Connect with us

Strategies

10 Security misperceptions that need to be addressed immediately

The list is based on the experience of Sophos Rapid Response, a team of expert incident responders who deliver fast assistance in identifying and neutralizing active threats such as malware infections, compromised data, or unauthorized access, among others.

Published

on

Photo by Mimi Thian from Unsplash.com

With June marking National ICT Month in the Philippines and the Department of Information and Communications Technology (DICT) adopting the CHIP (Connect, Harness, Innovate, and Protect) framework for digital transformation and underscoring the value of protection,  Sophos compiled   a guide for Filipino businesses so they can avoid  today’s most commonly held security misperceptions.

The list is based on the experience of Sophos Rapid Response, a team of expert incident responders who deliver fast assistance in identifying and neutralizing active threats such as malware infections, compromised data, or unauthorized access, among others.

Misperception 1: We are not a target. We are too small or have no assets of value to an adversary 

Sophos Advice: Many cyberattack victims assume they are too small, in a sector of no interest, or lacking the kind of lucrative assets that would attract an adversary. The truth is, it doesn’t matter. If you have the processing power and a digital presence, you are a target. Despite the media headlines, most attacks are not perpetrated by advanced nation-state attackers. They are launched by opportunists looking for easy prey and low-hanging fruit, such as organizations with security gaps, errors, or misconfigurations that cybercriminals can easily exploit. 

Misperception 2: We don’t need advanced security technologies installed everywhere 

Sophos Advice: Some IT teams still believe that endpoint security software is enough to stop all threats or don’t need security for their servers. Attackers take full advantage of such assumptions. Any mistakes in configuration, patching, or protection make servers a primary target, not a secondary one, as might have been the case in the past.

Based on the incidents that Sophos Rapid Response has investigated, servers are now the number one target for attacks. Attackers can easily find a direct route using stolen access credentials.  Suppose your organization relies only on basic security without more advanced and integrated tools such as behavioral and AI-based detection and a 24/7 human-led security operations center. In that case, intruders will likely find their way past your defenses.

Misperception 3: We have robust security policies in place 

Sophos Advice:  Having security policies for applications and users is critical. However, they need  to be checked and updated constantly as new features and functionality are added to devices connected to the network. Verify and test policies using techniques such as penetration testing, tabletop exercises, and trial runs of disaster recovery plans. 

Misperception 4: Remote Desktop Protocol (RDP) servers can be protected from attackers by changing the ports they are on and introducing multi-factor authentication (MFA) 

Sophos Advice: The standard port used for RDP services is 3389, so most attackers will scan this port to find open remote access servers. However, the scanning will identify any available services, so changing ports offers little or no protection on its own. 

Further, while introducing multi-factor authentication is essential, it won’t enhance security unless all employees and devices enforce it. RDP activity should occur within the protective boundary of a virtual private network (VPN). Still, even that cannot fully protect an organization if the attackers already have a foothold in a network. Ideally, unless its use is essential, IT security should limit or disable RDP internally and externally.

Misperception 5: Blocking IP addresses from high-risk regions such as Russia, China, and North Korea protects us against attacks from those geographies 

Sophos Advice:  Blocking IPs from specific regions is unlikely to do any harm, but it could give a false sense of security if it’s the sole means of protection. Adversaries host their malicious infrastructure in many countries, with hotspots in the US, the Netherlands, and the rest of Europe. 

Misperception 6: Our backups provide immunity from the impact of ransomware 

Sophos Advice: Keeping up-to-date backups of documents is business-critical. However, if your backups are connected to the network, then they are within reach of attackers and vulnerable to being encrypted, deleted, or disabled in a ransomware attack. 

Storing backups in the cloud also needs to be done with care. The standard formula for secure backups to restore data and systems after a ransomware attack is 3:2:1. Three copies of everything, using two different systems, one of which is offline. 

Having offline backups in place won’t protect your information from extortion-based ransomware attacks, where the criminals steal and threaten to publish your data instead of or as well as encrypting it. 

Misperception 7: Our employees understand security 

Sophos Advice: According to the State of Ransomware 2021, 22% of organizations believe they’ll be hit by ransomware in the next 12 months because it’s hard to stop end users from compromising security. 

Social engineering tactics like phishing emails are becoming harder to spot. Messages are often hand-crafted, accurately written, persuasive, and carefully targeted. Your employees need to know how to spot suspicious messages and what to do when they receive one. Who do they notify so that other employees can be alerted? 

Misperception 8: Incident response teams can recover my data after a ransomware attack

Sophos Advice: This is very unlikely. Attackers today make far fewer mistakes, and the encryption process has improved, so relying on responders to find a loophole that can undo the damage is extremely rare. Automatic backups like Windows Volume Shadow Copies are also deleted by most modern ransomware and overwriting the original data stored on disk, making recovery impossible other than paying the ransom. 

Misperception 9: Paying the ransom will get our data back after a ransomware attack 

Sophos Advice: According to the State of Ransomware survey 2021, an organization that pays the ransom recovers on average around two-thirds (65%) of its data.  A mere 8% got back all of their data, and 29% recovered less than half. Paying the ransom even when it seems easier and covered by your cyber-insurance policy is therefore not a straightforward solution to getting your data back. 

Misperception 10: The release of ransomware is the whole attack – if we survive that we’re OK 

Sophos Advice: Unfortunately, this is rarely the case. Ransomware is just the point where the attackers want you to realize they are there and what they have done. 

The adversaries are likely to have been in your network for days if not weeks before releasing the ransomware, exploring, disabling, or deleting backups, finding the machines with high-value information or applications to target for encryption, removing information, and installing additional payloads such as backdoors. Maintaining a presence in the victim’s networks allows attackers to launch a second attack if they want to. 

Strategies

Renting out your place? Human connection key to a successful holiday rental

Warmth, friendliness and a sense of belonging, or the “homely” side of the experience, strengthen guest loyalty, making them more likely to return to the same host. However, these feelings alone didn’t necessarily make guests more likely to recommend the property to others.

Published

on

Striking up a connection with the property host is the factor that drives repeat bookings on holiday accommodation platforms such as Airbnb.

This is according to a new study, carried out by universities in the UK and Iran and published in the February 2026 edition of International Journal of Hospitality Management, that suggested that quality and value of accommodation also play a part in guest satisfaction, but personal connection is key to people deciding to stay again.

The research analyzed hundreds of online guest reviews and conducted in-depth interviews to understand what shapes guests’ evaluations of their stays in what is known as “peer-to-peer accommodation”.

Conducted over six years, the study shows that guests assess their stays using emotional cues such as warmth, atmosphere, and aesthetics; and cognitive cues such as cleanliness, safety, and convenience.

The study found that warmth, friendliness and a sense of belonging, or the “homely” side of the experience, strengthen guest loyalty, making them more likely to return to the same host. However, these feelings alone didn’t necessarily make guests more likely to recommend the property to others.

In contrast, affective and intellectual experiences – the enjoyment and perceived value of the stay – were stronger predictors of recommendations and positive reviews.

The research also examined how the quality of booking websites, such as Airbnb’s platform, influences guest behaviour. Although the website didn’t change how guests felt about the property itself, a well-designed and trustworthy site directly boosted guest loyalty and word-of-mouth.

Co-author Nektarios Tzempelikos, Professor of Marketing at Anglia Ruskin University (ARU), said: “Guests think carefully about both emotional and practical aspects before booking. Hosts who focus only on one side – either charm or functionality – may be missing the bigger picture.

“Platforms like Airbnb thrive when they’re designed for trust. Guests return to sites that are clear, reliable and easy to use. But it’s not just about tech, it’s about people. The most memorable stays come from warmth, authenticity and genuine local connection.

“By encouraging friendly, personal communication between hosts and guests, and balancing smart technology with a human touch, platforms can create experiences that feel less transactional and more meaningful.”

The study was carried out by researchers from Brunel University, University of Bradford, Newcastle University, Anglia Ruskin University and the University of Tehran.

Continue Reading

BizNews

In-aisle store displays might crowd shoppers and reduce overall sales

Retailers might seek strategies to boost product exposure without also increasing crowding – especially for cart shoppers who may experience greater crowding effects – and that excessive use of in-aisle fixtures will likely dampen sales at the aggregate level rather than increasing it. 

Published

on

In a study involving a real-world grocery store, in-aisle displays meant to boost product visibility were in fact associated with reduced sales and purchase-related behaviors, with results amplified for shopping cart users.

Mathias Streicher of Austria’s Department of Management and Marketing presents these findings in the open-access journal PLOS One.

Retailers often place extra product displays directly in aisles in an effort to boost visibility and enhance sales. However, in-aisle displays could increase spatial crowding, which occurs when people feel restricted in their freedom of movement and has been linked with purchase-avoidance tendencies. To help clarify if in-aisle displays result in more purchases, Streicher conducted several experiments with a partnering grocery store.

First, they tracked weekly sales for an aisle containing household, baby and pet staples over a six-week period during which five product-display stands were placed mid-aisle. The stands were then removed for six weeks. Comparison of sales data showed that in fact, sales increased after removal of the in-aisle displays, with the average weekly percentage of total store revenue from that aisle rising from 4.33 to 4.83 percent.

A second in-store experiment in the same aisle showed that people using shopping carts also stopped and physically handled products—behavior previously linked with sales—about 7.05 times more often when in-aisle displays were absent than when they were present. Non-cart shoppers also touched products more often when displays were removed, but the effect was smaller (3.81 times).

Finally, in an online experiment, 200 participants imagined using a shopping cart or basket while viewing photographs of the same aisle from the in-store experiments, with or without in-aisle displays. They tended to rate the aisle with displays as more crowded and reported lower levels of perceived control for aisles with displays than those without, with effects amplified for imagined cart versus basket use.

Together, these findings suggest retailers might seek strategies to boost product exposure without also increasing crowding – especially for cart shoppers who may experience greater crowding effects – and that excessive use of in-aisle fixtures will likely dampen sales at the aggregate level rather than increasing it. 

Further research could address some of this study’s limitations, such as by considering the effects of human crowding, promotional offers on products, and seasonal influences on shopping behaviors.

Streicher adds: “The research shows that adding merchandise into store aisles can actually reduce overall sales by making the environment feel crowded and harder to navigate. Importantly, this negative effect is even stronger for shoppers using carts, as they experience greater spatial constraints and reduced control while shopping.”

Continue Reading

BizNews

Structure of online reviews shapes their helpfulness

Reviews that grow increasingly positive are most helpful to readers, while those that turn negative are least helpful. For average-rated products, progressively negative trajectories enhance helpfulness, whereas reviews that start negative and grow positive are least effective.

Published

on

A study of nearly 200,000 Amazon reviews shows that the usefulness of online product reviews depends not only on what is said, but on how the information is structured.

The researchers, from the Universities of Cambridge and Queensland, studied Amazon reviews for products ranging from clothing to food to electronics. They found that how the information is organised matters as much as what is said, and that different review structures are more or less helpful, depending on how highly the reviewer has rated the product.

Their results, published in the journal Scientific Reports, could help companies and third-party review platforms design their review pages to prompt the sort of reviews that will be most helpful to potential customers.

For example, a reviewer assessing a laptop might praise its performance and design while criticising its battery life, so how should such information be structured to be most useful to the reader? Should the review begin with criticism and end on a positive note, or start positively before turning to drawbacks?

“Any target of evaluation typically has both positive and negative aspects, which makes crafting evaluative messages challenging,” said co-author Dr Yeun Joon Kim from Cambridge Judge Business School. “The key question is how to structure these elements within a single message. For example, one might present criticism upfront and then move to praise, or instead integrate negative points within an otherwise positive evaluation. Yet research has paid little attention to this structural dimension.

“We wanted to understand whether certain structures are consistently more effective, or whether their effectiveness depends on the performance of the target being evaluated.”

The study was based on 195,675 reviews of 5,487 distinct products, and assessed performance and related factors, and a helpfulness score as measured by reader votes.

The researchers identified nine possible structures of online reviews ranging from Type A reviews that start positive and become more positive as they go along, to Type I reviews that start negatively and become even more negative – with lots of variance in between.

For highly-rated products, reviews that grow increasingly positive are most helpful to readers, while those that turn negative are least helpful. For average-rated products, progressively negative trajectories enhance helpfulness, whereas reviews that start negative and grow positive are least effective. For low-rated products, reviews are judged most helpful when they open constructively before introducing criticism.

“The results are nuanced but very clear,” said co-author Dr Luna Luan from the University of Queensland, who carried out the research while earning her PhD at Cambridge Judge Business School. “Looking at the overall sentiment of reviews does not fully translate into message effectiveness. It is the broader structure of sentiment – how positivity and negativity evolve throughout the review – that shapes how readers interpret online reviews.”

“Our findings have practical implications for how platforms and companies can design review pages in order to elicit the sort of reviews that will be most helpful to readers based on how highly products are rated,” said Kim. “For example, instead of simply asking ‘Write your review here’, the online review form could instead include micro-prompts that guide how reviewers structure feedback in a way recipients find most helpful.”

The researchers found the most commonly used review styles are not necessarily the most helpful to readers. In particular, for average- and low-rated products, the structures that reviewers tend to adopt often differ from those that readers find most useful.

This mismatch likely reflects different underlying motivations. Reviewers are not always writing to maximise usefulness for others, but may instead be expressing their own experiences, frustrations or emotions – especially when evaluating products of moderate or poor quality. As a result, review writing often serves both as information sharing and as a form of self-expression. This helps explain why widely used review styles do not always align with what readers perceive as most informative or helpful.

Continue Reading
Advertisement
Advertisement

Like us on Facebook

Trending