Security, while a topic on every organisation's lips, is also one that attracts a large number of myths. This is due in part to lack of information, erroneous assumptions and generalisations. As with all myths, they are filtered down from one person to another, mostly because it is not inconceivable that they are true.
Simon Campbell-Young, CEO of Phoenix Distribution, says these myths cause individuals to become lackadaisical about security, and far more likely to fall victim to an attack.
He discusses some of the more common myths that plague the security sector. "Firstly, there is the misconception that anti-malware solutions and firewalls are a silver bullet, and constitute total protection. This is not true. While they are vital links in the security chain, no single element is 100% effective all the time. They are not effective against more advanced threats, or zero-day attacks. They are best when used in conjuction with good security practices and sensible habits."
Another myth, he says, is the belief that once an anti-malware software solution is installed, the user can sit back and no longer give it any thought. "While many think that installing a solution solves the problem, they need to bear in mind that hundreds of thousands of new threats are written every day, and new zero-day vulnerabilities are discovered. All vendors release updated versions of their software to fix vulnerabilities or bugs, and solve any issues. Updates need to be installed as soon as possible, and on a regular basis to make sure they are effective."
Perhaps one of the most dangerous myths, says Campbell-Young, is the 'I have nothing valuable worth stealing' notion that many users have. "The idea that you have nothing valuable or worth protecting is a ridiculous one. What you think is valuable, and what an attacker thinks is valuable, are two very different things."
He says personal data can be used in phishing or spear phishing attacks, financial details can be used to steal money, and even machines with none of this data can be hijacked and used to target others by making them part of a botnet that can be used in denial of service attacks.
Another fallacy, says Campbell-Young, is that attackers are only after people with money in the bank. "This is not true; identity theft can affect anyone. Bear in mind that cyber criminals go for the low hanging fruit, they want to gain the most, while going to the least effort. Everyone has information that can be useful, and identity theft can wreak havoc on the lives of even the least well-off individuals."
Finally, he says, and probably the most common myth, is that 'it won't happen to me'. Campbell-Young says this is the worst sort of wishful thinking, and often means people don't want to fork out a few hundred rands for a decent security solution. "Admitting that there is a problem means that something needs to be done about it. Too many have a 'head in the sand' attitude to security, which places them at great risk."
Share