Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/31/2019
02:30 PM
Brian Engle
Brian Engle
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

8 Cybersecurity Myths Debunked

The last thing any business needs is a swarm of myths and misunderstandings seeding common and frequent errors organizations of all sizes make in safeguarding data and infrastructure.

Cybersecurity plays an integral role in the realm of good business models. You'd be hard pressed to come across an enterprise which doesn't have some form of cybersecurity policy as part of its infrastructure. But even cybersecurity programs built with good intentions can fall short. Why? The best intentions are often based on an array of myths perpetuated by a combination of mistrust, misunderstanding, and lack of information. These are the myths of cybersecurity, and I'm going to break down some of the most common ones found throughout the tech industry.

Myth 1: You're Too Small to Be Attacked
You read about data breaches all the time. Big companies suffer penetration attacks with millions of user data compromised by the nebulous realms of hackers. "Well," you think, "that'll never happen to my business, there's not enough value, we're too small." And that's just wrong. In 2016, 43% of all cyberattacks were conducted against small to medium-sized businesses. This is a growing trend, with malware and malicious attacks escalating in both complexity and frequency. You're as likely as a target as any major enterprise, so don't buy into this line of thinking.

Myth 2: Passwords Are Good Enough
The downfall of any security policy is the lazy "set it and forget it" mentality. Cultivating this lethargic approach is the adoption of complex passwords and believing it's good enough. You have your staff memorize a 12-character login phrase with special characters, caps, and numbers? That must be enough!

It's not, because a mix of social engineering and complex malware attacks can circumvent it  with alarming ease. Password reuse across multiple platforms makes you dependent on the security of other organizations, where a breach of their password database places accounts at risk on your systems. Malicious third parties employ a wide range of bots and auto-attacks to hasten their process, and without two-factor authentication and a level of encryption (especially on vulnerable public networks), one password just isn't sufficient in today's dangerous cyber world.

Myth 3: Antivirus Is Good Enough
Much like the "set it and forget it" password philosophy, this equally applies to your antivirus setup. It's tempting to believe the fancy software your enterprise invested so much capital in will thwart any and all attackers, but again, that's not true. Antivirus is of foundational importance, but good cybersecurity requires a rigorous program that includes protection, detection, and response preparation along with safe practices for user behaviors.

Myth 4: It's IT's Problem
Computers are hard, so let IT handle everything, right? This, again, is a foolish way to look at cybersecurity. Some businesses lack the capital to hire experienced staff. And, even with a good IT team, said staff are limited in what they can handle. If you expect your IT team to manage every single tech-related problem, from resetting logins to managing network infrastructure and dealing with potential intrusions, you're asking for trouble. Every staff member should be familiar with good cybersecurity practices.

Myth 5: BYOD is Safe
While a BYOD (bring your own device) policy is popular and cost-effective, it's a whole new avenue of risk for a business. Assuming smartphones and mobile devices brought by staff are secure is a serious error in judgment. Apps with personal data, logins, and business-related info are easy to compromise, and every unsecure device is just another potential hole in your cybersecurity foundation. It's important that employees follow rigorous guidelines when using their own hardware.

Myth 6: Total Security Is Possible
The eternal struggle of cybersecurity is its constant need to adapt to new threats. As security teams adapt strategies and tactics to meet those threats, attacks evolve to counter the changes. It's a constant battleground, meaning total security is impossible to achieve. A business should always expect some form of cyberattack and should always have backup, incident and crisis preparedness, and disaster recovery (BDR) measures in place. You can only take a proactive approach towards malicious threats, not counter them in their entirety.

Myth 7: You Don't Need Assessments and Tests
I couldn't think of a more disastrous approach to a cybersecurity plan. This is like working on a term paper and submitting it with zero revisions, edits, or extra eyes. You cannot reasonably expect your current cybersecurity plans to be foolproof without conducting assessments and penetration tests. These self-evaluations are invaluable, revealing where you're weakest and strongest.

Myth 8: Threats Are Only External
Competent security requires just as a hard a look at internal staff and policies as do the various third-party attacks. This is because — whether from human error or malign intent — cybersecurity risks are as likely to emerge from your own enterprise as outside of it. More is at risk, too, considering staff are the pathway to the most sensitive info.

Related Content:

Brian Engle's role as CISO/Director of Advisory Services allows him to lead the delivery of strategic consulting services for CyberDefenses' growing client base with risk management support, information security program assessment, and cybersecurity program maturity ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
StephenGiderson
50%
50%
StephenGiderson,
User Rank: Strategist
2/13/2019 | 11:58:01 PM
Better safe than sorry
We should never take security for granted! At the end of the day, all it takes is some guy to target you, and there goes all of your data and privacy! If you can afford to implement better security systems in your networks, do it! It will be better than the alternative.
markgrogan
50%
50%
markgrogan,
User Rank: Strategist
2/13/2019 | 1:39:18 AM
Be on your best guard
It is highly dangerous to base your beliefs on a set of myths which have yet to be proven by experts. If you are managing a huge account, this situation simply means that you just have a lot more to handle as a lot more is at stake. You cannot simply remain complacent when security is concerned even if you are handling a small firm. You have to be put your best front forward before any security lapses even have the opportunity to occur.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/1/2019 | 12:19:29 PM
Almost all have one trait in common
Discussed this last night at my A.A. meeting - COMPLACENCY.  The trust that because things seem OK they really are OK and, therefore, fine and dandy.  Most Malware cannot be seen by the average user save something obvious like ransomware or adware.  Google Redirectors are common but the real invasive stuff that hides and steals data is very hard to jus SEE off the bat.  So if it is part of IT and the server is up and staff is working - well then.  My clients would have said SO, WTF IS WRONG????/   
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...