Language Selection

English French German Italian Portuguese Spanish

Oversold Security Hype

Filed under
Security

A number of the most promoted security risks are nothing more than a load of hype, Gartner has said in an unexpected outbreak of sober assessment.

The analysis firm has decided to use its IT Security Summit in Washington, D.C., this week to name and shame the issues it sees as the most oversold. The top-five list comprises a number of favorites from the last year, namely the fear of mobile malware, the belief that Voice over IP (VoIP) is unsafe, concerns about wireless hotspots, the equation of regulatory compliance with security, and the idea of a superworm that could spread on the Internet in a matter of minutes.

Of mobile malware, company vice president John Pescatore put it bluntly: "Antivirus vendors see huge potential profit opportunities in selling security solutions to billions of cell phone and PDA users. In particular, the antiviral industry sees cell phones as the way to grow sales outside of a flat, commoditized PC market. However, device-side antiviruses for cell phones will be completely ineffective."

Of the obsession with regulatory compliance, his analyst colleague Lawrence Orans said: "The best way to increase enterprise IT security is to buy and build software that has fewer vulnerabilities, but there has been no regulatory focus on this area."

Similarly, attacks on VoIP systems are rare--which renders elaborate security measures unnecessary--and the danger to users of wireless hotspots could be greatly reduced with simple technology. The threat of what the company called the "Warhol worm," able to infect every unprotected PC on the Internet in 15 minutes, has been greatly exaggerated.

"Many businesses are delaying rolling out high-productivity technologies, such as wireless local-area networks [WLANs] and IP telephony systems, because they have seen so much hype about potential threats," continued Orans in the official statement.

Perhaps it is fair to point out that Gartner itself has sometimes sent out mixed messages on these issues. Only last year it produced a report titled "Voice over IP Communications Must Be Secured," which noted in the summary the unique attributes of the medium that made security important. Now Gartner appears to be playing down this issue. "Preventive measures for securing an IP telephony environment are very similar to securing a data-only environment," Orans is quoted as saying.

The company has also produced numerous paid-for reports in recent years on the subject of wireless and mobile security, which doesn't in itself invalidate its current stance but which has added to the general impression in the minds of IT professionals that these are areas of real anxiety.

Gartner publishes a Hype Cycle report on a variety of IT industries, accessible at its Web site.

Source.

More in Tux Machines

today's howtos

Tizen in Bolivia and India

Security Leftovers

  • Security updates for Wednesday
  • Microsoft says its best not to fiddle with its Windows 10 group policies (that don't work)

    On Monday, we revealed that a security researcher had used a packet sniffer to show that many settings designed to prevent access to the internet were being ignored with connections to a range of third party servers including advertising hubs.

  • What's got a vast attack surface and runs on Linux? Windows Defender, of course
    Google Project Zero's Windows bug-hunter and fuzz-boffin Tavis Ormandy has given the world an insight into how he works so fast: he works on Linux, and with the release of a personal project on GitHub, others can too. Ormandy's project is to port Windows DLLs to Linux for his vuln tests (“So that's how he works so fast!” Penguinistas around the world are saying). Typically self-effacing, Ormandy made this simple announcement on Twitter (to a reception mixing admiration, humour, and horror):
  • Hacked in Translation – from Subtitles to Complete Takeover
    Check Point researchers revealed a new attack vector which threatens millions of users worldwide – attack by subtitles. By crafting malicious subtitle files, which are then downloaded by a victim’s media player, attackers can take complete control over any type of device via vulnerabilities found in many popular streaming platforms, including VLC, Kodi (XBMC), Popcorn-Time and strem.io. We estimate there are approximately 200 million video players and streamers that currently run the vulnerable software, making this one of the most widespread, easily accessed and zero-resistance vulnerability reported in recent years.
  • A Samba remote code execution vulnerability
    Distributors are already shipping the fix; there's also a workaround in the advisory for those who cannot update immediately.

KDE, Qt, GTK and GNOME News

  • KDE Plasma 5.8.7 LTS Desktop Environment Released with over 60 Improvements
    KDE has announced today the release and immediate availability of the seventh maintenance update to the long-term supported KDE Plasma 5.8 desktop environment. KDE Plasma 5.8.7 LTS is now considered the latest stable and most advanced version of the KDE Plasma 5.8 LTS (Long Term Support) desktop environment, which some of you out there are probably using on your favorite GNU/Linux distributions instead of a short-lived branch like KDE Plasma 5.9 or the upcoming KDE Plasma 5.10 release.
  • Summer of Coding!
    After a month of dread and panicking about the fact that Google Summer of Code results are announced in the middle of exam season... I'm happy to say I'll be doing the Rust plugin for KDevelop!
  • Qt 5.9 Release Candidate Available For Testing
  • Qt 5.9.0 RC released
    We have released Qt 5.9.0 RC today. You can update it at the top of your Qt 5.9 beta(4) online installation or do clean installation by using qt online installer. Detailed instructions here: https://wiki.qt.io/How_to_get_snapshot_via_online_installer .
  • The Road to GTK+ 4 Continues, New Milestone Adds Initial OS X and Meson Support
    A new milestone was released recently, GTK+ 3.91.0, which adds quite a bunch of improvements and bug fixes, but also some new APIs and compatibility with other supported operating systems besides those based on the Linux kernel. For example, GTK+ 3.91.0 implements initial support for Apple's macOS platform, which will make it possible to run apps written in GTK+ 4 on OS X.
  • Epiphany Browser Updated for GNOME 3.25.2 with New Shortcuts for Switching Tabs
    Ahead of today's GNOME 3.25.2 desktop environment development release, the team of developers behind the Epiphany web browser have released the second milestone towards the Epiphany 3.26 stable series, due out later this year.