Fundamentals of IT risk analysis
IT risk analysis determines the systems that need protection and helps the IT manager determine which protective actions are most cost effective.
Providers of security and anti-malware products like to spread images of young hackers wearing hoodies as a threat to IT systems. But, more often, employees of a company pose a greater threat to information security. Insiders are responsible for about 70 percent of the incidents; external attackers who exploit security vulnerabilities account for about 30 percent. The ISO/IEC 27005 standard  on IT risk management lists poorly trained or careless employees, disgruntled or malicious employees, and dishonest or recently fired employees as the main hazards.
At the same time, the profile of the external attacker is also changing. The romantic notion of the lonesome hacker sitting in an apartment and stealing data for the joy of being able to do so is far from the norm. Hacking today is usually a business where prices are defined by supply, demand, and ancillary costs (see the box titled "Cost and Benefits for Attackers.")
In this climate, every business needs to be aware of potential security threats, and it helps to have a systematic strategy for quantifying risk and assigning priorities as to which problems are most urgent. The business tool for getting to grips with vulnerability assessment is risk analysis. Risk analysis helps a company identify the risks, calculate the financial impact, identify vulnerabilities, assess threats, and put a value on the damage that would occur if someone were to exploit existing vulnerabilities and conflicts. The goal is not just to find the most glaring vulnerability or the most expensive loss scenario – risk analysis attempts to evaluate the severity of an attack in the context of the likelihood the attack will occur, showing IT managers which prevention measures will give the most protection for the IT dollar.
Read full article as PDF:
Symantec says Linux-Darlioz burrows in through PHP.
Dell renews its quest for the ultimate developer machine.
Innovative back door looks like normal SSH traffic.
One of CeBITs most successful forums opens the new year with a new name. The popular Open Source Forum continues in 2014 under the name Special Conference: Open Source. This year, the forum will be bigger and offer a wider range of possibilities for sponsors.
New release offers better graphics drivers and expands filesystem support.
New mail protocol will shut out the NSA and prevent snooping on metadata.
A new web application helps users visualize distributed denial-of-service attacks.
Ubuntu 13.10 takes a step toward convergence, with lots of mobility, but Mir only partly here.
Galileo board is targeted to embedded developers and educational institutions.