4

Perhaps more so than for other Q&A sites it seems to me that context often matters a lot, as does the threat model envisioned by the questioner. Is there a good general way to ask for that sort of info near the top of the FAQ? We're getting a lot of very general questions that would require a long essay to cover variations based on low-threat environments vs high-value targets. Perhaps blending it into the the guidance on how we want practical questions to actual problems people are having?

4

I'm proposing a short addition to the FAW in this answer. I've made it community wiki (assuming I remember to hit the button) - if you want to improve it, please jump in and make edits :). I don't mind if not a single word from my version makes it into the final answer, as long as we agree what we want to say.

What background should I give in my question?

Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, and vice versa. Are you trying to protect something of global value against Advanced Persistent Threats? Or are you looking for a cost-effective approach for a low-profile small business? To get the most helpful answers you should tell us:

  • what assets you are trying to protect
  • who uses the asset you're trying to protect, and who you think might want to abuse it (and why)
  • what steps you've already taken to protect that asset
  • what risks you think you still need to mitigate

This is essentially a summary of your threat model, or risk profile, if you've already created one. Providing this information will also help you organize your own thoughts about your security issues.

Further information on the context is often also helpful. Does it involve a web app or desktop; employees or general public; Windows/Linux, Python/Java, Europe/Singapore, etc.

  • damn, "FAW" got edited out :( – user185 Jan 27 '11 at 17:01
  • Right - popped it into the start of the FAW, and added a line referring to the Scoping Question as well - meta.security.stackexchange.com/q/180/485. Can everyone have a look and let a mod know if we need more changes? – Rory Alsop Jan 28 '11 at 10:57
  • Thanks, Graham. Nice work folks! I've also added another proposed change, to the first line of the FAQ, as another answer. – nealmcb Jan 28 '11 at 16:19
  • Hmm - looks like a previous version of this answer has already made it into the faq. I suggest a bit more discussion (on each section) and a further update. – nealmcb Jan 28 '11 at 16:28
  • @rory Thanks for updating the FAQ. What do you think of my last update? – nealmcb Jan 29 '11 at 16:44
3

While we're at it, I'm going to propose updating the first line of the FAQ also. Feel free to edit this - it is "community wiki".


IT Security - Stack Exchange is for IT security professionals to discuss protecting assets from threats and vulnerabilities. Topics include web app hardening, network security, phishing, risk management, policies, penetration testing, tools and using cryptography. If you are a home user you may be better served by asking your question at superuser.com.

  • 1
    I like this wording - have edited it on already. Feel free to comment if alternatives work. – Rory Alsop Jan 29 '11 at 13:52
1

Sure, this is a good candidate for the type of topic-specific clarification that can go in the top of your /faq.

(this section of your faq is editable by diamond community mods, right now)

0

@nealmcb - excellent idea. Have you some thoughts on a paragraph or two on this?

  • @nealmcb - just take into account that when you say "threat model", different people understand different things... – AviD Jan 25 '11 at 20:05
  • @avid There are two meanings, and several approaches, given at en.wikipedia.org/wiki/Threat_model (which is of course a fine source of CC-licensed content) - how do they sync with what it means to you? Is there a clearer term for the background that would help us foster good questions and answers? – nealmcb Jan 25 '11 at 20:16
  • @nealmcb - hehe, no I understood that you meant the other meaning, I just sometimes have to do a double take... It's definitely fair use, though - just thought I'd mention that if its going in the FAW, it should be noted that there are those that are likely to misunderstand. Perhaps, "risk profile"? – AviD Jan 25 '11 at 20:45
  • 1
    @avid I actually found the wikipedia language pretty confusing, and finally think I've gotten closer to understanding the common confusion, with Microsoft using threat model to mean what many mean by attack model, via the post at taosecurity.blogspot.com/2007/06/… And yeah - "risk profile" sounds potentially useful to me, so long as we don't veer off into financial security questions :) – nealmcb Jan 25 '11 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .