Questions tagged [metrics]
The metrics tag has no summary.
25 questions
3 votes
2 answers
2k views
CVSS3 score for XSS leading to account takeover
Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
- 110
0 votes
0 answers
150 views
Identify hosts that are serving specific metric on Shodan
Using things like Shodan and Zoomeye we can find tens of thousands of exposed Prometheus endpoints with queries like service:prometheus port:9090 etc.. Now let's say we know that there are entities on ...
- 1
2 votes
2 answers
374 views
Why do entropies of passwords significantly differ from site to site?
I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from ...
- 21
0 votes
1 answer
393 views
Kubernetes user impersonation to obtain exec privileges
I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
1 vote
2 answers
327 views
CVSS Temporal guidance
I've recently been given a set of guidance notes on CVSS; but the guidance isn't making sense. I've sent a query off, but got no response. So asking here. Say you have an exploit (can ignore base for ...
- 142
1 vote
1 answer
297 views
Malware Threat Hunting in Airport Systems - KPIs/Metrics to Track [closed]
I am trying to figure out how to detect potential threats from malwares in various systems installed in the airport. To be specific, my focus is on the following systems in airports: Baggage Handling ...
- 111
2 votes
1 answer
177 views
Gather system metrics securely from infected VM
I intend to train an RNN on snapshots of the VM metrics to classify malware. I will, therefore, run hundreds of different pieces of malware inside that VM. It has been isolated from my host (as best ...
- 143
3 votes
1 answer
1k views
Why can't a Tor node simultaneously be a guard and an exit node?
By looking at probability graphs for nodes at metrics.torproject.org, it seems that exit nodes can't also be guards (they have 0.0000% probability of serving as guard) and vice versa. Why is that so?
- 31
4 votes
2 answers
2k views
How do I measure compliance to Information security policies?
I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
- 51
1 vote
0 answers
242 views
Quantifying security with metrics
I am working on a state-of-the-art quantification of security, meaning a numerical assessment of security for a system. In my research, most of the work is not recent (up to 2012 so far) and is ...
- 103
0 votes
3 answers
695 views
What are some metrics to be used to evaluate SaaS security?
What are some metrics to be used to evaluate a SaaS app's security? Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it ...
- 394
5 votes
2 answers
5k views
"Triage an incident"
I have been trying to find a definition of triage in relation to Information Security but cannot find any online. From the different examples given online (i.e. medical world), it seems related to ...
- 554
1 vote
1 answer
199 views
why don't we measure the strength of crypto against the cost it would take to crack it? [closed]
I hear all the time how many hours it would take to break a certain type of encryption. I think this may be the wrong metric to look at ever since scaling became an easy to implement solution. Sure ...
- 277
3 votes
2 answers
717 views
security metrics on softwares developed
Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected by ...
- 1,096
6 votes
1 answer
1k views
Can OSSTMM RAVs be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000?
The calculation of RAVs in OSSTMM seem very useful as a security metric but, can they be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000? ISO 27001:2013 ...
- 2,789