74

Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to infinity and come up with cohesive answer. Unfortunately this is what you need to do in this case. But I don't believe that this calculation is really as ...


61

High Level Culture In my experience, shifting a security culture takes 3 steps: Get management buy-in to do things differently Get personal management engagement to lead the way on what is important Set the tone through training, media, and in-person events that "people like us do things like this" Here's the thing: management has to be leading the charge ...


56

A warning that this response is coming from theory, not experience. Are there ethical consequences regarding the impact of the bad event on others? Will it hurt your users? Also consider the employees of the company who may be hurt if it is ruined by an attack. If so, you may feel you have an ethical obligation to mitigate. If you do mitigate the attack, ...


39

I think that is a false dichotomy, and your CSO is being plain silly. Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "responsibility" are obviously not productive, though it might fit into the general corporate culture. While there are various ways of qualifying the realm of ...


35

Basically, if you run code from untrusted sources on a machine that has data you don't want that code to have access to, you need to patch. Desktop computers should be patched because they've got an unfortunate habit of encountering untrusted code; shared-hosting servers, particularly virtual private server hosts, must be patched, because Meltdown lets one ...


33

Think of your users as customers. You are helping them meet their business requirements to secure data. That means it's your job to keep the requirements placed on them as sensible, justified and limited as possible. It's UX engineering. Examples: if you make it hard to get a proper login on a system, workgroups will share passwords on post-its or ...


30

When looking for actual physical risks, doxing and the results are most important. There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything else might useful for actual physical attacks (or swatting) available online to which I will not link for obvious reasons. The amount of information that can ...


27

SSL 2 was deprecated in 2011 It was not deprecated, it was outright prohibited which is a huge difference. See also What's the difference between SSLv3 being deprecated and SSLv2 being prohibited? However many devices are manufactured before 2011 and still in use today TLS 1.0 was defined 1999 and was available in major TLS stacks (including openssl)...


25

You should be taking into account the fact that your team knows about this attack vector. If simply knowing about the vulnerability makes it easier to execute the attack, you may have a bigger problem than you thought. (For example, a hard-to-find backdoor known to your team.) If that's the case, your own team members are high on the list of opponents to ...


20

In general, it is always best to reduce your attack surface. No system is ever perfect and your deactivation protocol will be no exception due to both programmatic and potential human error. Risk 1: Let's say all your terminated employees accounts have been properly de-activated, for example via altering their role in the employee table in the database (or ...


17

While I generally disagree with the CSO, I can see a reason why he drew this line. The question can come down to the delineation of who needs to lead mitigation and remediation efforts. DDoS does, of course, impact availability but is typically handled by the Operations team. If a DDoS event happens, your CSO might feel that there is nothing that he can do ...


16

Although there are exceptions, generally managers do things for one of two reasons: Doing it will make them look good Not doing it will make them look bad Now apply this to your management to see who the key stakeholders are: Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV look good. However, if ...


15

For example, I had experienced this in my practice: When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for security questions like "name of your dog" and "your school". This information was displayed in profiles in social networks. Having many accounts makes it difficult ...


13

This is a really difficult issue, but if you have the chance to change things, you should give it all you've got. You can't change a culture overnight. However, there are steps you can take to begin changing the culture for the better. Policy enforcement This is first on my list. I'm in full agreement here that you need to enforce security policies, and ...


13

You have choosen the correct approach: Now usually we gauged such problems by multiplying probability of occurrence by the expected damage... and just faced its limits: we are lost trying to multiply a number tending to zero by a number tending to infinity I would say that you are facing an inacceptable risk (could cause a major blow to the company's ...


12

The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house that's expected to be empty could then lead to a break-in. If the same or a linked account includes pictures of valuables (whether as the subject -- "look at my ...


11

@ThiefMaster's answer does a great job of enumerating the risks of using an externally controlled Content-- which basically fall under the category of executing or displaying arbitrary code and content on a user's browser. I will mainly focus on your last question: How are those risk mitigated? which was unaddressed-- a lot has since changed (in 4 years). ...


11

My understanding of the issue is that it is a local information leak, where local means that the information are leaked "only" to processes on the same physical hardware and not (directly) to remote systems. And, it is an attack which was shown to be actually usable in practice to extract sensitive information, even it is currently not trivially to exploit. ...


11

Your first step would be to make a proper, quantitative risk analysis. Other answers have already provided pointers here, I especially want to support the mentioning of "How to Measure Anything in Cybersecurity Risk", a brilliant book. You can also look towards FAIR as a quantitative method. However, risk management doesn't start nor end with risk analysis. ...


11

They shouldn’t be asking you to write down your CVV number at all. Payment Card Industry security standards prohibit merchants from storing that information, and on paper counts. If they can’t process your card electronically so that the CVV is only ever held in memory then they shouldn’t be using the CVV at all, and accepting the risk that the transaction ...


10

This is really about closing the gap between Information Security and Business objectives. For most security departments today, the battle selling Information Security to the board is the major challenge. Usually, board members don't care about "good security”, they care about "good enough security". InfoSec is rarely clearly defined in most organizations ...


9

One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to post a photo of their passport/identity card/drivers license/certificate with full name and/or anything else with a social security number at some point, ...


9

Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in decoders for any of the numerous formats could be exploited to gain arbitrary code execution. This becomes even more likely given the fact that FFmpeg is written in C, ...


8

You need to distinguish between two types of non-personal account: Generic accounts are accounts that multiple humans can login to. These are generally bad as you lose accountability. If John and Fred both have access, and a malicious event occurs, who do we blame - John or Fred? Service accounts are used by applications, not by humans. Provided these are ...


7

As the O'Reilly book, DevOpsSec details in chapter 2, Separation of Duties (SoD) is a major component of the information-security standards: ISO 27001, NIST SP 800-53, COBIT, ITIL, etc -- and part of the regulatory requirements for (at the very-least): FFIEC, Sarbanes-Oxley Section 404, SSAE 16, GLBA, MiFID II, and PCI DSS. Developers do agree that read-...


7

There is indeed evidence that suggests that users of strong cryptography (and of services that use strong cryptography) get selected e.g. by the NSA. I would still recommend encryption and encrypted services: The NSA will put you in the “crypto users” selector, so what? Most likely this will be it. If you actually intersect with another group, say “left ...


7

tl;dr: When it comes to a security vuln, high enough impact means it should be mitigated, no matter how low the probability. On top of that, that probability is not static, it is constantly, perhaps radically, increasing. There is a book The Black Swan: The Impact of the Highly Improbable by Nassim Taleb which pulls most of its examples from finance, but is ...


6

First of all, there are three different metrics to calculate the global CVSS score. These are: Base Metrics, Temporal Metrics and Environmental Metrics. Temporal Metrics and Environmental Metrics are optional and these are calculated using the Base ones as an input value. To have a better overview of these metrics and their equation, take a look of this ...


Only top voted, non community-wiki answers of a minimum length are eligible