The Four Most Dangerous Security Myths

[mandy]

A lot of "accepted wisdom" is just flat-out wrong. If you've been told that patches always fix a security hole, or that SSL is all you need to be safe, read on.

To help you separate truth from fiction, here are four of the most dangerous security myths.

1. Patches always fix the security hole:...
2. SSL is secure:...
3. Theoretical vulnerabilities don't pose a danger:...
4. Wireless networks are inherently insecure:...

full article: http://www.informationweek.com/story/showArticle.jhtml?articleID=172300043&pgno=1

[rose]

1. Patches always fix the security hole:...

Windows patches are proof that patching doesn't fix security problems 100% of the time. 

"You need to find the holes before the bad guys do," he says. "Most people think defensively, but you have to think offensively. It's jujitsu."   duh!  trying to find them first is the hard part

[bargainbloodhound]

[quote author=rose link=topic=820.msg3127#msg3127 date=1129399676]

1. Patches always fix the security hole:...

Windows patches are proof that patching doesn't fix security problems 100% of the time. 
[/quote]

Gentoo patches/upgrades that cause Apache to stop working for users who didn't read the change notes before installing them are proof that....  :twistedevil:

1. Patches always fix the security hole:...

They fix known security holes but the odds are a new one will be found the day after you install the patch. The second you connect a server or computer to a network/the Internet you've opened up a potential security hole that's just waiting to be explored by evil outsiders.  :twistedevil: 

2. SSL is secure:... 

 

Until you encounter a phisher using an SSL certificate and spoofing a well known web site and discover that the lock icon showing on your browser didn't mean that you were safe when you gave out your credit card info.  :

3. Theoretical vulnerabilities don't pose a danger:...

Expect to be hacked at some point in the near future if you believe you're safe from hackers