Dyman & Associates Risk Management Projects: 10M Passwords Publicized For Research

We've all heard of this before: a hacker releasing a certain number of passwords and usernames, presumably just for the lulz. But this time, we're talking about 10 million records posted by no less than a security specialist himself.
Security expert Mark Burnett has published 10 million sets of usernames and passwords online in an effort to equip the security sector with more information, while also getting himself potentially tagged as a criminal.
He clarified that his release of the username-password list is solely for white-hat purposes -- to aid research in making login authentications more effective and fraud-proof. Burnett insisted that he does not intend to help facilitate any illegal activity
or defraud people by his actions.
"I could have released this data anonymously like everyone else does but why should I have to? I clearly have no criminal intent here. It is beyond all reason that any researcher, student, or journalist have to be afraid of law enforcement agencies that
are supposed to be protecting us instead of trying to find ways to use the laws against us," he said in his post.
Leaking a massive amount of user data into the wild certainly does not sound like great help for most people but for security professionals, it's an important tool for research. For instance, how else would they know that online users are generally bad at choosing
passwords?
In his post, he shared that he would often get requests for his password data from researchers but he would just decline them before. But since he also know its importance, he decided to publish a clean data set for the public.
"A carefully-selected set of data provides great insight into user behavior and is valuable for furthering password security. So I built a data set of ten million usernames and passwords that I am releasing to the public domain."
To be fair, Dyman & Associates Risk Management Projects confirms that analyzing a username-password set seems to be more helpful for the security researchers.
According to him, it was by no means an easy decision but he eventually posted it after weighing down a number of factors. And though Burnett said he believes most of the data are already expired and unused, the domain part of the logins and any keyword that
could link it to a certain site were still removed to make it difficult for those with criminal intent.
Besides, Dyman & Associates Risk Management Projects experts agreed with him in saying that if a hacker would need such a list in order to attack someone, he's not going to be much of a threat.
Burnett has previously helped in collecting the recent list of worst passwords to alarm people into adopting better practices when it comes to their login credentials.
Lastly, he imparted the following warning for complacent users: "Be aware that if your password is not on this list that means nothing. This is a random sampling of thousands of dumps consisting of upwards to a billion passwords."

Similar Messages

Solution Manager project - no roadmap available for CRM 7.0 EhP3

Hi all,
I'm setting up a new project in solution manager for an upgrade.
However, in my roadmap selection tab, there's no roadmap for CRM 7.0 EhP3 (or even EhP2).
Is this just not available or can/should I update this list?
Many thanks and with kind regards,
Yee-Tee

Hello,
There are two possibilities I see here.
1-Your roadmap list is not up-to-date.
2-There is no roadmaps for these specific product/version delivered for the solman.
I would recommend you to first check the ST-ICO package SP level. The whole documentation content (Roadmaps, BPR, templates,...) are delivered by this component, so in order to have the complete and must up-to-date list, you'll need the latest SP-level.
further info: Implement SAP | SAP Support Portal
I hope this helps.
best regards,
Fabricius

Risk Management in PS

Hi everyone!
Does anyone know if the there's any functionality in SAP to handle Risk Management?
What the client needs to know is if SAP has any available tool to manage risks in project. When they are building up the solution for a client, they consider several risks that may arise. And during the execution of the project, they monitor those risks constantly. They can occurr or not, and sometimes other risks not detected can arise and have to be handled. Do you know if there's something in PS to address this?
Thanks in advance!
Regards,
Thalos.

Hi
Yes, it is possible to handle risk management in SAP PS.
Risk management need to consider the following:-
a) Event: What could happen?
b) Probability: How likely is it to happen?
c) Impact: How bad will it be if it happens?
d) Mitigation: How can you reduce the Probability (and by how much)?
e) Contingency: How can you reduce the Impact (and by how much)?
f) Reduction = Mitigation X Contingency
g) Exposure = Risk u2013 Reduction
Event you need to link with your network activities, means each activity you need to identify the risk involved.
Probability and Impact of the risk should be recorded on each activity which can be done through user fields.
For Mitigation and Contingency you can use DMS to maintain on each network activity.
If any Risk/ event occurred on an activity which you can identify through user status, and reporting can be done through notification.
If detailed mitigation plan need to be recorded you can record it through notification using class and charecteristics in order to record the values.
Create a Query / Z report to analyse the risk.
Tnx.
Abdul

SharePoint Risk Management

Hi,
I want to create Project Risk Management in SharePoint 2013. Can you please provide some idea how to create it.
Thanks,

Hi
This will get you started with the project
http://pm-foundations.com/2011/04/10/using-sharepoint-to-manage-risks-issues/
http://www.slideshare.net/echo4sharepoint/risk-management-in-sharepoint-governance
Please remember to mark the replies as answers if they help
Amit Kotha

Risk Management Plan ERP WW Implementation

Hello All
I´m developing a Risk Management Plan and need to identify risks related to ERP implementation in multiple geographies. The implementations will be based on the same template and the template, a base model, will be managed in a centralized way by the corporation, both from a process and from an IT perspective, e.g., process changes that impact the base model will be approved by a centralized group responsible for the integrity of the base model. These changes, if approved, will be incorporated to the base model under a strict versioning and configuration management policy. The Business and IT organizations will have to manage both the integrity of the base model (and its versions) and the rollout of specific versions to the geographies. Geographies include Latin America, North America, Africa.
I´m willing to identify risks of the strategy to the business itself (the strategy I described above) and it´s impact on the IT organization/processes that will need to support it. This company already runs SAP on it´s biggest business unit, now it will be expanding the solution to smaller BUs in other countries. The base model currently used by the corporation is different than the base model (template) that will be implemented in the smaller BUs, for historical reasons.
A good start could be a Risk Assessment (part of a typical Risk Management Plan) of an ERP implementation project with similar characteristics, e.g.: multiple geographies, different Business Units in these geographies, having to ensure integrity of the base model (template), etc...
Does anyone have anything similar to this that I could use as a start? Thanks.
Message was edited by:
        José Welington Nogueira Filho

Hi Jose,
Its quite interesting that you are working on Risk management . Risk management Plan requires to analyze the organization based on its Operations,Financial activities.
As per my understnading Risk management process is involved or can be segregated based on the following classification .
a) Financial Risk
b) Operational Risk
c) Strategic Risk
d)External Risk
Your Risk management Plan cna start up with the identify, categorize and analyze enterprise risks.
a) Financial Risk:
        - Based on the complexity ,size and nature of organization identify first top
           ten financial risks in the company.
b) Operational Risks:
        - Quality
        - Hiring and retention
        - Supply Chain
        - Succession Planning
c) Strategic Risks:
        - Intellectual Property Infringement / Counterfiet
        - Business Model and portfolio
        - Resource alignment
d) Exteran Risks:
        - Catastophic/Business Interrruption
        - Technological innovation
        - Competetors
While coming to Risk management Life-Cycle:
1. Validation and verification
2. Risk Treatment process
3. Governance & Monitoring
Based on the Low and high point methods you can identify the risks and give ranks based on the risk priority and prepare a graphical presentation .
As per above risks classification i am giving you more classification it will help you to prepare your Risk management plan in detailed ananlysis:
a) Financial Risks:
       - Cash Flow
       - Credit
       - Debit
       - Equity
       - Interest rates
b) Operational Risks;
      - Catastophe /BI
      - Change Mangement
      - Security
c) Strategic risks:
      - Brand repuatation
      - Business Model Portfolio
      -Channel
      - IP Infringment/Counterfiet
      - Quality
      - Resource allocation /Alignment
d) External Risks:
       - Competeiotrs
       - Customers Needs / Product support
       - Legal / anti-trust
       - Regulatory / Taxation
       - Technological Innovations
This information will help you to start your Risk analysis Plan. Please let me know if you need any thing esle on this.
Please award points if this is helpful.
Regards,
Ramesh Choragudi

Enterprise Risk Management Approach in SAP GRC

Hi All,
Can you please let me know as to what is the approach followed for implementation of Enterprise Risk Management (ERM) in SAP GRC. Also please tell me how the internal control frameworks like COSO, COBIT is mapped to ERM in SAP GRC.
Regards
Vivek

Dear Vivek,
While assigning roles to users, you will be displayed the risks that are identified with those roles, if any. You can either mitigate or remove the roles.
The process covered by GRC Risk management includes the following steps:
-Risk Planning: Determines the approach to risk management in each business area or project. This includes setting up the risk management organization and defining risk thresholds . This phase is partially supported by a software application.
-Risk Identification and Analysis: Identifies the risks in order to analyze and prioritize them along different attributes, such as probability of occurrence and potential total loss associated to the risk.
-Risk Response: Decides on actions needed to respond to a risk. One action could be to actively mitigate the risk to reduce probability of occurrence and/or potential impact.
-Risk Monitoring: Includes the regular update of risk information and the risk reporting to monitor progress along the risk management process.
The Risk Management application provides a set of different reporting capabilities based on the individual needs of the target groups:
-A set of built-in reports that are delivered with the application. These reports allow risk managers to review the current risk state.
-Visual Composer based dashboards that provide information about the current risk status on an aggregated basis. The dashboards fulfill the risk reporting needs of senior managers and line managers.
Step 1: You maintain the Risk structure
1. You set up the organizational hierarchy
2. You set up the Activity Hierarchy
3. You set up the Risk Hierarchy
Step 2: You perform the Risk Assessment
1. You identify the risks
2. You analyze the risks
3. You respond to risks
4. You document the Incidents
Step 3: You analyze risk reports
1. You generate risk reports
2. You report the incidents
Step 4: You analyze the dashboards
Refer SAP documentation on GRC for more information.
Regards,
Naveen.

Two questions about Risk Management 2.0

hi experts,
Please find below two questions about Risk Management:
-In SPRO, Risk Management>Create top node: after completing information and executing I have this error:
Error in the ABAP Application Program
The current ABAP program "/ORM/ORM_CREATE_TOP_NODES" had to be terminated
because it has
come across a statement that unfortunately cannot be executed.
The following syntax error occurred in program "/ORM/SAPLORM_API_SERVICES " in
include "/ORM/LORM_API_SERVICESU10 " in
line 97:
"Bei PERFORM bzw. CALL FUNCTION "GET_ORGUNIT_THRESHOLDS" ist der Aktual"
"parameter "I_ORGUNIT_ID" zum Formalparameter "IV_ORGUNIT_ID" inkompati"
"bel."
The include has been created and last changed by:
Created by: "SAP "
Last changed by: "SAP "
Error in the ABAP Application Program
The current ABAP program "/ORM/ORM_CREATE_TOP_NODES" had to be terminated
because it has
come across a statement that unfortunately cannot be executed.
Do you know where it could come from?
-On the Portal>Risk Management
when I click in a link under the risk management menu(activities and risks, risk report, document risk,...) i alway have an internal server error:
While processing the current request, an exception occured which could not be handled by the application or the framework.
If the information contained on this page doesn't help you to find and correct the cause of the problem, please contact your system administrator. To facilitate analysis of the problem, keep a copy of this error page. Hint: Most browsers allow to select all content, copy it and then paste it into an empty document (e.g. email or simple text file).
Do we have to set up some customizing points before accessing these links?
Thank you !
Regards,
Julien

Hi Julien ,
I have the same error what u described as :-
-On the Portal>Risk Management
when I click in a link under the risk management menu(activities and risks, risk report, document risk,...) i alway have an internal server error:
While processing the current request, an exception occured which could not be handled by the application or the framework.
If the information contained on this page doesn't help you to find and correct the cause of the problem, please contact your system administrator. To facilitate analysis of the problem, keep a copy of this error page. Hint: Most browsers allow to select all content, copy it and then paste it into an empty document (e.g. email or simple text file).
Do we have to set up some customizing points before accessing these links? "
Are you able to solve this. Please let me know how to resolve this???
Thanks
Regards,
Atul

How SAP Risk Management may be interfaced with SAP Strategy Management?

Hello,
Any document, any customer experience around integration between SAP BusinessObjects Strategy Management and SAP BusinessObjects Risk Management would be very appreciated.
Best regards
Jean-Luc

Hi Renaud,
where you able to create your webservice and use it from GRC RM?
If yes, I would be interested in - 'How do i connect SAP RM 3.0 with that web service'
Regards
Holger

I forgot the answers for the security questions and when I try to change them (My Apple ID - Manage your account - Password and Security) I'm asked to answer the exact questions I'm Trying to change because I don't remember the answers. How can I do it?

I forgot the answers for the security questions and when I try to change them (My Apple ID -> Manage your account -> Password and Security) I'm asked to answer the exact questions I'm trying to change because I don't remember the answers. How can I do it?

Can't you try the email option instead?

Not able to create a new project (i.e Manage - Project ) in 10g

Hi Team
I am trying to create a new project to implement Multi User Development Environment (MUDE) , but facing the below problems while doing so : -
a:> While Opening repository in Online Mode :-
I am not able to open open Manage --> Projects ( as Projects is disabled for me i. grayed out )
b:> While opening in Offline Mode :-
I am able to navigate to Manage --> Projects , but when the Project Windows opens and I am doing Actions --->New Project not able to do so ( as New Project is disable i.e grayed out ) .
Please guide.
Thanks
Rohit

Hi Friends
Actually there was a mistake on my part ... i.e I had opened the repositorty in offline while BI server was still running !
how silly . ..:)
I am now getting the options .
Regards
Rhit

Missing (most, but not all) masters from managed project

I just found that I have a one project in my library where most of the raw master files (NEF) are missing. The project contains 160 photos, but only 14 masters are present and these are randomly distributed in the project (not sequential files). My entire library is managed (not referenced). All photos were imported at one time.
All the edited versions appear in the browser with no problem, including the "full" version and the Quick Preview ("P"). Oddly, when I press "M" to view the master image, it displays correctly with no adjustments, but the message "Master Image not Found" appears where it would normally say "Master Image." I only noticed the masters were missing when I tried to export a version and got the follwing message:
"Versions with unavailable master files cannot be exported. The selected master image is either offline or not found. Please reconnect it and try again."
I searched in the library and vaults for original the filenames, but they do not exist in either location. If all the masters were missing, I would have concluded that I imported that project as a referenced file and later deleted the masters, but 14 of the 160 are still there.
I have two questions:
First, does anyone have any idea how the master files could be deleted so I can avoid this in the future? I am beginning to think this is simply a corruption of the database (not reassuring).
Second, is there any way to recover the versions that clearly exist in the project so I can reimport these as masters? While viewing them in the browser, I can zoom in to the original resolution on both the master and the edited version, but can't perform any further edits to the image (although I can add metadata). I'd be happy to retrieve a JPEG version, even though it appears I have lost the original raw file.
By the way, I have already performed all three library repair options on Aperture launch (Repair Permissions, Repair Database and Rebuild Database).
Thanks for any help,
Dave

From the OP's other thread:
I have three vaults (on three HDs) backing up one Aperture library (two onsite and one for offsite backup). Two of the vaults simultaneously became corrupted and I could no longer back up to them.
That plus the live library seems like 3 to me.
You wrote:
With managed-Masters one can back up a broken Library to a dozen perfect drives and all that results is a dozen identically broken Libraries.
Which is why backing up without verify the backup is a meaningless exercise. This goes for any backup method, How do you know your TM or CCC backup or simple copy of your masters is good?
If the Masters are backed up prior to Aperture the problem resolves (versions still lost).
And this is true also for managed libraries.
If (backed up) Referenced Masters are used and the Library becomes corrupt the problem resolves (versions still lost).
Not sure what you are trying to say here.
Proper use of Vaults also save Versions, but only prior to the time that the Library became corrupted - and we do not necessarily know the instant a Library becomes corrupt.
Proper use of vaults also saves masters if the library is managed. Ans see above for why we verify backups.
Look I agree that the masters need to be backed up in other than the vault (or TM or CCC or any one place). I use the Aperture backup dialog in the input window:
But once the masteres are backed-up referenced masters has no inherent saftey advantage over managed masters. In fact if all you do is backup before import and then place the masters on their own disk they are slightly less secure as they are only in two places.
In my operation I have my masters in three places, the import backup location the library and the vault I create from that library. In fact I have multiple vaults so in fact I have my masters in a minimum of 5 places. And its all fairly transparent.
So continue to sing the praise of referenced masters, for some and in some situations they are the way to go But from a security standpoint they have no advantage over managed masters.

Risk Management interactive reports drill up error

Hi,
I have been working with Risk Management 10 in SAP GRC recently. I noticed that when using the Risk Manager Interactive Reports in the Report section (Heat Map and Overview Report), I have received an error when trying to drill back up to the parent organizational unit after I have drilled down to the child sub organization.
Our current workaround is to click on the <All> unit, close the window, and then reopen the window and drill back down to the parent unit. While this workaround has been successful when using the reports so far, it is difficult to communicate this error to other users when they attempt to use the reports.
Are there any fixes to this error, or any plans to fix? Otherwise, is there a feature that needs to be adjusted in Risk Management? Thanks.

Bump

Links to Documentation in a Solution Manager Project

Solution Manager Project Documentation has a feature that allows you to "link" to differnet levels of your documentation. For instance, if I attach a documentation template at the Process level of a Project and there are 10 process steps under that process, I can create links at each process step that will link to the document that I attached at the process level.
Is there a way to automatically build these links or must I create each link manually?
Thx

Hi Rod,
at least until solman version 7.0 ehp1 i'm not aware of any automatic way to do that. Maybe in the 7.1 could be any other option, maybe importing from any external tool.
I believe that the only things you can do in a node and replicate to the subnodes are the settings in the administration tab.
Kind regards, Fabricius

BC sets activation for GRC 10.0 Risk Management

Hi ,
I am new to Risk management,please suggest the required list of BC set for activation.
Thanks in advance,
Varun

Hi Varun ,
Apart from the common BC sets , You also need to activate RM Specific BC sets.
You can find the list in Installation Guide " SAP Access Control, SAP Process Control, and SAP Risk Management 10.0/10.1"
( https://websmp108.sap-ag.de/~form/sapnet?_SCENARIO=01100035870000000202&_SHORTKEY=01100035870000718172 )
Here is the list for your quick reference:
BC_SET_ANALYSIS_PROFILE
BC-SET_ACTIVITY_TYPES
BC_SET_BENEFIT_CATEGORY
BC_SET_DEFINE_CATEGORIES_POWL
BC_SET_DEFINE_THREE_POINT_ANALYS
BC_SET_DRIVER_CATEGORY
BC_SET_IMPACT_CATEGORY
BC_SET_IMPACT_LEVEL
BC-SET_INFLUENCE_STRENGTH
BC_SET_MAINTAIN_DEFAULT_QUERY
BC-SET_MAINTAIN_OPP_RESP_TYPES
BC_SET_MAINTAIN_USER_RESP
BC_SET_OBJECTIVE_CATEGORIES
BC_SET_PROBABILITY_LEVEL_ID
BC_SET_PROBABILITY_LEVEL_MATRIX
BC-SET_RESPONSE_EFFECTIVENESS
BC-SET_RESPONSE_TYPE
BC_SET_RISK_APETITE
BC_SET_RISK_LEVEL
BC_SET_RISK_LEVEL_MATRIX
BC_SET_RISK_PRIORITY_MATRIX
BC_SET_ROLES
BC_SET_SPEED_OF_ONSET
BC-SET_LOSS_MATRIX_COLORS
BC_SET_UNIT_MEASURE
BC-SET_RISK_RESPONSE_TYPE
BCSET-GRRM-GRFNV_POLICYTYPE
BCSET-GRRM-GRRMVPOLICYRESP
BCSET-GRRM-GRFNV_POLICYTYPE
BCSET-GRRM-GRRMVPOLICYRESP
Thanks & Regards
Uma Shankar T

SAP GRC 10.0 Risk Management - Forecasting Horizon Scoring Analysis Mode

Hi everyone,
In SAP GRC 10.0 Risk Management Support Package 7, we need to assess a corporate risk by performing an automatic analysis aggregation based on a scoring analysis profile.
The problem is that corporate risks must be created based on a forecasting horizon.
So, can we create forecasting horizons with scoring analysis mode? How? Must be enabled through customizing or applying a SAP note?
Best Regards,
Chema Traveso

Hi,
I think this is still user-specific, as it was in 5.X. I have checked the new GRC authorisation object parameters delivered within the roles and also tried to see if a Admin user was able to see all the variants created by the different users, but so far I have not found a solution.
It may be worthwhile to raise this in "IdeaPlace", hoping it gets enough votes and SAP's attention for implementing in a future Support Pack delivery.

Dyman & Associates Risk Management Projects: 10M Passwords Publicized For Research

Similar Messages

Maybe you are looking for