Attacks/Breaches

7/11/2018
10:30 AM
Jack Jones
Jack Jones
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv

What We Talk About When We Talk About Risk

Measuring security risk is not that hard if you get your terms straight and leverage well-established methods and principles from other disciplines.

Source: Jack Jones
Source: Jack Jones

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/11/2018 | 2:59:02 PM
Re: Cybersecurity Risk Taxonomy
Small Business - general rule is that a small business (I guess 50 emps or less) can live for only 2 weeks following a major crash of systems.  I supported such shops and always had a backup-restore plan in working place and used it on several critical cases inclusive of server drive failure and ransomware attack.   Measure THAT!!!   (Lesson - always ask for a large check for services in such cases).
jonesj26
50%
50%
jonesj26,
User Rank: Author
7/11/2018 | 1:44:13 PM
Re: Cybersecurity Risk Taxonomy
Thanks, Christian.  You're absolutely right about this problem being discussed for some time now.  Unfortunately, I don't believe it's broadly recognized yet as a foundational Achilles Heel for our profession.  Hopefully we can elevate it within the minds of our colleagues and accelerate the evolution of our profession.

Cheers

Jack
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
7/11/2018 | 11:43:29 AM
Cybersecurity Risk Taxonomy
These are excellent points - in fact, the very list of risks you noted that are typically raised when asked are the ones I tend to see in initial project documents that relate to security.

Cybersecurity Risk Taxonomy (A. M. Rea-Guaman, T. San Feliu, J. A. Calvo-Manzano, I. D. Sanchez-Garcia) is a paper published under the International Conference on Software Process Improvement, 2017. It covers an interesting deep dive into studies published from 1990 to 2017. They found "132 papers and some of them mention some risk taxonomies within the scope of IT (information technologies) cybersecurity, although only five primary elements were selected, identifying the main risk taxonomies."

The perspectives covered include Asset, Attacks, Service, Business and External, with papers covering a wide range of combinations of taxonomy descriptions. Some of the items in the taxonomies include Business objects and dynamics models, Social engineering, Systems and technology failures, Failed internal processes, Resource or target information and Actions of people.

Your example InfoSec risks make sense upon more reading of studies like the one above, which is a great piece indicating this conversation of risk in InfoSec has been going on for some time.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17317
PUBLISHED: 2018-09-21
FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action, io_in_iface, io_in_set, io_in_ip, io_in_mask, io_in_gw, io_out_iface, io_out_set, io_out_mask, io_out_gw, iface, or domain parameter to /ww...
CVE-2018-17320
PUBLISHED: 2018-09-21
An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action.
CVE-2018-17141
PUBLISHED: 2018-09-21
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.
CVE-2018-17173
PUBLISHED: 2018-09-21
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
CVE-2018-17174
PUBLISHED: 2018-09-21
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of service (even arbitrary code execution in a certain context) in a product using this library via malformed data.