Today, more people are aware of cybersecurity and how to protect their digital assets than ever before. However, despite this increase in awareness, the rate of cyberattacks continues to rise year over year. For example, there was a 72% increase in data breaches in 2023 compared to 2021. A significant number of these attacks can be attributed to ignorance and the many myths people have about cybersecurity.
Before delving into the world of cybersecurity, I held several misconceptions about online security that I believed to be facts. However, as I gained more knowledge in this field, I realized how much misinformation exists about cybersecurity and online security. In today’s article, we will explore 10 popular cybersecurity myths.
1. Only Certain People in the Organizations are Targets
While it’s true that high-profile individuals like CEOs and CFOs in organizations are often targeted, cyber-attacks are not limited to these people only. Most cyber-attacks are actually directed at low-profile individuals too through methods like phishing, spoofing, and identity theft.
These attacks are easier for hackers to execute on low-profile individuals since security measures are often less stringent compared to the top members of the organization. So, everyone, regardless of their status in the organization can be a target for cyber-attacks. That’s why all employees and other stakeholders in the organization must be equipped with knowledge of how to protect themselves and the organization from various kinds of attacks.
2. Phishing Emails are Always Obvious; You’ll Know Them When You See Them
This used to be the case in the early days of the internet. Most of these phishing emails used to have wrong grammar and were not as personalized, making it easier for anyone to identify and ignore them. However, phishing attacks have become increasingly sophisticated since attackers now have access to more sophisticated AI tools like ChatGPT. This makes it easier for them to craft grammatically correct and personalized emails that can be hard to distinguish from real ones.
Cybercriminals can also replicate company logos, email addresses, and other visual elements to make their messages appear legitimate. They can even use information from your contacts or social networks to make their attempts more personalized and convincing. As a result, phishing links are often cleverly embedded within messages that look genuine, making it harder to spot the deception.
3. Multifactor Authentication is Sufficient for Identity Management
While MFA adds an extra layer of security, it is not foolproof. Determined attackers can still bypass these measures through social engineering tactics, such as tricking employees into revealing their credentials. For instance, when using SMS codes for MFA, attackers could trick their victims into revealing the code sent to them. It is important to remember that messages sent via SMS are also not encrypted, making them susceptible to man-in-the-middle attacks.
That is why it is crucial to use more secure MFA methods such as passkeys and authenticator apps like Microsoft Authenticator. Organizations also need to go beyond MFA by implementing continuous testing practices to detect and mitigate social engineering attacks. Employee training is also crucial as it gives everyone that common knowledge, they need to safeguard their online accounts.
4. Any Data That’s Been Deleted Cannot Be Accessed by Hackers
Deleting data does not guarantee its complete removal. Most operating systems store files in the recycle bin (for Windows) or trash can (for macOS and Linux) before permanently deleting them. But even when files are deleted from the recycle bin, cyber attackers can use file restoration programs to recover deleted them if they gain remote access to the computer or drive with these files.
Similarly, files stored in the cloud are often not permanently deleted immediately. Many cloud services retain deleted files for a period (often 30 days or more), during which time they can still be accessed. Therefore, deleted data remains vulnerable unless proper measures are taken to ensure its permanent removal.
5. Apple Mac Computers are Invulnerable to Malware
This is a common myth, especially among Apple fanboys. While Mac operating systems are known for their robust security and privacy features, they are not immune to malware. Malware encompasses a variety of malicious software, including viruses, adware, ransomware, and more. Macs have been targeted by specific types of malware that exploit vulnerabilities unique to their system.
Indeed, Craig Federighi, Apple’s senior vice president of software engineering, has acknowledged that the prevalence of malware on Macs falls short of the company’s standards. This admission serves as compelling evidence for anyone who doubted the vulnerability of Macs to malware attacks. To stay safe from malware, Mac users need to employ security measures like antivirus software, maintain up-to-date systems, and exercise safe browsing habits, just as users of other operating systems do.
6. Security Tools Alone Are Enough to Keep Cyberattacks Out
Relying solely on technology for cybersecurity is a significant mistake. While tools like firewalls and Intrusion Detections Systems (IDS) are essential components of a security strategy, they must be part of a broader approach that includes people, processes, training, and multiple layers of defense.
Cybersecurity frameworks, such as those from the National Institute of Standards and Technology (NIST), recommend a holistic approach and not only relying on technology tools. That is why it is crucial to regularly test the effectiveness of security controls, do ongoing training for employees, and establish comprehensive defense mechanisms.
7. Cybersecurity is IT’s Responsibility Alone
Over the years, many people have believed that the responsibility to protect the digital assets of an organization is only for the IT and cybersecurity teams. However, cybersecurity must be a shared responsibility across the entire organization, including all employees and vendors. Many cyber-attacks stem from routine oversights, such as opening suspicious email attachments, clicking on untrusted links, or responding to malicious messages.
To prevent these common attacks, every employee and other stakeholders of the organization must be involved in cybersecurity efforts. Mandatory cybersecurity training should be provided to all company stakeholders (mainly employees) to help them recognize, evaluate, and report suspicious activities. This training doesn’t need to be very technical but should raise awareness of cybersecurity threats and the best practices for dealing with common attacks.
8. Cyberattacks Are an External Threat
While media coverage often highlights attacks by external criminal gangs, there is a significant percentage of attacks that are actually inside jobs. One of the studies done by IBM showed that 60% of cyberattacks are an inside job. For instance, disgruntled employees who are trusted within organizations and familiar with internal systems and processes can misuse this knowledge to bypass security measures.
Mitigating insider threats is challenging because overly intrusive surveillance or a lack of trust can harm the organization just as much as an actual cyberattack. Therefore, organizations must balance trust and security, implementing policies that monitor for insider threats without creating a hostile work environment. This includes implementing the principle of least privilege to give users only the access they do to do their job.
9. Cybersecurity Should Be a Concern for Large Organizations Only
This misconception suggests that cybercriminals only target big businesses, leaving smaller entities safe. In reality, cybercriminals seek vulnerabilities regardless of the business size. In fact, small businesses are often more appealing targets because they typically lack the sophisticated security measures of larger enterprises. A recent report by the Identity Theft Resource Center shows that over 73% of small business owners reported at least one cyberattack in 2023.
If you read our Hack Round-Up for April, you will realize that a significant number of attacks targeted small businesses. This clearly shows that cybersecurity is crucial for businesses of all sizes, as no organization is immune to cyber threats. Small businesses should recognize the importance of implementing robust cybersecurity measures to protect against potential attacks, ensuring they are not seen as easy targets by cybercriminals.
10. Antivirus Software is Adequate Protection
While antivirus software is essential for detecting and eliminating harmful software, it is not a comprehensive solution for all cybersecurity threats. Cyberattacks are becoming increasingly sophisticated, often employing methods that can bypass traditional antivirus programs. To effectively protect against modern threats, organizations need a multi-layered approach that includes several tools.
Some of these tools include includes Intrusion Detection Systems, Endpoint Detection and Response, Network Detection and Response, Next-Generation Firewalls, and many more. They should also implement other security best practices such as encryption of sensitive data, multi-factor authentication, continuous employee training, and more.
Final Thoughts
Cybersecurity is a dynamic and complex field, where new knowledge and insights emerge every day. This constant evolution presents opportunities to learn and grow, as well as to unlearn and dispel long-held misconceptions. By recognizing and debunking the ten popular myths covered in this article, you can develop a more accurate understanding of the cyber threat landscape and take proactive measures to safeguard yourself and your organization. Here are some of the key takeaways from this article:
- Everyone is a target
- Be skeptical of every email you receive
- MFA is a must, but not foolproof
- Deleted data isn’t always gone forever
- No Operating System is invincible, including Macs
- Layered defenses are key
- Cybersecurity is a shared responsibility and not only IT’s role
- Beware of insider threats
- All businesses are at risk, including small and large organizations
- Move beyond relying on only a basic antivirus to using several security tools
