Seven Cyber-Security Myths Debunked

Security myths cause organisations to incorrectly assess threats, misallocate resources and set inappropriate goals. 

If we look at the world of cyber security through the eyes of the media, it’s a pretty frightening view. We hear story after story of security breaches hitting major companies and the subsequent data leaks that follows affecting thousands of people. It’s enough to fill any business with trepidation.

With cyber security such a big talking point, we tend to see a lot of information floating around – some of which is not in the least bit true. If a company wants to enhance its IT security it is imperative to be able to separate facts from fiction.

It’s these fundamental security myths that cause organisations to incorrectly assess threats, misallocate resources and set inappropriate goals. Dispelling those myths is key to developing a sophisticated and appropriate approach to information security.

So, what are these myths exactly?

Cyber security? Just leave it to the IT department

Implementing appropriate technical controls to safeguard the information that an organisation holds is the first line of defence against security threats. However, the biggest issue faced by businesses is in regards to the users of the systems where this information is held. These people represent the most significant risk either through intentional actions, a disgruntled staff member for example, or by accident. A 2015 HM Government Information Security Breaches Survey found that 81 per cent of large organisations reported some staff involvement in the breaches they suffered.

The most common threat today is ransom ware, an attack that is typically based on sending an email to a member of staff with an attachment. By opening the file, malware is downloaded onto the computer and the rest is then history. Educating staff to not open attachments or click on links is one of the most important areas for organisations to concentrate on.

The risks from cyber-attacks are no longer just a matter for technical teams. High profile attacks like TalkTalk and Sony have resulted in serious financial and reputational damage being done. The result is that cyber security is starting to become an issue that is handled at boardroom level. 

Software will sort out your security issues

To deal with most cyber-attacks, implementing good software management is the first stage of the process. It covers two of the five basic controls that CESG has listed as part of their Cyber Essentials scheme. Whilst it is effective in limiting the success of an attack and mitigating the effects, in isolation it simply cannot achieve everything.

Once again, people pose the biggest threat to secure information. Education regarding exposing their organisations to danger must be implemented. Businesses must strike a balance here though – introducing technical solutions that are complex and unusable by staff is counterproductive and will not protect sufficiently against attack.

It’s not all just a question of keeping the bad guys out

Most organisations that are serious about protecting their information understand that a successful cyber-attack is unfortunately inevitable – we have to accept that trying to keep the bad guys out may not be possible for the majority of businesses, implementing the controls set out by CESG would prevent most straightforward attacks. However, what they are unable to deal with are the less common but more sophisticated and prolonged attacks.

Well-developed processes across an organisation need to be implemented to detect unauthorised network activity and initiate appropriate action quickly. For any organisation holding significant amounts of sensitive or personal data, they must drive change to get to a stage where their systems can identify attacks and automatically change themselves to stop the attack being successful – or minimise the damage that occurs.

It’s just the big businesses that will be attacked

A 2015 HM Government report confirmed that 74 per cent of small and medium-sized enterprises reported a security breach. However, only 7 per cent of small businesses expect information security spend to increase in the next year.

The myth that small and medium-sized businesses don’t face a threat is actually the very opposite. For a hacker, small and medium sized organisations are seen as an opportunity as they believe less is being done to protect data. This data might be information about clients, customer details, bank details or it might be as a way into one of your customers’ systems where you are linked through e-commerce, by email or in some other way.

The previously mentioned ransom ware affects both SMEs and individuals alike. Hackers are intelligent – they do not ask for millions from their victims but instead ask for a sum of money that is significant but acceptable to most people.

The weak point is the user who clicks on links in emails or opens attachments. This is when the vicious circle beings. Before paying the ransom to get back to “normal” operations, just remember there are many gangs out there who will share your information. The evidence that you are willing to pay will quickly be passed around to other similar groups.

If the manufacturers made computing safe we wouldn’t need to worry about cyber security

Things are undoubtedly getting better when it comes to the hardware and software that is being created – Windows 10 is widely accepted as being one of the most secure Microsoft operating systems there has ever been for example. Manufacturers understand the importance of security for users and are working to improve this. They do face a challenge here though. If a computer is too secure then users find ways around the security or do not even use that system at all.

Technology can go so far but it is still often the users themselves who are unpredictable and unreliable.

I don’t have anything worth stealing

Each and every one of us has personal and sensitive data that we want to keep to ourselves and not share with anybody. In the Internet age we live in though, this is becoming increasingly difficult.

One of the primary purposes (if not the only one) of the World Wide Web was to share information. Once information about us is out in the Internet domain, it’s no surprise that it can find its way into the hands of bad people. It is essential to ensure that the more sensitive or personal information is better protected.

This includes protecting information stored on our local PC, tablet or smartphone. We need to realise than any device that can connect to the Internet is an opportunity for hackers.  

The Internet of things is a wonderful development

The Internet addressing protocol IPv6 will provide every single Internet-enabled device in the world with its own unique address so that they can be individually contacted. Smartphones, tablets, washing machines and even cars will be included. Whilst our lives are becoming more connected and convenient, a bigger opportunity for criminals to take advantage of this has been created.

The hacker of today only needs access to the Internet to initiate an attack. As connectivity to the Internet continues to grow, so does the cyber-attack surface available to hackers.

ITProPortal: http://bit.ly/27TH7Sn

 

 

« Real-life RoboCop Will Replace Human Cops By 2020
You Should Not Trust The Media »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Riverbed Technology

Riverbed Technology

The Riverbed Network and Application Performance Platform enables organizations to visualize, optimize, accelerate and remediate the performance of any network for any application.

SISSDEN

SISSDEN

SISSDEN will improve cybersecurity through the development of increased awareness and the effective sharing of actionable threat information.

Cybernance

Cybernance

Cybernance provide an enterprise-wide, web-based software solution for managing and mitigating cyber risk based on key compliance frameworks.

SparkCognition

SparkCognition

SparkCognition’s AI-powered solutions enhance cybersecurity, identify and prevent equipment failures before they happen, and provide prescriptive intelligence for maintaining your most critical assets

The Open Group

The Open Group

The Open Group: Leading the development of open, vendor-neutral IT standards and certifications.

ECS

ECS

ECS is a leading information technology provider delivering cloud, cybersecurity, software development, IT modernization, and advanced science and engineering services.

Repulsa

Repulsa

Repulsa provides state-of-the-art, patented, fast filtering with over 700 million malicious IP addresses and over 30 million categorized site listings updated daily.

Firedome

Firedome

Firedome's tailormade solution for IoT companies is designed to proactively prevent, detect, and respond to inevitable vulnerabilities in connected devices.

Braintrace

Braintrace

Braintrace’s services include Managed Detection and Response (MDR), Managed SIEM, SIEM-as-a-Service, SOC-as-a-Service, Advisory Services, and Incident Response.

Eclypsium

Eclypsium

Eclypsium protects organizations from the foundation of their computing infrastructure upward, controlling the risk and stopping threats inside firmware of laptops, servers, and networks.

Resistant AI

Resistant AI

Resistant AI protects against evolving online fraud. We connect the dots to provide a new layer of trust and performance for our clients’ systems.

PSafe

PSafe

PSafe is a leading provider of mobile privacy, security, and performance apps. We deliver innovative products that protect your freedom to safely connect, share, play, express and explore online.

Zyston

Zyston

Zyston's solutions provide end-to-end management of your cybersecurity needs. Our range of services help protect your business where it needs it the most.

Campus cyber

Campus cyber

A project initiated by the President of the Republic, the Cyber Campus is the totem site of cybersecurity that brings together the main national and international players in the field.

Crayon

Crayon

Crayon is a customer-centric innovation and IT services company. We provide guidance on the best solutions for our clients’ business needs and budget with software, cloud, AI and big data.

Sendmarc

Sendmarc

Sendmarc automates the process of protecting your domain from being used in email impersonation and phishing attacks.