3 biggest cybersecurity myths

3 biggest cybersecurity myths

No doubt cybersecurity is now part of our daily conversations – cryptocurrency hacking, election meddling, leaks and exposes, it is something that we all have learn to live with.

Unfortunately, there are still (many) people that believe cybersecurity is something “my geek nephew has to worry about, not me”.

Nathan House, a cybersecurity expert from Station X, published in his newsletter the 3 biggest cybersecurity myths and I found his insights a must-share with all of you:

 

#1 Small or medium sized businesses have nothing of value to an attacker

Many small businesses think they have nothing of value to an attacker so are unlikely to be a target, but the very opposite is the reality. I hear this “we have nothing of value to an attacker, why would they attack us?” question so often that it drives me bananas.

Small organisations are in fact perfect targets for attacks because they have weak defenses so are easily compromised.

A 2016 Government report confirms that 74% of small and medium-sized businesses (SMBs) reported a security breach and that only 7% of small businesses expect information security spend to increase in the next year.

Ransomware is the weapon of choice to attack small businesses indiscriminately, using it to encrypt the victim systems and files. Only when a ransom is paid are the files unencrypted.

All small businesses have something of value to themselves and it’s their own files and systems, which can be held for ransom.

Ransomware affects both SMBs and individuals alike. The attackers are now tailoring the amount of money demanded. They do not ask for a large sum from victims they know cannot pay. To unencrypt the files, they ask for a sum of money that is significant but “acceptable” to the victim.

In the case of an individual, it might be $100. For a small organisation, perhaps $500 is enough to make a nice income for the attackers and small enough that their victims are likely to pay.

Using ransomware to attack soft targets like small to medium sized businesses is becoming more and more prevalent. So not only is this a myth, it’s an extremely dangerous myth to believe and the one that is commonly held by management.

 

#2 Cyber security is an IT problem

This is another very dangerous myth if an organisations executives believe it.

IT staff should not be making risk decisions that can affect the success or failure of an organisation. That is the role of the executives.

There is no doubt that cyber security comes largely from implementing appropriate information technical based controls to safeguard information held within an organisation.

Therefore, IT are responsible for implementing and recommending security controls. But the final choice on if risks should be mitigated or taken should be down to the executives who understand the strategy objectives of the business.

Most organisations are not in the business of security. Security is just an enabler for the business to function within acceptable levels of risk. How much risk an organisation should take cannot be determined by IT as they simply don’t have this level of understanding about the organisation. It is for executives to set the level of risk tolerance.

An example might be that it could make good business sense to launch a product, so it can reach market in time and forgo some of the security. An IT person would not be able to make this sort of call.

Security is not an absolute. Its job is to inform the business and protect it to the level that is acceptable. Some organisations need to run with high levels of cyber risk in order to be viable as a business.

The risks from cyber attacks are not a technical problem. The recent attacks on TalkTalk, Sony, Target and others have resulted in serious financial damage being done to the company itself, and so the problem is now a boardroom issue that has to be managed at that level just like any other risk to the business.

 

#3 “Make my system 100% secure”

One of the most frustrating requests you can get as a security expert is being asked to “make the system 100% secure”.

There cannot be 100% security so the requester must define what “secure” means to them and they often have no clue.

People believe that complete security can be achieved and that complete security is required by law or industry practice. Neither is correct. Both laws and industry practices require businesses to do what is “reasonable.” Complete security is not required or even realistic.

Studies show that it would require businesses to increase overall security budgets nine-fold to address just 95 percent of the threats. That increase would, in most cases, exceed the overall budget for the entire business.

There is a fundamental paradox with regard to security efforts: As security protections increase, usability of the secured systems often decreases. That is, the greater the security, the less useful the thing secured will be.

It is, for example, possible to completely secure a mobile device, such as a smartphone. All that is necessary is to:

1. put the device into airplane mode,

2. place in a Faraday case and

3. lock the device in a secure safe

While complete security has been achieved, usability has been reduced to zero. A balance must always be struck between effective security measures and usability of the data or system being secured.

There are many misconceptions in cyber security that we need to overcome and what we need to always concentrate on is reducing risk.

 

Liked the post? Share the love!
Beware of fake and dangerous Android apps

Beware of fake and dangerous Android apps

According to the Internet machine it is estimated there are more than 2 billion (yes, billion with a b) active Android devices in the world.

Now imagine for a second that you are an evil villain straight out a Bond movie with a super magical computer that could take control of those devices… what would you do?

Well, some people are finding very creative and dangerous ways to make that a reality.

Android users (different from Apple iOS) have the ability to install apps from the Google Play store and from what’s called third party developers. This brings up some great advantages but also opens the door for the bad guys to attack devices by playing the “user” card.

Good example? Android apps that promise “unlimited movies and TV shows” or “fast credit card approval”. Also, there are many fake apps that look almost identical to the real ones like the fake WhatsApp that was downloaded more than a million times before it was discovered and removed last year.

An installed fake or dangerous Android app is something that should not be taken lightly, specially based on the cold hard fact that most of us use our phones and tablets more than our laptops. A very well crafted Android malware can steal your data, login credentials to other apps and websites, use your phone as a bot to attack other devices or for cryptocurrency mining, among many others.

How can you protect yourself? Glad you ask.

  1. Stop looking for apps to watch free movies and TV! This is the best honeypot hackers use to lure and attack your devices.
  2. Take a close look at the Search Results: when you search for an app you’ll get many results – a fake app will use the same icon as the one its trying to pose of. In this case, check the ratings and the number of downloads and you’ll see the real one has more reviews and higher downloads.
  3. Read descriptions and look at the screenshots: bogus apps might have grammar errors, low quality or non-existing screenshots, etc.
  4. When in doubt… simply don’t install the app!

Finally, if you spot a fake or suspicious app be a good user and report it. Google has the option under Additional Information; also share with your social media peeps, this is the best way to create awareness.

Liked the post? Share the love!
Got a brand-new computer? Here’s some considerations before moving all your data

Got a brand-new computer? Here’s some considerations before moving all your data

This is an edited version of an old post I wrote years ago. Despite the fact laptop prices have not came down (it’s quite the opposite), many clients called me early December asking for suggestions on what kind of computer they should get – 100% are getting laptops, a clear indication that desktop computers in the consumer market are simply disappearing.

My response is always the same: minimum specs should be i5 processor (latest generation if possible), 8 GB RAM and 250 GB SSD. Screen size, expansion ports and brands are personal preferences though my favourites for years have been Lenovo and Dell.

So now you have a new laptop… what’s next? Well, if you bought it from stores like Best Buy and Staples, your laptop will come with A TON of preinstalled software we IT pros joyfully call crapware. This is crappy software that manufacturers install to subsidize the cost of hardware like antiviruses, games, media players, PDF readers, etc. Almost all of it is junk and buggy, and it should get removed immediately way before you copy your first file. For this task we recommend PC Decrapifier.

Crapware out of the way, next is basic but important software:

  1. A good and paid antivirus – with free, you get what you pay for.
  2. Printer software and drivers: if your printer is older than a couple of years, Windows 10 should install drivers automatically when you plug it in via USB cable, but you still need to install your printer applications like scanner, copier, fax utility (if applicable), etc.
  3. Internet browser: Microsoft Edge is good, but Mozilla Firefox and Google Chrome are always excellent choices that any Windows user should install. Mac OS comes with Safari and you can also install Firefox and Chrome.
  4. Windows Updates: believe it or not, a computer is already behind critical updates out of the box. I suggest install ALL pending Windows updates before moving any data just in case process goes wrong you can roll back and start again without losing any data. Again, same goes for Mac OS.
  5. Microsoft Office (Win and Mac): Windows computers come with a pre-installed license of Office 2016 or Office 365. If you already have an Office 365 subscription process is as easy as log in with your account information and Windows will validate your installation. There are other free and excellent alternatives like Libre Office (Win/Mac/Linux).

Once all the above steps have been completed, I suggest you proceed to configure your email accounts and move your data to the new computer. If your stuff is in the cloud (Dropbox, Google Drive, iDrive which we totally recommend) you probably know what to do. If you have everything in your old hard drive, then you need an external hard drive to move the data or your trusted IT guy to help you with the process.

And that’s it, you can now go ahead and enjoy your new toy!

Liked the post? Share the love!