75 votes

How to deal with low-probability high-impact risks?

Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to ...
user avatar
  • 48.8k
62 votes

How to create a company culture that cares about information security?

High Level Culture In my experience, shifting a security culture takes 3 steps: Get management buy-in to do things differently Get personal management engagement to lead the way on what is important ...
user avatar
  • 123k
56 votes

How to deal with low-probability high-impact risks?

A warning that this response is coming from theory, not experience. Are there ethical consequences regarding the impact of the bad event on others? Will it hurt your users? Also consider the ...
user avatar
  • 657
39 votes
Accepted

DDOS - security or operational risk?

I think that is a false dichotomy, and your CSO is being plain silly. Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "...
user avatar
  • 72.1k
35 votes
Accepted

What are the risks of not patching a server or hypervisor for Meltdown?

Basically, if you run code from untrusted sources on a machine that has data you don't want that code to have access to, you need to patch. Desktop computers should be patched because they've got an ...
user avatar
  • 34.4k
33 votes

How to create a company culture that cares about information security?

Think of your users as customers. You are helping them meet their business requirements to secure data. That means it's your job to keep the requirements placed on them as sensible, justified and ...
user avatar
  • 817
30 votes

What are the real physical risks of casual social media publishing?

When looking for actual physical risks, doxing and the results are most important. There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything ...
user avatar
  • 14.3k
27 votes

What are the risks of providing SSLv2 for additional device compatibility?

SSL 2 was deprecated in 2011 It was not deprecated, it was outright prohibited which is a huge difference. See also What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?...
user avatar
25 votes

How to deal with low-probability high-impact risks?

You should be taking into account the fact that your team knows about this attack vector. If simply knowing about the vulnerability makes it easier to execute the attack, you may have a bigger ...
user avatar
20 votes
Accepted

Is there a security advantage or risk in removing disabled user accounts?

In general, it is always best to reduce your attack surface. No system is ever perfect and your deactivation protocol will be no exception due to both programmatic and potential human error. Risk 1: ...
user avatar
  • 2,691
17 votes

DDOS - security or operational risk?

While I generally disagree with the CSO, I can see a reason why he drew this line. The question can come down to the delineation of who needs to lead mitigation and remediation efforts. DDoS does, of ...
user avatar
  • 123k
15 votes

What are the real physical risks of casual social media publishing?

For example, I had experienced this in my practice: When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for ...
user avatar
  • 161
13 votes

How to create a company culture that cares about information security?

This is a really difficult issue, but if you have the chance to change things, you should give it all you've got. You can't change a culture overnight. However, there are steps you can take to begin ...
user avatar
  • 22.5k
13 votes

How to deal with low-probability high-impact risks?

You have choosen the correct approach: Now usually we gauged such problems by multiplying probability of occurrence by the expected damage... and just faced its limits: we are lost trying to ...
user avatar
12 votes
Accepted

What are the real physical risks of casual social media publishing?

The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house ...
user avatar
  • 4,185
11 votes

What are the security risks when using free Content delivery networks (CDNs)?

@ThiefMaster's answer does a great job of enumerating the risks of using an externally controlled Content-- which basically fall under the category of executing or displaying arbitrary code and ...
user avatar
  • 3,886
11 votes

What are the risks of not patching a server or hypervisor for Meltdown?

My understanding of the issue is that it is a local information leak, where local means that the information are leaked "only" to processes on the same physical hardware and not (directly) to remote ...
user avatar
11 votes

How to deal with low-probability high-impact risks?

Your first step would be to make a proper, quantitative risk analysis. Other answers have already provided pointers here, I especially want to support the mentioning of "How to Measure Anything in ...
user avatar
  • 10.1k
11 votes

I have to write down credit card information on paper and send it. How can I minimize my risk?

They shouldn’t be asking you to write down your CVV number at all. Payment Card Industry security standards prohibit merchants from storing that information, and on paper counts. If they can’t process ...
user avatar
  • 10.1k
9 votes

What are the real physical risks of casual social media publishing?

One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to ...
user avatar
  • 197
9 votes
Accepted

Security risks of using ffmpeg as part of web service

Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in ...
user avatar
  • 64.2k
7 votes

Is Segregation of Duties a Requirement?

As the O'Reilly book, DevOpsSec details in chapter 2, Separation of Duties (SoD) is a major component of the information-security standards: ISO 27001, NIST SP 800-53, COBIT, ITIL, etc -- and part of ...
user avatar
  • 18.9k
7 votes
Accepted

What are the risks of having your data targeted precisely because you try to hide it?

There is indeed evidence that suggests that users of strong cryptography (and of services that use strong cryptography) get selected e.g. by the NSA. I would still recommend encryption and encrypted ...
user avatar
  • 1,111
7 votes

How to deal with low-probability high-impact risks?

tl;dr: When it comes to a security vuln, high enough impact means it should be mitigated, no matter how low the probability. On top of that, that probability is not static, it is constantly, perhaps ...
user avatar
6 votes
Accepted

Can information security risks essentially only be triaged according to the CIA triangle?

There are lots of other possibilities. Note that the CIA triad is not so much a model for security risks as it is for security goals/objectives. It has often been criticized for being overly ...
user avatar
  • 43.8k
6 votes

Is there a specification for the color values representing information classification levels for the United States?

Ok so after diving into this a bit, this is the best I can come up with. I do not work for the US government so I cant say anything with any level of confidence. However; It seems that the color ...
user avatar
  • 1,614
6 votes

What are the real physical risks of casual social media publishing?

Few years ago there was a strong opposition to Gawker Stalker app for posting current locations of celebrities. The main argument for the app was: By posting someone's location out on a public ...
user avatar
  • 3,191
6 votes
Accepted

What is as CISOs job, exactly?

As someone who has overseen a number of shared CISOs and sold organisations on the need for someone in this role, I can tell you that the problem is that each organisation has different needs and ...
user avatar
  • 123k

Only top scored, non community-wiki answers of a minimum length are eligible