What are common cybersecurity misconceptions that Technical Support should know?

“I have 68.9 SLA’s with stakeholder teams, politely asked my users to update 5 times, and sent out a jazzy memo about phishing to all-company@email[.]com.” I’m an architect and engineer. My favorite parts of security are architecting and building between technologies. However, company security culture and security policy — which creates accountability — is the 🥊 heavyweight champion of all the ground work that architects, engineers and administrators put in, and of end user adherence to good, secure process.

In my experience I have found that the greatest dangers posed to Cybersecurity are solved by the Non-technical solutions. I have found from responding to several incidences that if most of technology users simply observe a good password hygiene, more than half of the incidences reported will be averted. The weakest links I found in Cybersecurity are mostly users who have no relationship with technical challenges

The term social engineering is used for a reason in cybersecurity. It has nothing to do with technology but can be the in road to a security hole. A hacker may only need to find out 3-5 social things about you to engineer a platform. They will use that personal/social information to get to your email, company software and building passwords, which then is not secure anymore. Once personal patterns are know, they are in.

One of the most common cybersecurity misconceptions is that it is only about technology, such as firewalls, antivirus software, encryption, and passwords. However, cybersecurity is also about people, processes, and policies. For example, human error, such as clicking on phishing links, using weak passwords, or sharing sensitive information, can compromise the security of a system.

All things cybersecurity begin and end with governance, Risk Management and compliance. Protecting systems and how that protection is administered is always a business decision. Monitoring CVEs and KEVs against industry threat actors will tend to guide cybersecurity business practices alongside other budgetary factors

Common cybersecurity misconception includes beliefs like antivirus software provides total protection, private browsing ensures full anonymity, or Mac and Linux systems are immune to malware. It's crucial to clarify these misunderstandings, emphasizing that cybersecurity is everyone's responsibility. Users should be educated on safe practices. Technical support should also stress the importance of data backups, regular software updates, and strong passwords, while dispelling the misconception that HTTPS guarantees a website's legitimacy. Furthermore, they should explain that firewalls provide network security but aren't foolproof. By addressing these misconceptions, technical support can help users enhance their online security.

Cybersecurity Audits, Testing and Plan reviews should be built in to your company's culture. Whether by an outside source or designated staff - your Cybersecurity plans, policy and procedures should be audited and update as needed. Boring but better than after a fail. Testing - for security holes by penetration testing or ethical hacking will prove the security plan you have in place. Including some staff education on persistent issues helps here as well, for continued awareness. Plan reviews - for procedures, reporting and mitigation in crisis are great ways to see where things may need to be tweaked or find broken links in the process also. Set aside the dedicated time and seal things up.

No matter what systems, policies, procedures, etc that your organization has in place… it doesn’t all fall in IT when they fail. Some of it does, but it all begins and ends with trusting and following the best practices your security team recommends and following your procedures with diligence. IT helps, but isn’t responsible for negligence beyond their own, if any.

I my experience, think this is the most common misconception in corporate organizations. Especially with non-tech users of technology. They simply don't want to bother about even the most basic safety procedures, these users put IT-support's number is on auto-dial. I have encountered many users who hand over their passwords and login detail to the IT-support guys believing they have the absolute responsibility for their safety. This simply is a demand for more Cybersecurity professionals in the area of governance, compliance, awareness and training.

In reality, cybersecurity is a collective effort that extends far beyond the confines of IT. Technical support plays a pivotal role in dispelling this myth by actively collaborating with various departments and teams. By breaking down silos and promoting a united front, technical support ensures that cybersecurity is integrated into the fabric of the entire organization. This involves aligning security objectives with broader business goals, fostering a culture of awareness, and instilling a sense of accountability at every level. Effective cybersecurity requires a shared commitment from all stakeholders, and technical support serves as a linchpin in facilitating this collaborative approach.

I saw an interesting statement in one of the security lessons and it is that there is no secure computer system, only defendable systems. If you view it through that lense it isn't hopeless to maintain a security posture, but it is a landscape where you do need to maintain vigilance.

In reality, cybersecurity is an achievable goal when approached with the right mindset and strategies. It's about understanding that perfect security might be elusive, but effective risk management and mitigation are entirely within reach. Technical support plays a crucial role in fostering a culture of optimism and proactiveness. By staying informed about the latest tools and practices, learning from past incidents, and adapting to the evolving threat landscape, technical support professionals can contribute significantly to building robust cybersecurity postures. The key lies in viewing cybersecurity as a dynamic process of continual improvement, where each step taken enhances the overall security resilience.

7-Misconception 7: Small businesses are not targeted by cyberattacks There is a misconception that small businesses are not attractive targets for cyberattacks because they may not have as much valuable data as larger enterprises. However, cybercriminals often target small businesses precisely because they may have weaker cybersecurity defenses. Technical support should emphasize to small business clients that they are not immune to cyber threats and should implement robust cybersecurity measures.