6.3.4 Summary of Security Tips

There are many ways to violate your data integrity, breach your data confidentiality, and interrupt your system availability through malicious acts, user errors, and disasters. The following is a list of security practices that can help you protect your computer system:

• Keep applications and operating system updated with the latest security patches (vendors such as Microsoft are continually fixing vulnerabilities and posting updates to their customers)

• Turn off your computer or disconnect from the network when not in use

• Close all unused Internet ports

• Install firewalls to protect your network boundary in order to keep unwanted traffic and users out of the network

• Use security software such as firewall and intruder detection systems

Practices against privacy violation and identity theft:

• Use strong passwords that are 8 or more characters long, consisting of a mix of upper and lower case letters, numbers, and punctuation marks

• Encrypt sensitive data such as passwords and credit card numbers

Practices against malicious code:

• Avoid opening unexpected email attachments. If you must, be sure your virus definitions are up-to-date, save the file to your hard disk, scan the file using your anti-virus software, and then open the file

• Expose hidden filename extensions

• Exercise caution when downloading unauthenticated software. If you choose to install software that has not been signed by a trusted source, you may wish to wait for a period of time before installing it in order to see if a Trojan horse is discovered

• Disable Java, JavaScript, and ActiveX if possible- a malicious web developer may attach a script to the content sent from a web site. The malicious script is transferred to your browser, where it can execute and compromise your machine. However, disabling Java, JavaScript, and ActiveX may impair your browsing experience

• Disable scripting features in email programs if possible- email programs use the same code as web browsers to display HTML, therefore vulnerabilities that affect ActiveX, Java, and JavaScript are often applicable to email as well as web pages

• Turn off macros in applications

• Install anti-virus software and keep it up-to-date on user machines and on email servers

• Consult your system support personnel if you work from home to conform with employer's policies or procedures relating to the security of your home network

Practices against data failure, corruption, or deletion:

• Develop a recovery plan in case your system is compromised, or destroyed

• Perform and verify backups

• Make a boot disk before your computer is damaged or compromised

If your computer is compromised:

• Disconnect it from the network and restore from backups

• Verify the integrity of the entire computer (software, configuration files, logs, data, etc.)

• If integrity cannot be verified, reinstall operating system and applications

• Apply all security patches and workarounds before reconnecting to network

It is also possible to safeguard your system so that traffic other than that which is necessary cannot pass through your system. But, keep in mind, you may be limiting your system's ability to interact with other systems or users (for example, filtering out email attachments). Or, you can go to the extremes to avoid security threats and limit your use of the computer by disconnecting from the network. That, however, would severely limit the functionality of your computer. When setting up a computer system, there is a balance that you will need to establish between risk and reward. You should estimate how much risk you are willing to take in order to obtain the functionality that you desire for your computer system. In general, when safeguarding your computer system, make sure you follow a reasonable security policy advised by security experts (from security organizations such as The CERT® Coordination Center (CERT/CC), SANS Institute, or security personnel from your organization).

Most intrusions result from exploitation of known vulnerabilities, configuration errors, or virus attacks where countermeasures were available. One of the most important and useful ways to strengthen the security of your system is to become informed of security issues and vulnerability updates. By performing the recommended practices, you can operate your system in a more secure manner, and help spread best practices to others around you. Some useful resources:

• CERT Tech Tip: Home Network Security

• Recovering from an Incident                          

Assessments: Exercise 6

192