The second biggest misconception is that of the dedicated human attacker. Nothing captures our attention like a malicious human hacker -- the emotional, visceral mental picture of caffeine-high attackers just waiting to break into your business. And in many cases hackers are breaking in; it's just that 99.99 percent of the real attack threat to any business is automated malware (viruses, worms, Trojans, etc.).

Too many computer defenses and books concentrate on the wrong problem -- the hackers instead of the malware. How can anyone give you the correct defense if you don't understand the correct problem?

Should a defender prepare and defend differently based on malicious mobile code versus the dedicated attacker? Yes. Simple security by obscurity works well against automated threats.

For instance, two of my honeypots (http://www.infoworld.com/article/05/12/16/51OPsecadvise_1.html) run Microsoft SQL server. Microsoft SQL servers typically run on ports 1433 UDP and 1434 TCP. The MS-SQL honeypot that runs on those ports gets scanned and attacked dozens to thousands of times a day. The other honeypot runs on a high non-default port (say, 30143 TCP) with a blank sa password, but it never gets attacked. Or, I should say, almost never -- in the 22 months that it has been up, it has been scanned once on the correct port, and even that hacker or bot didn't attack it.

No sa password guesses and no buffer overflow attempts in almost two years: One simple security by obscurity trick defeated almost all of the risk. And even if the attacker guesses the correct port on a production SQL server, they'll face the default security inherent in all the regular installs.