One Reason Why InfoSec Sucked In The Past 20 Years - The "Security Tips" Myth

From time to time, I get disappointed how much effort and money is put into securing computers, networks, mobile phones, ... and yet in 2016 here we are, where not much has changed on the defensive side. There are many things I personally blame for this situation, and one of them is the security tips.

The goal of these security tips is that if the average user follows these easy to remember rules, their computer will be safe. Unfortunately, by the time people integrate these rules into their daily life, these rules either become outdated, or these rules were so oversimplified that it was never true in the first place. Some of these security tips might sound ridiculous to people in InfoSec nowadays, but this is exactly what people still remember because we told them so for years.

PDF is safe to open

This is an oldie. I think this started at the time of macro viruses. Still, people think opening a PDF from an untrusted source is safer than opening a Word file. For details why this is not true, check: https://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-497/Adobe-Acrobat-Reader.html

On an unrelated note, people still believe PDF is integrity protected because the content cannot be changed (compared to a Word document).

Image stolen from Kaspersky

Java is secure

One of the best ones. Oracle started marketing Java as a safe language, where buffer overflows, format strings and pointer-based vulnerabilities are gone. Unfortunately, they forgot to tell the world that instead of "unsafe programs developed by others" they installed their unsafe program on 3 billion devices. 

Stay away from rogue websites and you will be safe

This is a very common belief I hear from average people. "I only visit some trusted news sites and social media, I never visit those shady sites." I have some bad news. At the time of malvertising and infected websites, you don't have to visit those shady sites anymore to get infected.

Don't use open WiFi

I have a very long explanation of why this makes no sense, see here. Actually, the whole recommendation makes no sense as people will connect to public WiFis, no matter what we (InfoSec) recommend.

The password policy nightmare

Actually, this topic has been covered by myself in two blog posts, see here and here. Long story short: use a password manager and 2-factor authentication wherever possible. Let the password manager choose the password for you. And last but not least, corporate password policy sux.

Sites with a padlock are safe

We tell people for years that the communication with HTTPS sites are safe, and you can be sure it is HTTPS by finding a randomly changing padlock icon somewhere next to the URL. What people hear is that sites with padlocks are safe. Whatever that means. The same goes for WiFi - a network with a padlock is safe.

Use Linux, it is free from malware

For years people told to Windows users that only if they would use Linux they won't have so much malware. Thanks to Android, now everyone in the world can enjoy malware on his/her Linux machine.

OSX is free from malware

It is true that there is significantly less malware on OSX than on Windows, but this is an "economical" question rather than a "security" one. The more people use OSX, the better target it will become. Some people even believe they are safe from phishing because they are using a Mac!

Updated AV + firewall makes me 100% safe

There is no such thing as 100% safe, and unfortunately, nowadays most malware is written for PROFIT, which means it can bypass these basic protections for days (or weeks, months, years). The more proactive protection is built into the product, the better!

How to backup data

Although this is one of the most important security tips which is not followed by people, my problem here is not the backup data advise, but how we as a community failed to provide easy to use ways to do that. Now that crypto-ransomware is a real threat to every Windows (and some OSX) users, even those people who have backups on their NAS can find their backups lost. The only hope is that at least OSX has Time Machine which is not targeted yet, and the only backup solution which really works.

The worst part is that we even created NAS devices which can be infected via worms ...

Disconnect your computer from the Internet when not used

There is no need to comment on this. Whoever recommends things like that, clearly has a problem.

Use (free) VPN to protect your anonimity

First of all. There is no such thing as free service. If it is free, you are the service. On another hand, a non-free VPN can introduce new vulnerablities, and they won't protect your anonymity. It replaces one ISP with another (your VPN provider). Even TOR cannot guarantee anonymity by itself, and VPNs are much worse.

The corporate "security tips" myth

"Luckily" these toxic security tips have infected the enterprise environment as well, not just the home users.

Use robots.txt to hide secret information on public websites

It is 2016 and somehow web developers still believe in this nonsense. And this is why this is usually the first to check on a website for penetration testers or attackers.

My password policy is safer than ever

As previously discussed, passwords are bad. Very bad. And they will stick with us for decades ...

Use WAF, IDS, IPS, Nextgen APT detection hibber-gibber and you will be safe

Companies should invest more in people and less into magic blinking devices.

Instead of shipping computers with bloatware, ship computers with exploit protection software

Teach people how to use a password safe

Teach people how to use 2FA

Teach people how to use common-sense

Conclusion

Computer security is complex, hard and the risks change every year. Is this our fault? Probably. But these kinds of security tips won't help us save the world. 

Related links

1. Pentest Tools Download
2. Best Hacking Tools 2020
3. Pentest Box Tools Download
4. Pentest Automation Tools
5. Kik Hack Tools
6. Hacker Tools Hardware
7. Hack Website Online Tool
8. Android Hack Tools Github
9. Hacker Tools 2019
10. Pentest Tools Subdomain
11. Hack Website Online Tool
12. Hacker Tools Apk
13. Hacker Tool Kit
14. Hacker Hardware Tools
15. Hacker Tool Kit
16. Pentest Tools Port Scanner
17. Hacking Tools Github
18. Physical Pentest Tools
19. Hack Tools Mac
20. Top Pentest Tools
21. Tools 4 Hack
22. Hacking Tools And Software
23. Hacker Tool Kit
24. Ethical Hacker Tools
25. Hacking Tools Kit
26. Hacker Tools List
27. Hacking Tools 2020
28. Hack Website Online Tool
29. Hacker
30. Hack Tools 2019
31. Hack Tools Pc
32. Hacker
33. Hacker Tools 2019
34. Hacker Tools 2020
35. Hacking Tools Mac
36. Hack Tools 2019
37. Pentest Tools Framework
38. Hack Rom Tools
39. Hack Tools For Mac
40. Hacking Tools For Games
41. Hack Tools For Windows
42. Pentest Tools For Windows
43. Best Hacking Tools 2019
44. Hacking Tools For Mac
45. Hack And Tools
46. Hacking Tools
47. Hacker Tools List
48. Pentest Tools Subdomain
49. Hacker Tools Mac
50. Pentest Tools Free
51. Hacking Tools 2019
52. Best Hacking Tools 2020
53. Hacker Search Tools
54. Hacking Tools Hardware
55. Android Hack Tools Github
56. Pentest Tools Website
57. Hacking Tools For Games
58. Hacking Tools Pc
59. Hacker Tools Linux
60. Hacking Tools Free Download
61. Hacking Tools For Windows
62. How To Make Hacking Tools
63. Best Hacking Tools 2020
64. Hack Tools For Windows
65. Hack Tools Mac
66. Hacker Tools Apk
67. Easy Hack Tools
68. Pentest Tools Kali Linux
69. Nsa Hacker Tools
70. Hacker Search Tools
71. Hacker Tools For Mac
72. Hacking Tools 2019
73. Pentest Reporting Tools
74. Pentest Tools Download
75. Tools 4 Hack
76. Hacker Tools Software
77. Hacking Tools Github
78. Hacking Tools For Beginners
79. Pentest Tools Bluekeep
80. Hacking Tools Pc
81. Hacking Tools 2020
82. Pentest Tools Windows
83. Hack Tool Apk
84. Hacking Tools Pc
85. Hacker Tools Windows
86. Pentest Tools Free
87. Pentest Tools Find Subdomains
88. Hacking Tools Name
89. Hack Tools Download
90. Pentest Recon Tools
91. Hack And Tools
92. Hack Rom Tools
93. Pentest Tools
94. Hacker Tools Apk
95. Best Hacking Tools 2019
96. Pentest Tools Website Vulnerability
97. Hacking Tools Windows 10
98. Hacker Tools Free
99. Pentest Tools For Mac
100. Pentest Tools Bluekeep
101. Free Pentest Tools For Windows
102. Hacking Tools For Windows
103. Hacker Tools
104. Hacking Tools Software
105. Tools For Hacker
106. Pentest Tools Tcp Port Scanner
107. Hacking Tools For Kali Linux
108. Pentest Tools List
109. Hack Tools
110. Hack Tools Online
111. Ethical Hacker Tools
112. Pentest Tools Windows
113. Free Pentest Tools For Windows
114. Tools For Hacker
115. Kik Hack Tools
116. Hacker
117. Tools Used For Hacking
118. How To Hack
119. Hacker Security Tools
120. Hacker Tools For Pc
121. Hacker Tool Kit
122. Pentest Tools Website Vulnerability
123. Hack Tool Apk No Root
124. Hacker Tools For Windows
125. Nsa Hack Tools Download
126. Hacker
127. Pentest Tools Subdomain