Advisory dispels myths threatening organisational security

Companies must confront cybersecurity myths that endanger their data, regardless of their size or industry.

A statement from IDS-INDATA, a firm specialising in digital and data solutions, highlights prevalent misconceptions in cybersecurity that leave organisations vulnerable to threats. According to Ryan Cooke, Chief Information Security Officer at IDS-INDATA, these myths create significant risks: "Many businesses think their data is too insignificant to be targeted or that meeting compliance requirements alone means they are secure. These misconceptions present a considerable risk. Cyberattacks are on the rise and are generally not targeted, so it is vital to understand that every organisation across every industry is at risk."

The press release identifies several myths, including the belief that data perceived as insignificant is of no interest to cybercriminals. IDS-INDATA emphasises that all data can be valuable, whether it consists of customer records, financial information, or intellectual property. Moreover, it stresses the growing need to secure both Information Technology (IT) and Operational Technology (OT) systems, as the latter often control critical infrastructure and are becoming targets for digital attacks.

A common misconception is that compliance with data protection regulations equates to comprehensive security. Nevertheless, regulations often lag behind emerging cyber threats, requiring organisations to undertake continuous risk assessments to remain protected.

Another myth dispelled by the company is that cyberattacks are rare and will not impact them. In reality, such attacks are increasingly frequent, targeting businesses of various sizes. This highlights the necessity for companies to maintain a proactive approach to cybersecurity.

Human factors also play a critical role. IDS-INDATA points out the persistent assumption that employees inherently know best practices for data security. "Human error is one of the most common causes of data breaches. Employees need ongoing training and awareness programs to identify and respond to threats like phishing or social engineering," asserts the release.

The belief that having a firewall suffices in safeguarding against sophisticated cyber threats is also challenged. The firm advises adopting a multi-layered security strategy that includes protection against advanced threats targeting specific system vulnerabilities.

Furthermore, the myth that OT systems are always isolated and immune to hacking is misleading. With many OT systems now linked to IT networks, they become susceptible to attacks. Companies may not be aware of security gaps stemming from misconfiguration or unpatched vulnerabilities, rendering OT environments a possible entry point for attackers.

The perception that small businesses are insignificant targets for cybercriminals is also erroneous. Such enterprises are likely to possess weaker cybersecurity, making them appealing targets. Effective safeguards are essential regardless of the business size.

Cooke provides further insights into cloud security expectations. "Cloud providers implement strong security measures, but responsibility for securing data in the cloud is shared. Businesses must address risks and configurations unique to their cloud environment to ensure end-to-end protection," he explains.

On data privacy laws, the press release clarifies that these apply to all businesses, not just large ones. Non-compliance can result in significant penalties, necessitating that organisations stay informed and comply with applicable regulations.

Cooke concludes by urging organisations to advance their security measures: "Attackers know that your data is invaluable to you, regardless of what it is, so they will look to extort you to get it back. Companies must move beyond surface-level measures to implement proactive, integrated security strategies that protect IT and OT environments. Legacy signature-based antivirus and simple port-based firewalls are simply not enough." He adds that "security is a shared responsibility; all systems and staff must be educated and protected to keep businesses safe. Clear and concise company policies should be shared across the organisation, and regularly updated security awareness training highlighting modern threats is just as critical as any technical security control."