Cyber Security: Companies have a much higher likelihood of being attacked by low-level criminals rather than by specialized hackers backed by some government. This means you can stop the scammers and protect your systems if you follow some basic survival tips in cyberspace.
One of the steps in this direction is also the acknowledgment that computers, smartphones, and IoT devices have vulnerabilities that hackers can exploit.
However, instead of targeting an ideal and complete impregnable system, information security professionals must ensure that the exploitation of these vulnerabilities causes as little damage as possible.
“The reality is that the things we buy, the things we develop have vulnerabilities that to overcome, we need to develop systems to manage the damage, not the vulnerability,” says Ian Levy, technical director of the National Cyber Security Centre, a unit of GCHQ (the UK’s equivalent of the NSA).
Cyber Security Let's talk about security companies
Part of the problem, he said, speaking at CRESTCon & IISP Congress security held in London, is that cybersecurity companies are causing fear of national attacks. However, most companies are unlikely to face one.
“The majority of attacks we see are carried out by ninja cyber monkeys”, he said “who can breach the laptop I have in my bag with his thought?”
This type of approach leads individuals and businesses to attempts to solve a problem that does not necessarily exist. Trying to prevent large state attacks, it is very likely that real threats from lower-level hackers remain unanswered.
“We throw the blame there when we don’t understand the problem and don’t know what to do. We must understand and prioritize the threat we are trying to fix”, said Levy, who stated that honesty (implied by security companies) is required for identifying the attackers’ identity. Most are low‑level hackers and not the so‑called ‘advanced persistent threat’ groups supported by governments.
“Top hackers use very high‑technology methods, but they are the exception.”
Cyber Security Which advice and from where;
“The reality is that the advice we give is terrible”, said Levy, referring to the cybersecurity sector as a whole, which gives recommendations for the use of long, complex passwords, regular password changes, while also preventing people from using password managers.”
“It’s a stupid piece of advice – let’s stop giving stupid advice”, he said and called on security companies to “stop the mystery in cybersecurity” and with the help of evidence and useful advice to help people make better decisions for their protection.
Regarding government attacks, Levy said that “there’s not much you can do about it” and urged companies and individuals to focus on securing low-level attacks and minimizing the damage.
“You don't need to worry about state attacks, the majority of victims in cyberspace come from ransomware, and from script-kiddies.”
Cyber Security Closing
We should note that although we expected something like this from an employee at GCHQ, (since many of the things he mentioned benefit the service he works for, which deals with bypassing all Cyber Security) his rhetoric has a basis.
We fully agree that security companies terrorize the world for profit, and that there is advice that is not worthwhile.
For example, what the GCHQ agent mentioned about password managers. A time‑tested piece of advice that we often give on this page is to stay away from online password managers.
That does not mean that I don't use a password manager…
I use it, but not online. The KeePass application is free and open‑source, stores your passwords locally (on your computer) and uses very strong encryption.
The only thing that seems to be able to protect us at this moment is reading (knowledge) and critical thinking. Think about what is hidden behind each piece of information you read on the internet…
