Computer Security Habits

Just a quick idea.

Computer security is a habit.  There are a few things that need to be done consistently, and they are not difficult.  They are also not expensive.

• # Use a password on your computer.  These days, the threats you let in on your computer might be just bad habits your friends have.  You probably don’t distribute your car keys to all the people who come over to a party at your house, and you probably don’t want to allow anybody who comes over access to your personal stuff.  It’s none of their business.  The government has approved the airport search team to look at the content of your computer, if you are going on international flights.  This has obvious security and privacy issues, and if you have sensitive business files on your laptop or your home computer, you want them behind a password.  Unexpected users on your home machine might not be as careful as you are and you might collect spyware and worms from them going to unsafe sites.
• # Turn on the extensions on your files.  This is specifically aimed at users of Microsoft Windows.  Windows has file extensions turned off by default for common extensions.  You are expected to be able to figure out what a file is by its icon shape.  This works for people who pay attention to icon shapes, but not for those who don’t.  Words are still easier.  The reason for all these international icons, like the signs on public restroom with a stick figures to show where the boys and girls go is because there are plenty of people who are visiting and cannot read the language.  Presumably, on your own computer, you have it set up in a language you can read.  Extension-doubling is a common exploit that makes use of the default Microsoft “hide the extensions” game.  An email attachment called Beautiful_Sites.ppt is likely to appear harmless, however “.ppt” should not be visible if you have common extensions hidden, as it is the extension for Microsoft’s own Powerpoint software.  Evil Hacker, knowing you might have extensions hidden, sends you a file called Beautiful_Sites.ppt.exe, and Windows lops off the tell-tale exe extension, which we all know is short for executable, the standard Microsoft name for program files or application files.  The command in Windows 2000 and XP is “Folder Options”.  Go to your control panel, change to “classic view” and look for “Folder Options.”  The second tab says “View.”  In the middle of the View tab, is a white box with a list of view options. Take the checkmark OUT of the Line that reads “Hidefile extensions for known file types.”  Then click the apply button.  Now at the top of the window a previously greyed-out button becomes live that reads, “Like current Folder.”  This will make all folders behave the same way as the command you just applied.  Click the “Like Current Folder” button and approve the warning that appears, asking you if you really want to do that.  Now you cannot be fooled by the old doubled-extension trick.
• # Make sure your Windows Update system is set to download and install all updates automatically, and make sure the computer is turned on and attached to the Internet during the time you set it to check for Antivirus and Firewall updates.  For home use, My favourite Antivirus software is Bitdefender and my current favorite firewall is Comodo.  These are excellent software companies and both have a free (not free-trial) version for home users.
• # I do not think the “all-in-one” security suites are living up to their hype.  I don’t suggest having a single vender solution for this because that makes your security rest on a single point of failure too.  Did you know there are worms designed to attack specific antivirus products?
• # Don’t use “Windows Firewall” that comes preloaded in your Windows Operating System install.  Windows firewall leaves about 200 UDP ports open, even when it tells you it is locked down tight.

Oh yeah, I said this was about habits.

7 habits of people who run secure windows:

1. ! for general purposes, like email, web use and writing papers, etc., make a new profile that has no admin rights at all.  This way, even if you get infected on that profile, you may not have an entirely buggy computer.
2. ! Check your antivirus scan logs at least monthly to make sure there is nothing funny going on.
3. ! Keep a “throw-away” email for newsletters and signing up for web stuff.
4. ! Be suspicious of free things that require a credit card number to access.
5. ! Make sure your computer is on to receive automatic updates.  (Most computers are small consumers of power compared to the refrigerator, air-conditioning and 100-Watt lightbulbs)
6. ! Delete email older than 3 years (a waste of space, and it may slow your email down).
7. ! Run anti-spyware software every week.  Spybot S&D is a good one (also free).