,
5 tweets,
1 min read
Read on Twitter
This.
Probably the single biggest misconception among management, that they were breached, or not breached, because of something they did. Reinforced by press coverage that always blames breaches on the victim.
Probably the single biggest misconception among management, that they were breached, or not breached, because of something they did. Reinforced by press coverage that always blames breaches on the victim.
After all, if the Baltimore ransomware attack was because of below-average spending in security, the reason you haven't been hit by a major ransomware is because of your better than average cybersecurity.
Moreover, you do regularly get hit with small ransomware, occasional phished desktops getting compromised, which you easily fix, so this reinforces your believe that it's because it's what you are doing that you don't suffer a major hit.
But in fact, ransomware attacks like that against Baltimore are extremely opportunistic, and likely more due to pure chance than anything else.
In the coming RDP worm, how hard you get hit will likely be determined by whether it gets lucky with domain admin privileges rather than whether you've been diligent about patching.
