to automatize running the software on the guest machine and wrote a custom auxiliary analysis script to collect those metrics every second. The way to collect data is thus as secure as Cuckoo is so I guess better solutions could be found but at least there is a possibility to stream them as they are collected so that, in case of loss of ...


1

Because guard relays (also called entry relays) can never be exit relays. If you use a proxy or VPN, you have some anonymity, but also a single point of failure. If someone compromises the machine doing the relaying, they know your IP and the IP of where you're going. Tor protects against that by having at least 3 proxies in between (relays): You---[ Tor ...


1

I can think of following scenarios: Safety against SQL injection and login related attacks if your software has user accounts The accuracy and robustness of your access control if your software has users


1

There can never be a straightforward calculation for this. For example if you look at the LogJam attack and rainbow tables it is quite clear that there is a clear trade-off and breakdown in the resources that can be invested to crack 'every' encryption event and the resources required to crack one encryption event. Obviously each cypher and protocol (and ...


1

I know this is old, but I still found it on Google while searching, so here is my opinion: Today there's multiple bug bounty programs, in which, for obvious reasons, they need to measure the weight of the information and data that they receive from the ethical hackers and provide to their customers. As we all know, information is a difficult asset to ...


1

Pinning a cost on an exploit is usually going to involve (many) meetings with business users and in the end it's just an educated guess. You might be able to estimate the cost of a 4 hour business disruption due to a denial of service attack however for something like a website defacement you would have to have a chat with management and/or public relations ...


Only top voted, non community-wiki answers of a minimum length are eligible