Tag Archive for: confusing

London internet attack highlights confusing hacktivism movement

/in


Moreover, according to Professor Stuart Masnick of MIT, DDoS and other types of attacks used in hacktivism (most notably wiper attacks, where compromised systems are simply cleansed of all their data) are a “blunt weapon.” They are often hard to track even with access to technical details about a given attack. “If you launch a missile, with the technologies and satellites we have today, we can pretty well tell where the missile was launched from,” said Masnick. “If you launch a cyberattack, if you do a little bit of homework … no one knows where it came from.”

In one case, Masnick recalled, a Russian cyber group compromised an Iranian facility and launched a cyberattack from there, meaning that the evidence pointed back to the Iranian government, not Russia. “If you think you know who the attack came from, most likely you’re wrong,” he said. “Because a really good attacker will leave all the evidence pointing in a different direction.”

For the rank-and-file of businesses, staying secure means understanding their risk levels and maintaining a defense-in-depth. “Because hacktivism has its roots in not just protecting yourself from a [cybersecurity] perspective, but from a geopolitical perspective as well, the first thing just to be aware that someone is upset at you,” said Dickson, noting that larger organizations, and those more intimately involved with national infrastructure, are more likely targets.

Defense in depth key to limiting damage from hacktivism attacks

Masnick said that many of the most damaging cyberattacks in recent years have been as severe as they were because of poor security architecture and misconfiguration – not necessarily due to the skill of the attackers. Defense in depth, ensuring that all systems are hardened against attack, is key to limiting the damage from one system being compromised.

“We’ve done a number of studies of relatively sizeable cyberattacks,” he said. “And the thing we found is that … in most cases, there’s over a dozen things wrong,” not just one or two.

Source…

Why Is Computer Security Advice So Confusing?

/in


Laptop Cybersecurity

A recent study identifies issues with current computer security guidelines, suggesting they are often confusing and overwhelming for employees. Researchers recommend a more curated approach, emphasizing key messages and prioritizing vital information to enhance computer security understanding and implementation.

If you’ve ever felt baffled by the computer security instructions provided at your workplace, you’re not alone. A recent study underscores a fundamental issue in the crafting of these guidelines and suggests straightforward measures to enhance them – likely leading to better computer safety.

The concern revolves around the computer security protocols given by institutions, including businesses and government bodies, to their staff. These protocols aim to guide employees in safeguarding both personal and organizational data against dangers like malware and phishing attacks.

“As a computer security researcher, I’ve noticed that some of the computer security advice I read online is confusing, misleading, or just plain wrong,” says Brad Reaves, corresponding author of the new study and an assistant professor of computer science at North Carolina State University. “In some cases, I don’t know where the advice is coming from or what it’s based on. That was the impetus for this research. Who’s writing these guidelines? What are they basing their advice on? What’s their process? Is there any way we could do better?”

For the study, researchers conducted 21 in-depth interviews with professionals who are responsible for writing computer security guidelines for organizations including large corporations, universities, and government agencies.

“The key takeaway here is that the people writing these guidelines try to give as much information as possible,” Reaves says. “That’s great, in theory. But the writers don’t prioritize the advice that’s most important. Or, more specifically, they don’t deprioritize the points that are significantly less important. And because there is so much security advice to include, the guidelines can be overwhelming – and the most important points get lost in the shuffle.”

The researchers found that one reason security…

Source…

Why computer security advice is more confusing than it should be

/in


security
Credit: Unsplash/CC0 Public Domain

If you find the computer security guidelines you get at work confusing and not very useful, you’re not alone. A new study highlights a key problem with how these guidelines are created, and outlines simple steps that would improve them—and probably make your computer safer.

At issue are the computer security guidelines that organizations like businesses and government agencies provide their employees. These guidelines are generally designed to help employees protect personal and employer data and minimize risks associated with threats such as malware and phishing scams.

“As a computer security researcher, I’ve noticed that some of the computer security advice I read online is confusing, misleading or just plain wrong,” says Brad Reaves, corresponding author of the new study and an assistant professor of computer science at North Carolina State University. “In some cases, I don’t know where the advice is coming from or what it’s based on. That was the impetus for this research. Who’s writing these guidelines? What are they basing their advice on? What’s their process? Is there any way we could do better?”

For the study, researchers conducted 21 in-depth interviews with professionals who are responsible for writing computer security guidelines for organizations including large corporations, universities and government agencies.

“The key takeaway here is that the people writing these guidelines try to give as much information as possible,” Reaves says. “That’s great, in theory. But the writers don’t prioritize the advice that’s most important. Or, more specifically, they don’t deprioritize the points that are significantly less important. And because there is so much security advice to include, the guidelines can be overwhelming—and the most important points get lost in the shuffle.”

The researchers found that one reason security guidelines can be so overwhelming is that guideline writers tend to incorporate every possible item from a wide variety of…

Source…

Why computer security advice is more confusing than it should be — ScienceDaily

/in


If you find the computer security guidelines you get at work confusing and not very useful, you’re not alone. A new study highlights a key problem with how these guidelines are created, and outlines simple steps that would improve them — and probably make your computer safer.

At issue are the computer security guidelines that organizations like businesses and government agencies provide their employees. These guidelines are generally designed to help employees protect personal and employer data and minimize risks associated with threats such as malware and phishing scams.

“As a computer security researcher, I’ve noticed that some of the computer security advice I read online is confusing, misleading or just plain wrong,” says Brad Reaves, corresponding author of the new study and an assistant professor of computer science at North Carolina State University. “In some cases, I don’t know where the advice is coming from or what it’s based on. That was the impetus for this research. Who’s writing these guidelines? What are they basing their advice on? What’s their process? Is there any way we could do better?”

For the study, researchers conducted 21 in-depth interviews with professionals who are responsible for writing computer security guidelines for organizations including large corporations, universities and government agencies.

“The key takeaway here is that the people writing these guidelines try to give as much information as possible,” Reaves says. “That’s great, in theory. But the writers don’t prioritize the advice that’s most important. Or, more specifically, they don’t deprioritize the points that are significantly less important. And because there is so much security advice to include, the guidelines can be overwhelming — and the most important points get lost in the shuffle.”

The researchers found that one reason security guidelines can be so overwhelming is that guideline writers tend to incorporate every possible item from a wide variety of authoritative sources.

“In other words, the guideline writers are compiling security information, rather than curating security information for their readers,” Reaves says.

Drawing on what they learned…

Source…