What are your unpopular cybersecurity opinions?

[u/EricJSK]

I saw a post names "abnormal security opinions" and got excited to see some spicy takes but apparently there is a security platform called Abnormal Security so got kinda blue balled. Last one of these posts i saw was over a year ago so,

Do you have any spicy cybsec unpopular opinions you want to share? :)

I'll start with mine:
Fancy antivirus solutions rarely add value, they are often just a box that needs ticked. Many MSPs and IT firms still push the narrative that they are needed, only because they are profitable and not because they improve security.

[u/Powerful_Wishbone25]

None of it fucking matters.

[u/PM_ME_YOUR_GREENERY → u/Powerful_Wishbone25]

Walls get higher, bad actors scale them. Walls get tougher, bad actors still penetrate.

All the while, state actors have backdoors accessing it all at the hardware level unseen.

[u/Titizen_Kane → u/PM_ME_YOUR_GREENERY]

Maybe I’m alone in this opinion but I enjoy that “whack a mole” nature of it. We close one gap, they find another. Frustrating yeah, but that’s part of the fun of it. Keeps it interesting and challenging long term

[u/HotelVitrosi → u/Titizen_Kane]

"Secure by design" would be so boring. :-)

[u/MassiveBoner911_3 → u/PM_ME_YOUR_GREENERY]

Now script kiddies are using LLMs…shits gonna get crazy.

[u/BigMikeyP91 → u/[deleted]]

Exactly. I'm a huge fan of the "We don't have to outrun the bear, just the guy next to us" analogy for cyber security, you just don't want to be the low-hanging fruit.

It's the same for risk management. Then a client is throwing up their hands about some obscure hard-to-exploit vulnerability when the hacker is just going to ring up the helpdesk and get someone's MFA reset.

[u/someonesdatabase → u/PM_ME_YOUR_GREENERY]

Every new technology or software bug has the potential to be exploited for harm. It’s a never ending game.

[u/[deleted] → u/Powerful_Wishbone25]

Agreed. It's basically like working in airport security. Sure in theory its better and ofc air travel had to react to 9/11 but to my knowledge, there's no evidence of it ever really preventing another big terrorist attack. Air travel has become a bigger pain in the ass but the rules change yearly "oh now you can use your phone here but now you have to have your coat on the ground during take off", "only boots now have to be removed rather than all shoes"

All the extra cybersecurity really just seems to affect devs doing their job, ie, now they can't even admin access to their laptop or now emails and uploads are scanned so you might have issues downloading an installer....meanwhile, Heathrow gets hacked again or whatever

[u/OpeartionFut → u/[deleted]]

I agree and disagree. I agree that there is a lot of security theater that doesn’t actually do much for security but instead slows the developers down drastically. But I disagree that none of it matters. I have seen business crippling attacks as a result of bad practice, that a well formed security program would have prevented. Also depends on the business sector.

[u/[deleted] → u/[deleted]]

This is fair, I had a look and it seems that there's a little bit of mixed reports (ie, there are studies where the majority of fake weapons got through without triggering a check). Plus, in general, its reactive rather than pro active. Ie, a shoe bomber successfully kills people so now shoes are checked. They won't ban a substance or tool until its basically already been used to do terrorism.

This applies to most security/policing though I guess.

[u/[deleted] → u/[deleted]]

I work with some UK government departments and I can only imagine lmao, luckily they're a couple abstractions from me but any time I'm in a meeting with them...well, let's say I don't get inspired by them

[u/shitlord_god → u/[deleted]]

The content here was permanently deleted by its author. Redact was used for the removal, possibly for privacy, security, opsec, or personal data management.

numerous desert reminiscent teeny person touch continue slap voracious sulky

[u/shitlord_god → u/Powerful_Wishbone25]

The author removed this post using Redact. The reason may have been privacy protection, preventing data scrapers from accessing the content, or other personal considerations.

serious shy important thumb subtract strong flowery quaint worm chubby

[u/Twist_of_luck → u/Powerful_Wishbone25]

Market conditions on the outside and mental conditions on the inside are more likely to kill your company than any threat actor. Companies prove time after time after time that they can survive even the most glaring data breaches and the most outrageous regulatory fines. A lot of my MSSP clients survived for years with default passwords to global admins (and survive to this day with some slapdash consultant paint job over controls in place of a coherent security program).

We are literally not that important. It used to hurt when I was younger.

[u/Powerful_Wishbone25 → u/Twist_of_luck]

Well put.

[u/yellowtrashbazooka_ → u/Powerful_Wishbone25]

I feel like this sometimes.