Fake News in Cybersecurity

It seems like we are bombarded with claims of ‘misinformation’ or ‘disinformation’ these days. We all hear about it so much on the news that most of us don’t know what to believe anymore. Politics and COVID have been centers of this controversy, but what concerns us at ITFirm.com are misconceptions still being taken as truth in the world of IT services and Cybersecurity.

Some of these myths are so ingrained among both business owners and consumers that they operate under a false sense of security. It’s time to set the record straight and dispel the misinformation.

‘Status Quo’ is not a concept that has relevance in the Cybersecurity threat landscape – it is ever-changing, where new threats and new solutions follow closely on each other’s heels. Your view of how to protect yourself from the threat matrix may seem the same every day on the surface, but in the underlying technology, it changes every day.

Your IT support or Managed IT Services provider is the shepherd and sheepdog that keeps your network flock safe. They know which information is reliable and true, and what are misconceptions.

As a business owner or administrator, you cannot afford to entertain false beliefs and become complacent. Ignorance of reality and complacency guarantee an inadequate approach to network risk reduction strategies.

The following are the Top 5 misconceptions or ‘fake news’ items about Cybersecurity, which can be very dangerous if taken as fact:

1) “Cyber criminals don’t want us - we’re too small.”
Every year, cyber-statistics refute this most damaging and insidious false belief – that notion is absolutely untrue. Cyber is like ‘Goldilocks & the Three Bears’. One business (or chair or bed in the story) is too big or too small for one crook, but just right for another.

The data breaches and Ransomware attacks that make the news, like the Colonial Pipeline attack in 2021, are committed by a relatively small handful of elite criminals. The lowest echelon are fast smart phone scams for a couple hundred bucks here and there, committed by rank and file, unsophisticated hackers.

The vast majority (over 80%) of all cyber-attacks, most of which are Ransomware, are targeted at Small and Mid-size Businesses (SMBs). The Colonial Pipeline can weather paying a 7-million-dollar ransom much easier than most businesses with 10 employees can handle a 1 or 2 hundred thousand dollar ransom. A couple hundred grand can shut many SMBs down.

2) “We’ve never been attacked, so our Security is fine.”
Another dangerous belief. At ITFirm.com, we stay a step ahead of malware and phishing schemes as they evolve and adapt to new protections, but we still say, “It’s not a matter of IF, but of WHEN”.

As you read this, criminals are busy developing new methods of network intrusion – their well-funded Research & Development (R&D) never stops. With more than 32 million SMBs in the United States alone, they just haven’t found you yet – and the more time that goes by, the closer they get to your network.

You may have the most up-to-date, next-generation cyber defenses available, but they are useless when one wrong click by an employee on a link or attachment in a phishing email opens the door for malware to infect your system. Ransomware generally locks the initially infected workstation screen and starts encrypting your data within a minute or two of that click – relieving you of access to it. Then, a ransom in cryptocurrency is demanded in exchange for a decryption key code. Paying the ransom is no guarantee - 40% of companies that pay the ransom NEVER get the decryption key.

3) “We use strong passwords, so we’re safe.”
Aside from the errant click on a phishing email noted above in #2, it depends on what you think a ‘strong’ password is. I can’t count the times that we have ‘onboarded’ new clients to discover passwords like ‘password’ (seriously) or ‘12345’ (the world’s most common password) – the really clever ones turn it around to ‘54321’ (HaHA!!! – they’ll never figure THAT out!). Yes, they will… in about zero seconds.

If you wonder how long it would take to break your password, PasswordMonster has a great calculator.

Aside from creating stronger passwords, Multi-Factor Authentication (MFA) should be used for access to your network. There are various common factors used: Questions – the first ever was probably, “What is your mother’s maiden name?” The Q & A here should be better than that – and not based on information that can easily be found on your social media. A question like “What’s your pet’s name?” is useless if ‘information miners’ – those who do the research to crack the passwords and sell them to the real crooks – can look on your facebook and see photos captioned ‘Me and Professor McFuzzyButtkins at the park’. Cybercrime is a billion dollar business - they are looking.

After that, retinal scans or thumbprints, even an employee ID card scan greatly improve your Cybersecurity.

4) “We’re compliant with industry regulations, so that should be enough.”
Industry and government regulations generally cover only the bare minimum in security and are often narrow in scope (often just secure backups) – usually in place to ensure the safety of your client information and little more. Your business has a lot more at stake than just that.

5) “IT support will take care of security.”
Good IT Support or a Managed Services Provider (MSP) should be maintaining top-notch cyber defenses, but do you know that for a fact? IT services is an unregulated industry – any bum can open an ‘IT company’. We have come to the rescue of more than a few businesses whose ‘IT Guys’ were unknowledgeable, incompetent morons.

Referring back to #2 above, according to PhishingBox, about 90% of all successful network breaches happen as a result of an employee falling for a phishing scam – Many surprising facts can be found HERE. Ongoing Security Awareness Training is a MUST for any business.