Risk
2/29/2008
04:50 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

F-Secure Survey Shows Misplaced Security Confidence

A new computer-use survey from security firm F-Secure shows that the majority of more than 1,000 respondents understands the importance of updating virus definitions. Yet less than 20 percent understood the need for frequent definition updates.

A new computer-use survey from security firm F-Secure shows that the majority of more than 1,000 respondents understands the importance of updating virus definitions. Yet less than 20 percent understood the need for frequent definition updates.The F-Secure Online Wellbeing Survey found that more than 90 percent of the North American and European respondents had security software installed on the computers.

But 76 percent of the participants felt confident that their anti-virusware would protect their computers from infection, while only 19 percent understood that virus definitions need to be checked/updated daily (at least.)

The disconnect reflects one of the largest security issues facing small and midsize businesses (and bigbiz, and consumers and everybody else, for that matter) -- the failure to understand the constant threat/constantly evolving threat environment in which we work, play and surf.

While F-Secure's purpose in underwriting the third-party survey is to help market its security services, as well as to offer a picture of the (over)confidence level of many computer users, the underlying message of ongoing computer-user naivet or outright ignorance, sometimes willfully so) should get equal attention from every one of us.

Until our colleagues and employees (and everyone else who calls on us for help because we "understand computers") come to understand, at the very least, for themselves that the Net, e-mail, downloads and all the rest of it is filled with very large threats that can change hourly, the confidence/safety gap is unlikely to narrow.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.