75
votes
How to deal with low-probability high-impact risks?
Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to ...
- 49.6k
60
votes
How to create a company culture that cares about information security?
High Level Culture
In my experience, shifting a security culture takes 3 steps:
Get management buy-in to do things differently
Get personal management engagement to lead the way on what is important
...
- 132k
57
votes
How to deal with low-probability high-impact risks?
A warning that this response is coming from theory, not experience.
Are there ethical consequences regarding the impact of the bad event on others? Will it hurt your users? Also consider the ...
- 823
35
votes
Accepted
What are the risks of not patching a server or hypervisor for Meltdown?
Basically, if you run code from untrusted sources on a machine that has data you don't want that code to have access to, you need to patch. Desktop computers should be patched because they've got an ...
- 34.8k
33
votes
How to create a company culture that cares about information security?
Think of your users as customers. You are helping them meet their business requirements to secure data. That means it's your job to keep the requirements placed on them as sensible, justified and ...
- 817
30
votes
What are the real physical risks of casual social media publishing?
When looking for actual physical risks, doxing and the results are most important.
There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything ...
- 14.5k
25
votes
How to deal with low-probability high-impact risks?
You should be taking into account the fact that your team knows about this attack vector.
If simply knowing about the vulnerability makes it easier to execute the attack, you may have a bigger ...
- 351
19
votes
Accepted
Is there a security advantage or risk in removing disabled user accounts?
In general, it is always best to reduce your attack surface. No system is ever perfect and your deactivation protocol will be no exception due to both programmatic and potential human error.
Risk 1: ...
- 2,751
15
votes
What are the real physical risks of casual social media publishing?
For example, I had experienced this in my practice:
When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for ...
- 161
14
votes
How to deal with low-probability high-impact risks?
You have choosen the correct approach:
Now usually we gauged such problems by multiplying probability of occurrence by the expected damage...
and just faced its limits:
we are lost trying to ...
- 26.9k
12
votes
How to create a company culture that cares about information security?
This is a really difficult issue, but if you have the chance to change things, you should give it all you've got.
You can't change a culture overnight. However, there are steps you can take to begin ...
- 22.6k
12
votes
Accepted
What are the real physical risks of casual social media publishing?
The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house ...
- 4,425
12
votes
I have to write down credit card information on paper and send it. How can I minimize my risk?
They shouldn’t be asking you to write down your CVV number at all. Payment Card Industry security standards prohibit merchants from storing that information, and on paper counts. If they can’t process ...
- 10.3k
11
votes
What are the risks of not patching a server or hypervisor for Meltdown?
My understanding of the issue is that it is a local information leak, where local means that the information are leaked "only" to processes on the same physical hardware and not (directly) to remote ...
- 208k
11
votes
How to deal with low-probability high-impact risks?
Your first step would be to make a proper, quantitative risk analysis. Other answers have already provided pointers here, I especially want to support the mentioning of "How to Measure Anything in ...
- 10.7k
10
votes
Accepted
Security risks of using ffmpeg as part of web service
Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in ...
- 67.3k
9
votes
What are the real physical risks of casual social media publishing?
One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to ...
- 197
7
votes
Is Segregation of Duties a Requirement?
As the O'Reilly book, DevOpsSec details in chapter 2, Separation of Duties (SoD) is a major component of the information-security standards: ISO 27001, NIST SP 800-53, COBIT, ITIL, etc -- and part of ...
- 19.1k
7
votes
Accepted
What are the risks of having your data targeted precisely because you try to hide it?
There is indeed evidence that suggests that users of strong cryptography (and of services that use strong cryptography) get selected e.g. by the NSA.
I would still recommend encryption and encrypted ...
- 1,121
7
votes
How to deal with low-probability high-impact risks?
tl;dr: When it comes to a security vuln, high enough impact means it should be mitigated, no matter how low the probability. On top of that, that probability is not static, it is constantly, perhaps ...
- 179
6
votes
Accepted
Can information security risks essentially only be triaged according to the CIA triangle?
There are lots of other possibilities.
Note that the CIA triad is not so much a model for security risks as it is for security goals/objectives. It has often been criticized for being overly ...
- 45.1k
6
votes
Is there a specification for the color values representing information classification levels for the United States?
Ok so after diving into this a bit, this is the best I can come up with. I do not work for the US government so I cant say anything with any level of confidence. However;
It seems that the color ...
- 1,664
6
votes
What are the real physical risks of casual social media publishing?
Few years ago there was a strong opposition to Gawker Stalker app for posting current locations of celebrities.
The main argument for the app was: By posting someone's location out on a public ...
- 3,286
6
votes
Accepted
What is as CISOs job, exactly?
As someone who has overseen a number of shared CISOs and sold organisations on the need for someone in this role, I can tell you that the problem is that each organisation has different needs and ...
- 132k
6
votes
How to calculate our application security debt?
The best advice I have heard is to figure out a list of all of the different types of events that could occur as a result of your security debt. Next, try to estimate the cost of each of those events....
- 3,322
6
votes
How to calculate our application security debt?
At this point, there is no standardised method of calculating the size (inventory) of technical debt. I have been working with a research team made up of PhD researchers from the University of Glasgow ...
- 132k
5
votes
How to create a company culture that cares about information security?
I'll take little detour and answer the question implied by this part:
but they simply don't care
@shroeder's answer already covers the starting point which is to have the management on your side. ...
- 5,897
5
votes
Accepted
Are revealed personal emails a security risk?
There are some downsides to having your email spread to strangers:
The more spread your email is, the more likely you are to get spam, phishing emails, emails containing malware, etc. If anyone of ...
- 65.8k
Only top scored, non community-wiki answers of a minimum length are eligible