Another myth things to x y x technology you don't need physical protection or a security policy.
Why is this false all applications can only be used for protection if they're turned on shutting down
your operating system.
It's hard to believe that it would still protect the data saved on the disks.
It doesn't and that can't.
This is true also of any other device.
Let's go back to firewalls for a moment.
Even if you paid $5000 for a mid-range firewall it won't defend your system against locally driven attacks
which for example may be launched from the computer standing next to your own.
In other words technological security measures are vital.
This should only be part of a larger security policy for your company.
We'll talk about that in the next part of this course effected security is achieved through obscurity
is another false notion.
This theory assumes that the less conspicuous You are the more secure your system will be.
But it's much harder to hide in the Internet than it is to hide in your house on your street or in your
neighborhood.
Attempting to obscure your computer system and the internet means that your presence will be compromised
for potential customers and other people you want to share information with not connecting to the Internet
in the first place wouldn't make for a big difference.
Any system that performs some operations can disclose a lot on its configuration and the people who
manage it
this information is out there for the public.
And then the next parts of this course will learn to read it.
The next myth client side security successfully protects the server and example is a client application
which does not allow users to enter minus one is a value in the price field on an online show.
It protects us from people who would want to try and deceive us by buying a product for free and making
us pay money to them.
This myth is false for two reasons.
As server administrators you have no control over client computers.
The client couldn't be the administrator of his computer and will be able to use it freely.
You could for example tamper with the functioning of your secure web page used for online purchases.
Not being a programmer the user may not want to modify the code on the web page but it can connect to
the page bypassing your application on a public server.
You can't force all users to connect to the server always using your application if there's communication.
Users can always set it without having to use an X program if they know how to do it.
And the program that will be used instead may not function exactly as you wish it would cracking passwords
is the biggest threat is another myth from our list yes you should protect your authorisations.
It's not true however that if in an authorized person gains access to your authorizations he or she
may hijack your identity and a computer system.
It's also not sure that cracking a password consists of trying algorithms and authorization procedures
until an unencrypted password is determined.
It's far easier to simply ask the user to provide a password as you'll see in six out of 10 attempts
the user will submit his password himself.
So cracking is simply not worth the trouble.
Encrypted passwords for example an empty five hash or any other cryptographic material are used for
authorizations in computer systems.
It's enough to send the hash to an application without even knowing the unencrypted value.
The threat is not limited to simply cracking passwords as far as computer systems users are concerned.
A variant of the myth tells them not to save any passwords they have to be memorized.
A secure password set up by administrators could for example be a string of 18 pseudo randomly generated
characters.
Users knowing they'll have trouble remembering it take the password down.
Is it wrong to do so.
No.
The problem is however storing the information in a secure way.
Like you would store the confidential data such as a credit card.
Not many people would leave their credit card under their keyboards.
They usually put it in a wallet so why don't you keep the note with your password in your wallet and
leave it under the keyboard instead.