given the below information what could a security professional do to prevent this situation or use this information in a defense?
Security Experts vs. Non-Experts
If you needed brain surgery (hopefully you never will, but just work with me here), to whom would you turn? The average person on the street? Or a health care professional who has studied about human brains and has years of experience? The answer is obvious.
So what about computer security? What if you were to ask security experts about security and also ask non-experts? Would you get different answers about what to do in order to be safe? And how different would the answers be?
That’s exactly what three researchers did recently to compare the thinking of the average user against what security experts said. The results were very interesting.
First, do it yourself: Look at the list below and select the top five actions that you would take to protect yourself while online. Then rank those five selections in order from most important to least important:
-Be suspicious of everything
-Change passwords
-Check if HTTPS
-Delete cookies
-Do not share information
-Install software updates
-Use 2-factor authentication
-Use antivirus
-Use Linux
-Use password manager
-Use strong passwords
-Use unique passwords
-Verify software
-Visit only known websites
Got your list of the top five things that you would do? Now compare it with what security experts vs. non-experts said:
EXPERTS
1. Install software updates
2. Use unique passwords
3. Use 2-factor authentication
4. Use strong passwords
5. Use password manager
NON-EXPERTS
1. Use antivirus
2. Use strong passwords
3. Change passwords
4. Visit only known website
5. Do not share information
These lists are obviously very different. Only one item–“Use strong passwords”–appears on both lists. The thinking of non-experts compared to security experts shows that the average user is still confused about how to stay secure.
Consider the first item on the list of each group. For non-experts 42 percent said that the most important step to take was to use antivirus (AV) software, while only 7 percent of security experts listed that among the top three steps that they take. Why are so many non-experts fixated on AV? The authors of the paper suggested that AV offers a convenient install-and-forget type of solution that users can do and then don’t have to think about it anymore. There certainly is truth in that. I think that most average users consider all attacks as “viruses” so “antivirus” repels all attacks, which of course is false. I also think that average users often have heard or read news media security advice that continues to advocate installing AV for maximum protection. Of course, AV does not offer comprehensive protection since viruses are only one small part of attacks today: worms, Trojans, spyware, ransomware, and many other types of malware all are different types of attacks and thus require different protections. And even if AV could offer comprehensive protection the AV vendors cannot keep up with the sheer number of new attacks. One antivirus software security institute receives more than 390,000 submissions of potential malware each day. At this rate the antivirus vendors would have to create and distribute updates every few seconds to keep users fully protected.
Now consider the first item on the list of the security experts: they said that installing software updates or patches was the most important step to take, with 35 percent of the experts listing that as Number #1. But only 2 percent of non-experts listed patching as the most important step. In fact, of all the steps patching had the highest percentage difference between experts and non-experts. Obviously non-experts lack an awareness on how effective updates are.
