6

There are lots of other possibilities. Note that the CIA triad is not so much a model for security risks as it is for security goals/objectives. It has often been criticized for being overly simplistic and incomplete. Consequently, there are lots of alternative models and extensions of the CIA triad. One popular option is the Parkerian hexad that consists of ...


5

This sounds like a great application for threat modeling as part of the design process. If you’re unfamiliar, threat modeling is a technique involving the creation of threat landscapes, where a product/service/system is analyzed to find potential risks. Fundamentally, threat models are simply conceptual decompositions addressing potential threats, so they ...


3

If you go by the spec and examples from first, neither is correct. Let's start with examples: CVE-2015-1098 - which is about DoS in iWork via a specifically crafted file - is scored as AV:L and UI:R. CVE-2009-0658 - which is about a buffer overflow in adobe acrobat via a specifically crafted file - is also scored as AV:L and UI:R. The reason in both cases ...


2

The risk register is a document which helps you to understand the risks within your organisation and help you plan out methods to resolve them. Often, you find many documents on the internet which give you some results, but most of it, is understood by very few people. As a result, the core issue, that is to resolve the risks is lost and most of the effort ...


2

Something is wrong in your risk assessment process if you are finding new risks every day. It could also be that your risk identification was done at the wrong level of abstraction. My guess is that you are doing this on a very low level and you should move up to understanding business impact. Risk is basically something of consequence that could go wrong. ...


2

This answer to this question is depending a lot on the environment. Some examples: If you are in a market with fierce competition, underpaid or otherwise unsatisfied workers, where the employees have access to valuable information, then the chance that these information will leak is very high, i.e. the risk an employee takes when stealing the information is ...


1

You are not going to find a standardised metric because that's not how risk works. Figuring out how adverse events will have an impact is the whole point of risk management. What would present a risk to a major university will be vastly different from what would present a risk to a 3-person app development start-up. For instance: 2.1 Anti virus ...


1

Knowledge of how the company works is largely irrelavant. In most cases, it will be "badly". What matters is the files on those servers. All your product designs. All your proprietary software. All your current bids and proposals. All your detailed contract cost calculations. And so on.


1

Risk management is typically done by quantifying the chance of something happening and also the impact to the business if that happens. For data leakage risk, the impact can be extremely high for companies that have intellectual property (IP) which if disclosed to a competitor would cause loss of market share down the road (because the competitor got the ...


1

I think the CWE is just not the right place. Quote from the FAQ: A1. What is CWE? What is a "software weakness"? Targeted at both the development community and the community of security practitioners, Common Weakness Enumeration (CWE™) is a formal list or dictionary of common software weaknesses that can occur in software's architecture, design, ...


1

While CVSS isn't great at estimating specific situations, you can get a good guess-timate. For authenticated persistent XSS, it would be medium: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N The issue here is that your different roles are effectively meaningless. Any user could perform actions in any of the roles via XSS. How bad that is really depends on ...


1

If you are assigning risk ratings such as low/medium/high, then I usually start off by classifying stored XSS as high risk: There are different roles/groups of users, but the part of the site is only accessible by a specific group (with different roles). Authentication cookies have the HTTPonly flag These may be mitigating factors for ...


Only top voted, non community-wiki answers of a minimum length are eligible