There are many mantras and claims floating around about cybersecurity. Some of them leave no room for doubt, like “defence in depth”, which suggests deploying protective means at every level of the hardware and software stack, or “KISS ─ keep it simple, stupid” to avoid over-complication and too many deviations from the “standard” cybersecurity system. Other, more unfortunate statements also hold true. For example, “convenient, cheap, secure ─ pick two” makes “secure” always the least attractive option, as it brings no immediate benefits. However, some other mantras and claims are simply not true. Plain wrong. Or, excuse my language, “bull****”.

Indeed, computer security is never straightforward. Often, there is no single solution, but a series of complementary solutions is needed, like how our xorlab ActiveGuard solution works together with the Microsoft SPAM filter. Often a holistic solution cannot be found, for example when the quick fix of having two-factor authentication (2FA) for the new CERN SSO was deployed, which meant that the old SSO was left to die, and the non-holistic solutions we are looking at for how to deploy 2FA to LXPLUS and Windows Terminal Servers in the future. Generally, computer security requires the aforementioned “defence in depth”: individually, multiple protective layers, each with a defined (implementation) scope, a limited coverage and holes are insufficient. But together, they provide adequate overall protection to the Organization that is pragmatic, balanced and efficient. Combined, they keep the cybersecurity risks and threats to the Organization under control.

So, while we acknowledge that there is no single solution to “cybersecurity”, there are many wrong solutions. Wrong statements. Wrong mantras. Bull****. In order to give you an idea of what we mean, let’s play “Bull**** Bingo”. Below are 25 statements we have heard in the past about cybersecurity, best security practices and cybersecurity implementation, some even from esteemed colleagues. Can you spot where they went wrong?  

The first three people to send the five true statements to Computer.Security@cern.ch will win a bottle of Coca-Cola, as well as a “Hawaiian” pizza from CERN’s Restaurant 2.

Want to learn more about computer security incidents and issues at CERN? Read our monthly reports (https://cern.ch/security/reports/en/monthly_reports.shtml). For more information, questions or advice, check out our website (https://cern.ch/Computer.Security) or contact us at Computer.Security@cern.ch.