136
Can you explain why browser security should be placed on the top priority ...
Because the browser is processing lots of untrusted content from the internet.
Of course, if you use any other programs which does this (like Mail client, maybe Office program, PDF reader) you should keep these updated too since vulnerabilities in these programs are a regular ...
89
First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily all of it.
Where possible, instead of saying no in this situation come back with a few options.
VPN so people travelling, can access the data wherever they ...
74
Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to infinity and come up with cohesive answer.
Unfortunately this is what you need to do in this case. But I don't believe that this calculation is really as ...
59
High Level Culture
In my experience, shifting a security culture takes 3 steps:
Get management buy-in to do things differently
Get personal management engagement to lead the way on what is important
Set the tone through training, media, and in-person events that "people like us do things like this"
Here's the thing: management has to be leading the charge ...
56
A warning that this response is coming from theory, not experience.
Are there ethical consequences regarding the impact of the bad event on others? Will it hurt your users? Also consider the employees of the company who may be hurt if it is ruined by an attack. If so, you may feel you have an ethical obligation to mitigate.
If you do mitigate the attack, ...
52
Risk
In the worst scenario, it could render website completely inaccessible for the users, it could perform particular actions as them (for example, requesting account removal, spending money) or it could steal confidential data.
Prevention
Can't be done. If you run someone else's JavaScript on your website, it becomes no more secure than that third-party....
39
You would never ignore a threat, and perhaps that is semantics over your wording. You either accept, mitigate, or outsource the risk for the given threat.
In this case, that would be:
accept that there will be a $X loss,
mitigate fix DRM or find DRM alternate to protect the product, or
outsource using insurance or place the risk on someone else in the same ...
37
Like most embedded hardware (routers, etc), their firmware often sucks, and unless you have unlimited time I'm afraid there is no way to thoroughly check every single camera out there. And even if you do find one that's currently secure, what guarantees that you'll get updates for vulnerabilities that will be discovered in the future ?
Instead, I suggest ...
32
Think of your users as customers. You are helping them meet their business requirements to secure data. That means it's your job to keep the requirements placed on them as sensible, justified and limited as possible. It's UX engineering.
Examples:
if you make it hard to get a proper login on a system, workgroups will share passwords on post-its or ...
31
When looking for actual physical risks, doxing and the results are most important.
There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything else might useful for actual physical attacks (or swatting) available online to which I will not link for obvious reasons.
The amount of information that can ...
25
You should be taking into account the fact that your team knows about this attack vector.
If simply knowing about the vulnerability makes it easier to execute the attack, you may have a bigger problem than you thought. (For example, a hard-to-find backdoor known to your team.)
If that's the case, your own team members are high on the list of opponents to ...
24
Are there some reasons that connecting internal systems directly to the internet is a bad thing?
You're unnecessarily increasing the attack surface.
Here are problems to consider:
An attacker who obtains control over this single exposed service can eventually leverage that access to infiltrate other services on the intranet.
You might be having a hard ...
21
Not all the websites you visit have certificates. You can’t smell fishy websites. Certificate doesn’t mean the site isn’t trying to hack you.
The browser is the biggest attack vector against your computer. It will tend to run unvetted JavaScript code at least, and god knows what else. It constantly processes data from untrusted sources.
18
Each of your statements is making a false assumption here:
Most of the websites I visit have SSL certificate.
This is great, but SSL/TLS only protects you against certain types of attacks.
Pretty much, a site having a (valid) TLS certificate simply means that the owner of that website has in some way proven ownership of the domain name that is used to ...
15
For example, I had experienced this in my practice:
When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for security questions like "name of your dog" and "your school". This information was displayed in profiles in social networks.
Having many accounts makes it difficult ...
14
TL;DR: NO (but we should define what "ignoring" means; from the text of the question I suspect we're actually of the same opinion).
You do not "ignore" a threat. The ancient saw says that you do not fear a threat that you cannot avoid - stultum est timere quod vitare non potes, since fear will avail you nothing.
But few threats are completely unavoidable ...
13
So I have to admit that my first reaction was "I would never do this." That, however, may be more because I, historically, don't like to let anybody know anything they don't need to, than for any real security reason.
So that said, the only security issues I can think of are fairly limited, and fairly esoteric. It could be used to find a DoS or DDoS ...
13
This is a really difficult issue, but if you have the chance to change things, you should give it all you've got.
You can't change a culture overnight. However, there are steps you can take to begin changing the culture for the better.
Policy enforcement
This is first on my list. I'm in full agreement here that you need to enforce security policies, and ...
13
You have choosen the correct approach:
Now usually we gauged such problems by multiplying probability of occurrence by the expected damage...
and just faced its limits:
we are lost trying to multiply a number tending to zero by a number tending to infinity
I would say that you are facing an inacceptable risk (could cause a major blow to the company's ...
12
If some people have put some hidden backdoors in your system, and if they were competent at it, then you won't be able to find them. "Competence", here, means "having an Internet access and typing 'rootkit mac os x' in Google". See e.g. this. It is theoretically impossible to completely hide a backdoor, but only in the same sense that it is theoretically ...
12
The way to look at which is better for you is to work out what your risk appetite is.
If you must have service at all costs then you don't want to fail closed, as any problem with that IPS will cause a Denial of Service. That is a very rare scenario though - the majority of implementations are configured to protect the server and the data on it.
This is ...
12
The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house that's expected to be empty could then lead to a break-in.
If the same or a linked account includes pictures of valuables (whether as the subject -- "look at my ...
11
Your first step would be to make a proper, quantitative risk analysis. Other answers have already provided pointers here, I especially want to support the mentioning of "How to Measure Anything in Cybersecurity Risk", a brilliant book. You can also look towards FAIR as a quantitative method.
However, risk management doesn't start nor end with risk analysis. ...
10
If you are looking for an inactive backdoor, then good luck, you'd need years of computer forensics skills to trace it down. On the other hand, if you are looking for a backdoor that is in use, then using traffic analysis from another system or a hardware device on the network could allow you to see if your computer is emitting any unexpected packets.
...
10
This started off as a comment on Andre's answer, but it got a bit long.
USB is fine as long as none of the cameras are more than 16 foot from the host :)
Since you need to run power out to the cameras anyway, just run a wired ethernet connection to the LAN (or use POE if you can find cameras which support it). On an un-routed subnet, most of the inherent ...
10
There are four basic strategies to control risks:
Avoidance: Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability
Transference: Shifting the risk to other areas or to outside entities
Mitigation: Reducing the impact if the vulnerability is exploited
Acceptance: Understanding the consequences and accepting the ...
10
One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to post a photo of their passport/identity card/drivers license/certificate with full name and/or anything else with a social security number at some point, ...
10
Low discoverability doesn't necessarily mean "security by obscurity". It could just mean that the vulnerability lies deep in a portion of functionality that's rarely ever investigated. It could also mean that discovery would require a corner case so narrow that even the initial discovery was unlikely to have ever happened. Such examples would be Dirty COW ...
Only top voted, non community-wiki answers of a minimum length are eligible
