Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.
138 votes
Accepted

Why should browser security be prioritized?

Can you explain why browser security should be placed on the top priority ... Because the browser is processing lots of untrusted content from the internet. Of course, if you use any other programs ...
user avatar
90 votes

Why is it bad to connect internal systems to the Internet?

First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily ...
user avatar
  • 14.1k
75 votes

How to deal with low-probability high-impact risks?

Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to ...
user avatar
  • 48.8k
62 votes

How to create a company culture that cares about information security?

High Level Culture In my experience, shifting a security culture takes 3 steps: Get management buy-in to do things differently Get personal management engagement to lead the way on what is important ...
user avatar
  • 123k
56 votes

How to deal with low-probability high-impact risks?

A warning that this response is coming from theory, not experience. Are there ethical consequences regarding the impact of the bad event on others? Will it hurt your users? Also consider the ...
user avatar
  • 657
53 votes

What's the danger of having some random, out of my control, JavaScript code running on my pages?

Risk In the worst scenario, it could render website completely inaccessible for the users, it could perform particular actions as them (for example, requesting account removal, spending money) or it ...
user avatar
  • 591
39 votes

Is ignoring a threat you cannot defend from a valid strategy?

You would never ignore a threat, and perhaps that is semantics over your wording. You either accept, mitigate, or outsource the risk for the given threat. In this case, that would be: accept that ...
user avatar
37 votes
Accepted

Evaluating the security of home security cameras

Like most embedded hardware (routers, etc), their firmware often sucks, and unless you have unlimited time I'm afraid there is no way to thoroughly check every single camera out there. And even if you ...
user avatar
  • 12.7k
33 votes

How to create a company culture that cares about information security?

Think of your users as customers. You are helping them meet their business requirements to secure data. That means it's your job to keep the requirements placed on them as sensible, justified and ...
user avatar
  • 817
30 votes

What are the real physical risks of casual social media publishing?

When looking for actual physical risks, doxing and the results are most important. There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything ...
user avatar
  • 14.3k
25 votes

How to deal with low-probability high-impact risks?

You should be taking into account the fact that your team knows about this attack vector. If simply knowing about the vulnerability makes it easier to execute the attack, you may have a bigger ...
user avatar
24 votes

Why is it bad to connect internal systems to the Internet?

Are there some reasons that connecting internal systems directly to the internet is a bad thing? You're unnecessarily increasing the attack surface. Here are problems to consider: An attacker who ...
user avatar
  • 43.6k
21 votes

Why should browser security be prioritized?

Not all the websites you visit have certificates. You can’t smell fishy websites. Certificate doesn’t mean the site isn’t trying to hack you. The browser is the biggest attack vector against your ...
user avatar
  • 1,823
19 votes

Why should browser security be prioritized?

Each of your statements is making a false assumption here: Most of the websites I visit have SSL certificate. This is great, but SSL/TLS only protects you against certain types of attacks. Pretty much,...
user avatar
15 votes

What are the real physical risks of casual social media publishing?

For example, I had experienced this in my practice: When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for ...
user avatar
  • 161
14 votes

Is ignoring a threat you cannot defend from a valid strategy?

TL;DR: NO (but we should define what "ignoring" means; from the text of the question I suspect we're actually of the same opinion). You do not "ignore" a threat. The ancient saw says that you do not ...
user avatar
  • 22.5k
13 votes
Accepted

Is exposing website performance data a security risk?

So I have to admit that my first reaction was "I would never do this." That, however, may be more because I, historically, don't like to let anybody know anything they don't need to, than for any ...
user avatar
  • 35.5k
13 votes

How to create a company culture that cares about information security?

This is a really difficult issue, but if you have the chance to change things, you should give it all you've got. You can't change a culture overnight. However, there are steps you can take to begin ...
user avatar
  • 22.5k
13 votes

How to deal with low-probability high-impact risks?

You have choosen the correct approach: Now usually we gauged such problems by multiplying probability of occurrence by the expected damage... and just faced its limits: we are lost trying to ...
user avatar
12 votes
Accepted

What are the real physical risks of casual social media publishing?

The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house ...
user avatar
  • 4,185
11 votes

Evaluating the security of home security cameras

This started off as a comment on Andre's answer, but it got a bit long. USB is fine as long as none of the cameras are more than 16 foot from the host :) Since you need to run power out to the ...
user avatar
  • 18.3k
11 votes

How to deal with low-probability high-impact risks?

Your first step would be to make a proper, quantitative risk analysis. Other answers have already provided pointers here, I especially want to support the mentioning of "How to Measure Anything in ...
user avatar
  • 9,994
10 votes

Is ignoring a threat you cannot defend from a valid strategy?

There are four basic strategies to control risks: Avoidance: Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability Transference: Shifting the risk to ...
user avatar
10 votes

Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?

Low discoverability doesn't necessarily mean "security by obscurity". It could just mean that the vulnerability lies deep in a portion of functionality that's rarely ever investigated. It could also ...
user avatar
  • 654
9 votes

Evaluating the security of home security cameras

EDIT - Modified this answer slightly (now three parts) Low Budget Version Pick up a used router (laying around the house?), install dd-wrt on it and turn off the WiFi. Bingo, ready made 4 port ...
user avatar
9 votes

What are the real physical risks of casual social media publishing?

One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to ...
user avatar
  • 197
8 votes
Accepted

Security analysis of Dashlane

A security analysis was performed in May 2016: Security Analysis of Dashlane by Paolo Gentili, Sarah Shader, Richard Yip, Brandon Zeng That analysis attempts to look for largely the same types of ...
user avatar
  • 196
8 votes

What's the danger of having some random, out of my control, JavaScript code running on my pages?

What's the worst thing that can happen? The third party can do anything that you could do with JavaScript - or anything an attacker could do with XSS. This includes stealing cookies, injecting a ...
user avatar
  • 29k
8 votes
Accepted

Do high-level programming languages have more vulnerabilities or security risks than low-level languages?

Major Caveat upfront: It is possible to be insecure in any language, any time, and only developer attentiveness/awareness can fix this. SQL injection is still a thing. Higher-level languages ...
user avatar
  • 1,978

Only top scored, non community-wiki answers of a minimum length are eligible