138
votes
Accepted
Why should browser security be prioritized?
Can you explain why browser security should be placed on the top priority ...
Because the browser is processing lots of untrusted content from the internet.
Of course, if you use any other programs ...
- 181k
90
votes
Why is it bad to connect internal systems to the Internet?
First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily ...
- 14.1k
75
votes
How to deal with low-probability high-impact risks?
Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to ...
- 48.8k
62
votes
How to create a company culture that cares about information security?
High Level Culture
In my experience, shifting a security culture takes 3 steps:
Get management buy-in to do things differently
Get personal management engagement to lead the way on what is important
...
- 123k
56
votes
How to deal with low-probability high-impact risks?
A warning that this response is coming from theory, not experience.
Are there ethical consequences regarding the impact of the bad event on others? Will it hurt your users? Also consider the ...
- 657
53
votes
What's the danger of having some random, out of my control, JavaScript code running on my pages?
Risk
In the worst scenario, it could render website completely inaccessible for the users, it could perform particular actions as them (for example, requesting account removal, spending money) or it ...
- 591
39
votes
Is ignoring a threat you cannot defend from a valid strategy?
You would never ignore a threat, and perhaps that is semantics over your wording. You either accept, mitigate, or outsource the risk for the given threat.
In this case, that would be:
accept that ...
- 447
37
votes
Accepted
Evaluating the security of home security cameras
Like most embedded hardware (routers, etc), their firmware often sucks, and unless you have unlimited time I'm afraid there is no way to thoroughly check every single camera out there. And even if you ...
- 12.7k
33
votes
How to create a company culture that cares about information security?
Think of your users as customers. You are helping them meet their business requirements to secure data. That means it's your job to keep the requirements placed on them as sensible, justified and ...
- 817
30
votes
What are the real physical risks of casual social media publishing?
When looking for actual physical risks, doxing and the results are most important.
There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything ...
- 14.3k
25
votes
How to deal with low-probability high-impact risks?
You should be taking into account the fact that your team knows about this attack vector.
If simply knowing about the vulnerability makes it easier to execute the attack, you may have a bigger ...
- 351
24
votes
Why is it bad to connect internal systems to the Internet?
Are there some reasons that connecting internal systems directly to the internet is a bad thing?
You're unnecessarily increasing the attack surface.
Here are problems to consider:
An attacker who ...
- 43.6k
21
votes
Why should browser security be prioritized?
Not all the websites you visit have certificates. You can’t smell fishy websites. Certificate doesn’t mean the site isn’t trying to hack you.
The browser is the biggest attack vector against your ...
- 1,823
19
votes
Why should browser security be prioritized?
Each of your statements is making a false assumption here:
Most of the websites I visit have SSL certificate.
This is great, but SSL/TLS only protects you against certain types of attacks.
Pretty much,...
- 1,615
15
votes
What are the real physical risks of casual social media publishing?
For example, I had experienced this in my practice:
When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for ...
- 161
14
votes
Is ignoring a threat you cannot defend from a valid strategy?
TL;DR: NO (but we should define what "ignoring" means; from the text of the question I suspect we're actually of the same opinion).
You do not "ignore" a threat. The ancient saw says that you do not ...
- 22.5k
13
votes
Accepted
Is exposing website performance data a security risk?
So I have to admit that my first reaction was "I would never do this." That, however, may be more because I, historically, don't like to let anybody know anything they don't need to, than for any ...
- 35.5k
13
votes
How to create a company culture that cares about information security?
This is a really difficult issue, but if you have the chance to change things, you should give it all you've got.
You can't change a culture overnight. However, there are steps you can take to begin ...
- 22.5k
13
votes
How to deal with low-probability high-impact risks?
You have choosen the correct approach:
Now usually we gauged such problems by multiplying probability of occurrence by the expected damage...
and just faced its limits:
we are lost trying to ...
- 25.5k
12
votes
Accepted
What are the real physical risks of casual social media publishing?
The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house ...
- 4,185
11
votes
Evaluating the security of home security cameras
This started off as a comment on Andre's answer, but it got a bit long.
USB is fine as long as none of the cameras are more than 16 foot from the host :)
Since you need to run power out to the ...
- 18.3k
11
votes
How to deal with low-probability high-impact risks?
Your first step would be to make a proper, quantitative risk analysis. Other answers have already provided pointers here, I especially want to support the mentioning of "How to Measure Anything in ...
- 9,994
10
votes
Is ignoring a threat you cannot defend from a valid strategy?
There are four basic strategies to control risks:
Avoidance: Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability
Transference: Shifting the risk to ...
- 324
10
votes
Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?
Low discoverability doesn't necessarily mean "security by obscurity". It could just mean that the vulnerability lies deep in a portion of functionality that's rarely ever investigated. It could also ...
- 654
9
votes
Evaluating the security of home security cameras
EDIT - Modified this answer slightly (now three parts)
Low Budget Version
Pick up a used router (laying around the house?), install dd-wrt on it and turn off the WiFi. Bingo, ready made 4 port ...
- 1,411
9
votes
What are the real physical risks of casual social media publishing?
One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to ...
- 197
8
votes
Accepted
Security analysis of Dashlane
A security analysis was performed in May 2016:
Security Analysis of Dashlane by Paolo Gentili, Sarah Shader, Richard Yip, Brandon Zeng
That analysis attempts to look for largely the same types of ...
- 196
8
votes
What's the danger of having some random, out of my control, JavaScript code running on my pages?
What's the worst thing that can happen?
The third party can do anything that you could do with JavaScript - or anything an attacker could do with XSS.
This includes stealing cookies, injecting a ...
- 29k
8
votes
Accepted
Do high-level programming languages have more vulnerabilities or security risks than low-level languages?
Major Caveat upfront:
It is possible to be insecure in any language, any time, and only developer attentiveness/awareness can fix this. SQL injection is still a thing. Higher-level languages ...
- 1,978
Only top scored, non community-wiki answers of a minimum length are eligible