From time to time, I get disappointed how much effort and money is put into securing computers, networks, mobile phones, ... and yet in 2016 here we are, where not much has changed on the defensive side. There are many things I personally blame for this situation, and one of them is the security tips.
The goal of these security tips is that if the average user follows these easy to remember rules, their computer will be safe. Unfortunately, by the time people integrate these rules into their daily life, these rules either become outdated, or these rules were so oversimplified that it was never true in the first place. Some of these security tips might sound ridiculous to people in InfoSec nowadays, but this is exactly what people still remember because we told them so for years.
PDF is safe to open
This is an oldie. I think this started at the time of macro viruses. Still, people think opening a PDF from an untrusted source is safer than opening a Word file. For details why this is not true, check: https://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-497/Adobe-Acrobat-Reader.html
On an unrelated note, people still believe PDF is integrity protected because the content cannot be changed (compared to a Word document).
Image stolen from Kaspersky |
Java is secure
One of the best ones. Oracle started marketing Java as a safe language, where buffer overflows, format strings and pointer-based vulnerabilities are gone. Unfortunately, they forgot to tell the world that instead of "unsafe programs developed by others" they installed their unsafe program on 3 billion devices.
Stay away from rogue websites and you will be safe
This is a very common belief I hear from average people. "I only visit some trusted news sites and social media, I never visit those shady sites." I have some bad news. At the time of malvertising and infected websites, you don't have to visit those shady sites anymore to get infected.
Don't use open WiFi
I have a very long explanation of why this makes no sense, see here. Actually, the whole recommendation makes no sense as people will connect to public WiFis, no matter what we (InfoSec) recommend.
The password policy nightmare
Actually, this topic has been covered by myself in two blog posts, see here and here. Long story short: use a password manager and 2-factor authentication wherever possible. Let the password manager choose the password for you. And last but not least, corporate password policy sux.
Sites with a padlock are safe
We tell people for years that the communication with HTTPS sites are safe, and you can be sure it is HTTPS by finding a randomly changing padlock icon somewhere next to the URL. What people hear is that sites with padlocks are safe. Whatever that means. The same goes for WiFi - a network with a padlock is safe.
Use Linux, it is free from malware
For years people told to Windows users that only if they would use Linux they won't have so much malware. Thanks to Android, now everyone in the world can enjoy malware on his/her Linux machine.
OSX is free from malware
It is true that there is significantly less malware on OSX than on Windows, but this is an "economical" question rather than a "security" one. The more people use OSX, the better target it will become. Some people even believe they are safe from phishing because they are using a Mac!
Updated AV + firewall makes me 100% safe
There is no such thing as 100% safe, and unfortunately, nowadays most malware is written for PROFIT, which means it can bypass these basic protections for days (or weeks, months, years). The more proactive protection is built into the product, the better!
How to backup data
Although this is one of the most important security tips which is not followed by people, my problem here is not the backup data advise, but how we as a community failed to provide easy to use ways to do that. Now that crypto-ransomware is a real threat to every Windows (and some OSX) users, even those people who have backups on their NAS can find their backups lost. The only hope is that at least OSX has Time Machine which is not targeted yet, and the only backup solution which really works.
The worst part is that we even created NAS devices which can be infected via worms ...
Disconnect your computer from the Internet when not used
There is no need to comment on this. Whoever recommends things like that, clearly has a problem.
Use (free) VPN to protect your anonimity
First of all. There is no such thing as free service. If it is free, you are the service. On another hand, a non-free VPN can introduce new vulnerablities, and they won't protect your anonymity. It replaces one ISP with another (your VPN provider). Even TOR cannot guarantee anonymity by itself, and VPNs are much worse.
The corporate "security tips" myth
"Luckily" these toxic security tips have infected the enterprise environment as well, not just the home users.
Use robots.txt to hide secret information on public websites
It is 2016 and somehow web developers still believe in this nonsense. And this is why this is usually the first to check on a website for penetration testers or attackers.
My password policy is safer than ever
As previously discussed, passwords are bad. Very bad. And they will stick with us for decades ...
Use WAF, IDS, IPS, Nextgen APT detection hibber-gibber and you will be safe
Companies should invest more in people and less into magic blinking devices.
Instead of shipping computers with bloatware, ship computers with exploit protection software
Teach people how to use a password safe
Teach people how to use 2FA
Teach people how to use common-sense
Conclusion
Computer security is complex, hard and the risks change every year. Is this our fault? Probably. But these kinds of security tips won't help us save the world.
Related links
- Hack Tools For Mac
- Hack Tools For Windows
- Hack Rom Tools
- Hack Tools Online
- Hack Tools For Ubuntu
- Hacking Tools For Pc
- Pentest Tools Website
- Pentest Tools Android
- Pentest Tools Windows
- Pentest Tools Url Fuzzer
- Hack Tool Apk
- Hacking Tools Hardware
- Hack App
- Hacking Tools Name
- Hacker Techniques Tools And Incident Handling
- Ethical Hacker Tools
- Hacker Tools For Windows
- Hack Apps
- Hacker Tools Linux
- Hacker Tools Apk
- Install Pentest Tools Ubuntu
- Hack Tools For Games
- Hacker Tool Kit
- Pentest Tools Port Scanner
- Hacking Tools Online
- Pentest Box Tools Download
- Hacking Tools For Mac
- Hack Tools For Ubuntu
- Hack Tools 2019
- How To Hack
- Hacking Tools For Pc
- Best Pentesting Tools 2018
- Hacking Tools For Windows 7
- Pentest Tools Free
- Hack Tool Apk No Root
- Hacker Tools Online
- Pentest Tools Alternative
- Hack Rom Tools
- Pentest Automation Tools
- Pentest Tools Url Fuzzer
- Hacker Tools For Mac
- Hacker Tools For Pc
- Hackers Toolbox
- World No 1 Hacker Software
- Hacker Tools For Ios
- Pentest Tools Bluekeep
- Pentest Recon Tools
- How To Make Hacking Tools
- Hacker Tools For Ios
- Hacking Tools Github
- Pentest Tools Alternative
- Usb Pentest Tools
- Hacker Tools For Windows
- Hacking Tools
- Hacker Tools Windows
- Pentest Box Tools Download
- Pentest Tools Windows
- Hacking Tools Name
- Hack Tool Apk
- Ethical Hacker Tools
- Hacking Tools Pc
- What Are Hacking Tools
- Pentest Tools Bluekeep
- Hacking Tools For Mac
- How To Make Hacking Tools
- Hacking Tools For Kali Linux
- Pentest Tools List
- Hack Tools For Pc
- Hack Tools Pc
- Tools For Hacker
- Pentest Tools Website Vulnerability
- Beginner Hacker Tools
- Hacker Tools For Pc
- Hack Tools Online
- Hacking Tools Github
- Hacking Tools Free Download
- Hack App
- Hacker Tools For Ios
- Hacking Tools Kit
- Nsa Hack Tools Download
- Pentest Tools Port Scanner
- Hacking Tools Windows
- Pentest Recon Tools
- Hacking Tools And Software
- Pentest Tools For Windows
- Install Pentest Tools Ubuntu
- Hacks And Tools
- Hacker Tools For Mac
- Nsa Hack Tools Download
- Hacker Tools Apk Download
- Hacking Tools Github
- Github Hacking Tools
- Hacking Tools For Beginners
- Pentest Tools Free
- Hacking Tools Kit
- Pentest Tools Subdomain
- Hacking Tools 2020
- Computer Hacker
- Hacker Tools List
- Hacker Tools Linux
- Pentest Tools Github
- Black Hat Hacker Tools
- Pentest Tools Bluekeep
- Hacker Tools Software
- Hacker Tools List
- Hacking Tools And Software
- Ethical Hacker Tools
- Hack App
- What Is Hacking Tools
- Hacker Tools 2019
- Hacking Tools For Mac
- Hacking Tools Github
- Hacks And Tools
- Pentest Tools Find Subdomains
- Hacker Tools For Pc
- Hack Tool Apk
- Pentest Box Tools Download
- Pentest Reporting Tools
- Hackrf Tools
- Hack Tools For Mac
- Hacking Tools Windows 10
- Hacker Security Tools
- Computer Hacker
- Hacking Tools For Windows Free Download
- How To Hack
- Hackers Toolbox
- Hacking Tools Windows
- Hacking Tools For Windows Free Download
- Pentest Tools Download
- Hacking Tools Usb
- Pentest Reporting Tools
- Best Hacking Tools 2019
- Pentest Tools Open Source
- Termux Hacking Tools 2019
- How To Install Pentest Tools In Ubuntu
- Hack Tools
- Hacker Tools For Mac
- How To Make Hacking Tools
- Bluetooth Hacking Tools Kali
- Hack Tools Github
- Hacking Tools For Windows
- Pentest Tools Nmap
- Hack Website Online Tool
- Best Hacking Tools 2019
- Hacker Tools For Ios
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Open Source
- Tools 4 Hack
- Wifi Hacker Tools For Windows
- Hack Tools Online
- Hack Tools For Ubuntu
- Hacking Tools Github
- Hacker Tools 2020
- Hacking Apps
Δεν υπάρχουν σχόλια:
Δημοσίευση σχολίου