Your PC is infected, but is it your fault?

[Andy Ful]

What we call a paranoia for home users, becomes the standard precaution for Enterprises. For example, when we have 1000 computers (one for each employee) connected to Enterprise network, the probability of Wannacry like infection can be, in the worse scenario, 1000*999 times greater than in the case of one home user.

Edit1.
Even more that 1000*999, because of the possibility of targeted attacks.

Edit2.
Even more, when home user is security paranoid one (because other people are not).

 

[509322]

What we call a paranoia for home users, becomes the standard precaution for Enterprises.

Precaution level at Enterprises is all over the place, just like with individual users. The level of "paranoia" (precaution using best practices) is directly tied to $$$ and to a greater extent the person responsible for security and their staff. You would sometimes be mortified by what you see in the field.

Ask @Umbra about his experiences with small-medium businesses.

 

[509322]

Edit1.
Even more that 1000*999, because of the possibility of targeted attacks.

Edit2.
Even more, when home user is security paranoid one (because other people are not).

1. Persistent targeted attack is very difficult to defend against

2. Success of such an attack increases significantly when the number of systems increases - even with security softs installed and adherence to best practices

3. Patient persistence will always win - eventually - because sooner or later the defender will make a mistake

 

[Andy Ful]

...
Ask @Umbra about his experiences with small-medium businesses.
...

And Umbra could ask me, about my experiences with highly confidential data in Government institution. But sadly, I could not answer.

 

[BoraMurdar]

confidential data in Government institution

Spoiler

 

[509322]

Let's make super pen-testing project.

Everybody bring their best security config and let an army of pen-testers hack away. Give the hacker army 30 days to bork your system.

Surprise ! - every single security config ultimately fails and the system is badly compromised. Some security configs will protect the system longer than others - but all will ultimately fail.

It's still your fault. Read the EULA.

Did you know that if your system is hacked, and the hacker uses your hacked system to commit a crime, because it is your system you can be held criminally responsible as well in many countries ?

Spoiler

Looooooooool, Awesome !

And Umbra could ask me, about my experiences with highly confidential data in Government institution. But sadly, I could not answer.

There is witch somewhere online that, for a price, will conduct on-site blessing, light a black candle or two, read spells from a big crusty book, sprinkle ground-up bat wings and rat tails around the systems -- all with a 100 % guarantee "You are protected !"

Afterwards, the government agents would have to shoot her cuz she has seen the goods.

This one here - against my better judgment - I'd get her phone number and let her go...

 

[Andy Ful]

Let's make super pen-testing project.
...
Give the hacker army 30 days to bork your system.
...

You underestimate hackers. Most systems will be hacked after one day.
But fortunately, hackers are not interested to hack you (if you are a home user).

There is witch somewhere online that, for a price, will conduct on-site blessing, read spells from a big book, sprinkle ground-up bat wings and rat tails around the systems -- all with a 100 % guarantee "You are protected !"

Afterwards, the government agents would have to shoot her cuz she has seen the goods.

This one here - against my better judgment - I'd get her phone number and let her go...

View attachment 158614

Many Government institutions can be hacked easily, not due to holes in the security software, but simply due to careless and security uneducated employees.

Edit.
Phishing and Social Engineering Cause Over Half of Cyber Incidents

 

[509322]

You underestimate hackers. Most systems will be hacked after one day.
But fortunately, hackers are not interested to hack you (if you are a home user).

Just threw a number out there, but you are correct.

The threat landscape is never as bad as it seems from IT security reports, but at the same time security configs are never as good as their users think

careless and security uneducated employees.

They'll kill us all...

WARNING ! = "Don't push the red button !"

"Oh man... what'd he\she just do ?"

"Pushed the red button..."

 

[212eta]

Do you think that malware infection is mostly "your fault"?

Most of the time, it is the user's fault.

 

[Duotone]

Hard to resist not to push that red button...

 

[509322]

Hard to resist not to push that red button...

Let's push it. See what happens...

Upon pushing red button, computer says: "You have 18 minutes to live."

I would bet if someone made a software that monitored the system and it would talk back to users when they attempted to do things that they should not, then security would be much better.

 

[cruelsister]

You guys are really being too hard on yourselves! Aside from ransomware I think you will agree that the harvesting of financial info (like credit card data) is an important issue. And although you may have a "Lockdown" security solution on your personal machine that will totally protect you from such breaches, are you safe?

Absolutely not! And no fault on your part at all. As an example:

You shopped at the major retailer Home Depot a few years back and paid for your purchase with a credit card, Some time passed and all of a sudden you find charges on your card for Emerald Bracelets. Your fault? No- turns out that among the numerous stupidities Home Depot was using SEP and didn't have the Network Threat Protection box checked. Home Depot's IT folks fault? No- the system was set up by Symantec Engineers with the HD IT people nodding like a bobble head dogs on the dashboard of your car ("We didn't want to implement that as it would have generated too many data points that would have been confusing..."). If only the IT folk would have used any of their 60 IQ the whole thing could have been prevented. And I won't even get into the fact that as Enterprise solutions can't distinguish good scripts from bad they don't bother with them at all.

Oh God! I normally have a point to my posts instead of a stream of consciousness ramble.

Note to self- never post when waking up hungover...

 

[ispx]

Aside from ransomware I think you will agree that the harvesting of financial info (like credit card data) is an important issue

i do agree, completely agree which is why i personally feel the need for zal more than zam on my computer.

 

[BoraMurdar]

The thread was about the measures that end-user can control. It's pointless to discuss things that are out of our reach.

Do you think that malware infection is mostly "your fault"?

 

[Andy Ful]

You guys are really being too hard on yourselves! Aside from ransomware I think you will agree that the harvesting of financial info (like credit card data) is an important issue. And although you may have a "Lockdown" security solution on your personal machine that will totally protect you from such breaches, are you safe?

Absolutely not! And no fault on your part at all. As an example:

You shopped at the major retailer Home Depot a few years back and paid for your purchase with a credit card, Some time passed and all of a sudden you find charges on your card for Emerald Bracelets. Your fault? No- turns out that among the numerous stupidities Home Depot was using SEP and didn't have the Network Threat Protection box checked. Home Depot's IT folks fault? No- the system was set up by Symantec Engineers with the HD IT people nodding like a bobble head dogs on the dashboard of your car ("We didn't want to implement that as it would have generated too many data points that would have been confusing..."). If only the IT folk would have used any of their 60 IQ the whole thing could have been prevented. And I won't even get into the fact that as Enterprise solutions can't distinguish good scripts from bad they don't bother with them at all.

Oh God! I normally have a point to my posts instead of a stream of consciousness ramble.

Note to self- never post when waking up hungover...

That is a good example of shared security issue (home users & Enterprises). It shows how Enterprises can be careless about customers' data. But, paranoid home users like us, can make some precautions:
1. Do not use a debit card when shopping online.
2. Use something like PayPal.
3. Use a virtual credit card which is fed only with the concrete sum required to buy a concrete product.

Edit1.
I must admit, that my wife is not paranoid about it.

Edit2.
Medicare card details of every Australian up for sale on the dark web

 

[mekelek]

imo it's your fault if you don't even attempt to protect yourself and act stupid.
it's not your fault from the point when you actually try to protect yourself, the Universe is out to get you at that point.

 

[Andy Ful]

My brother still uses an old laptop with Windows XP + ESET for browsing, banking and shopping. I tried to convince him that this is a stupid thing. He ignored my advice, and is still uninfected.

Edit.
He says, that the hacker has to be very lucky to find anything on his bank account. So, maybe he was hacked, and disappointed the hacker?

 

[roger_m]

On my own computers, every time I've been infected, it's been because I've opened an infected file. So it's been my fault. If I had been more careful about what I'd opened, my computers would not have been infected. These days, I take more care, and don't get infected. I don't do anything more to secure my computers, I'm just more careful.

I have been infected twice on a work computer, just by browsing websites, without opening any downloads. However this computer did not have the latest updates on it. For example Flash and Java were outdated. I didn't have admin access, and without that was unable to update them. In this instance, I would say it's not my fault. On my own computers I keep any vulnerable software updated, and can't recall ever being infected by an exploit.

 

[Andytay70]

I think there should be basic (compulsary) training on how to use a PC correctly.