How to Protect your Data ?

     It's a human tendency to lock your home whenever you go out; it makes you feel protected. But what about data what you have saved on your computer? Do you lock it when you transfer it from your computer? Given the threats lurking online - hackers, phishers, identity thieves and the like - you would do well to encrypt your data of you are using the internet to share crucial information with others. This ensures privacy and prevents it from getting hacked. Even if someone succeeds in stealing an encrypted file, he or she will be unable to misuse it unless the key to decode the content of that file is also stolen alongside. Then there are the monetary transactions online and the personal information shared on the Internet. To protect users, the file encryption process is a crucial part of an efficient computer security system. File encryption or data encryption is a process of transforming your confidential information into an unreadable format which cannot be accessed without the correct password or key. Though there are third-party encryption software available like TrueCrypt in the market, you can also use the lesser known, built-in feature of Windows to secure your files. Here to go about this.

How to Encrypt a File? 

1. Right click on a file you want to encrypt. Click the 'Properties' option at the bottom of the context menu.

2. Click the 'Advanced' button located under 'General' tab in the 'Properties' dialog box.

3. Click the 'Encrypt Contents to Secure Data' option and click 'OK'.

4. If the file is in a folder you will be prompted with an 'Encryption Warning' message. If this is the case, click the 'Encrypt the File Only' option and click 'OK'.

Tips

• You can use EFS (Encrypting File System) to encrypt files on Windows XP, Windows Vista, Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. The filesystem should be NTFS; it won't work on FAT32.

•  Select the certificate of the user whom you want to add (to the access list of the encrypted file), and then click OK. You can do this by clicking Properties -> Advanced -> EFS settings.

• To decrypt a folder, use the same process, only disable the document property encryption by clearing Encrypt Document Properties check box.

• Rename your file with a completely different filename and a different file extension. For example, change filename.doc into general.jpg or filename.xls into birthday.mp3; If file extensions (.doc, .png, .mp3, etc.) are not visible go to: Tools -> Folder Options -> View, and uncheck hide extensions for known file types. Some computer savvy individuals may be able to crack the file.

• You can encrypt your files using strong AES-256 encryption feature of 7-zip, which is a free file compression utility which you might be using already to compress/zip multiple files into one smaller file to be send across internet.

After encrypting the files, you should back up your certificates because there is no other way to recover encrypted files with a corrupted or missing certificate. It is critical that you back up the certificates and store them in a secure location. Here's how to back up your certificate : 

1. Open Microsoft Internet Explorer. On the Tools menu, click 'Internet Options'.

2. On the 'Content' tab, in the Certificates section, click 'Certificates'. Click the 'Personal' tab.

3. Select one certificate at a time until the 'Certificate Intended Purposes' field shows 'Encrypting File System'.

4. Click 'Export' to start the Certificate Export Wizard, and then click 'Next'. Click 'Enable Strong Protection', then click 'Next'. Type in your password.

5. Specify the path where you want to save the key, and then click 'Next'. You can save the key to another location on the hard disk, or on a removable media.

Read More

Tips for Strong Password

        A secret series of characters that enables a user to access a file, computer, or program is Password. On multi-user systems, each user must enter his or her password before the computer will respond to commands. The password helps ensure that unauthorized users do not access the computer. In addition, data files and programs may require a password.

Ideally, the password should be something that nobody could guess. In practice, most people choose a password that is easy to remember, such as their name or their initials. This is one reason it is relatively easy to break into most computer systems. Here are 10 tips for creating strong password.

1. Use a strong password. A strong password contains a combination of six or more uppercase and lowercase letters, plus punctuation and numbers. Using all four types ofcharacters works the best. For example instead of using welcome use W3Lc0mE^9.

2. Passwords should be eight or more characters in length. The longer the password, the harder it is to crack.

3. Never use the same password twice. If, for example, your eBay account were hacked and your password obtained, the hacker would have instant access to your PayPal account if you use the same password.

4. Do not use common information in your password, such as birthdates, your phone number, or other information directly related to you.

5. Passwords comprised of characters rather than proper words are more secure.

6. Refrain from writing passwords down and do not login to accounts via a public computer (e.g., at the library or Internet cafe) and save the password details in the browser.

7. Never click an e-mail link and log into a secure site from an e-mail. Even if the e-mail looks legitimate, always type the URL into a browser yourself, then log in to your account. This will help you avoid phishing attacks.

8. Do not allow applications to store your passwords online, and remember to clear your browser cache, history and clear passwords frequently.

9. Remember to change your passwords frequently. The more important the account, the more frequently the password should be changed.

10. Never communicate a password to anyone, especially via e-mail or instant messenger. Passwords should always be kept private.

Courtesy: http://doputtur.blogspot.com/

Read More

Disable Network Search by XP

By default, Windows XP monitors shared resources on the network to make it easier to connect to a shared resource. This feature, in Windows XP, is implemented by periodically scanning the computers on the network. During the scan, Windows XP identifies any newly-shared resources, such as a printer that has just gone online as a shared printer, or a folder that has just been shared.

If this is not needed for you, this feature can be disabled and XP will work faster.

Method 1:

Disable the automatic search for network printers and folders by changing folder options:To disable the automatic search for network printers and folders, follow these steps:
1.Double Click My Computer ,Click Tools menu ,Select Folder Options
2.Click the View tab.
3.In the Advanced Settings list, click to clear the Automatically Search for Network Folders and Printers check box.
4.Click OK.

Method 2:Disable the automatic search for network printers and folders by changing the registry key:To change the registry key to disable automatic search for network printers and folders , follow these steps:
1.Click Start, type regedit in the Start Search box, and then press ENTER.
2.Locate the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
3.Right-click System, point to New, and then click DWORD Value.
4.Type NoNetCrawling, and then press ENTER.
5.Double-click NoNetCrawling.
6.In the Value data box, type 1, and then click OK.
7.Close Registry Editor.

Source: Mocrosoft Support &   http://doputtur.blogspot.com/

Read More

Securing Yourself from a World of Hackers

Read More

Delete downloaded files and Browsing History

Due to privacy and security concerns, most people wish to delete their surfing history and files from their computer. It also prevents problems due to virus , spyware and increases the computer speed. Usually this is simple, but at times you can face problems.  

How to delete websites visited from Internet Explorer/ browser history

To clear your history from Internet Explorer :

1. Click Tools and Internet Options on the drop down menu,

2. Click on the General Settings tab.  

3. In the temporary internet files section , Click "delete cookies" (to delete cookies in cache)

4. Then click on  "delete files" . This deletes the html pages and images you download that Internet Explorer saves on your hard disk. Deleting files may take time, if  you have visited many websites. Wait till all the files are deleted, interrupting will cause partial deletion of files.

5. Then go to the history section, first "clear history" . Then set the "days to keep pages in history" at "0" . Click on apply to save this setting

6. Then click on "settings" , select "view files" click on top of page "edit" then click on "select all" then click on selected files, then click on "delete".  There should be no files if step 4 has been done properly

7. Click on the General Content tab in the Internet Options menu.

8. Under Personal information, click on the AutoComplete box. 

9. Uncheck "Web Addresses", "Forms" and "User Names and Passwords on Forms".

10. Click on "Clear Forms" & "Clear Passwords"

11. Click in the "Advanced" tab.

12. Go to the Security section and check "Empty Temporary Internet Files Folder When Browser is Closed" (This essentially does steps 3 and 4 every time you close your browser)

To clear your history from Mozilla Firefox:

1. Go to the "Tools" menu.

2. Select "Options" > "Privacy" > "History."

3. Click on "Clear." To completely disable the history function, set "Remember visited pages for the last X days" to zero ("0"). 4. Click "OK" to exit.
or Firebox * Either press Ctrl+Shift+Del or Click Tools=>Clear Private Data.
* To permanently stop saving data that you entered in search and form fields :
Goto to Tools=>options=>Privacy=>Saved... uncheck the "Save Information As I enter in Form and Search Fields"
your search or form entries will not appear anymore.

Google Toolbar :

 To clear your search history from the drop-down text box on the Google Toolbar:1. Click on the 'Google' logo to access the drop-down menu.
2. Select the 'Clear Search History' option. This will clear all the previous searches from the drop-down box.
All you recent searches on the toolbar will be cleared

This should be used only by experienced users, since making a mistake could damage your computer and you will lose all data
To delete the search tool in the start menu, Go to Start >> Run >> Type in REGEDIT
Navigate to the HKEY_CURRENT_USER \ Software \ Microsoft\Search Assitant\ACMru
Your actual search list is kept there. Delete the actual text used for your searches, nothing else.

Other options for cleaning traces of online activity are CCleaner  (Free)

Read More

10 Tips for Securing your PC

1. Update / patch ALL your software every now and then!

2. Check / adjust ALL your settings so they are safe, since they ARENT by default!

3. Use firewall, like ZoneAlarm!

4. Use good passwords: at least 13marks long, containing both letters and numbers. Remember to chance your password every few months atleast!

5. Get good anti-virus & Spyware softwares and keep it updated!

6. Don’t open or execute files that you are not 100% sure are absolutely safe no matter where or how you get them.

7. Wipe your historyfiles (like cookies, internet history and temporary files, etc.), logs and personal files, with specific wiping program (like Eraser) instead of just deleting them.

8. Use encryption to enhance your privacy! Use encrypted email (like Hushmail or Ziplip) and encrypt sensitive files on your computer (PGP).

9. Don’t use public computers for anything you need to type in your logins, they usually have Trojan horses that capture your passwords.

10. Don’t assume anything. If you don’t know, find out! If you cant or don’t understand, ask someone who knows! There’s nothing more dangerous than doing something you don’t really know anything about. That’s the best way to cripple your system or get a Trojan horse on your computer!

Read More

Optimize Your Pen Drive for Security

NTFS file format offers more security and speed compared with the other file system’s like FAT or FAT32. When you want to format a Pen drive or USB drive in NTFS file system Format actually you will not see any option in Windows by default to do it. When you right click on the Pen drive‘s icon and choose format option you will get only two options FAT and FAT32 to format the pen drive. So you can format your USB drive in those two formats only. So here is a way to format you Pen drive in NTFS file system format.

The best advantage of NTFS file system format is that data can be written to the pen drive only using our system i.e. by your pc only (the data is secure). So when we plug on to other system they can only read the drive and cant write to it since the pen drive is in NTFS file format. So we don’t need to fear any virus from entering our pen drive.

Here’s how to do it.

• Plug the USB drive or Pen drive to your PC.
• Now right click on MY Computer in Desktop and select Device Manager.
• Select Disk Drive and Expand it (+) and you can see your drive.
• Now right click on it and select Properties and go to the Policies Tab.
• Now activate the option showing Optimize For Performance and press OK .
• This will enable the pen drive to be used in NTFS file format. From now on you will get the option to format your Pen drive or USB drive in NTFS file format.

You will also notice a speed increase in writing and reading data with your pendrive, this is because the pendrive or USB drive is now optimized for performance mode.

Read More

How to know Our Sent eMail is Read or Not?

If you ever wondered whether mails you sent ever gets read or just sent to trash, you can use a mail tracking service which allows email tracking provided by MailTracking.Com. They send you a email notification whenever the recipient reads your email. Notification includes many details including following… Date and time opened, Location of recipient (per their ISP city /town),How long the email was read for? , How many times your email was opened , If your email was forwarded, or opened on a different computer etc

How to Use Mail Tracking to Track your Emails Create an account with them first.

Then next time, whenever you send mail to someone@special.com just add .mailtracking.com to the email address.

So in this case email address will become someone@special.com.mailtracking.com

Now whenever someone@special.com read your email, you will receive notification mail from mailtracking.com

Details : Basically the change in email address will route email through mailtracking.com’ server. They add a small (around 3×3 pixel) white image which is almost invisible to human eyes in email body. The image will be hosted on mailtracking servers and a unique image is kept for each email message.

So when someone opens email that image also get downloaded. Now mailtracking server logs the browser request for image (note that the request goes in background) and thus can mail you details which mentioned above.

Read More

What is "autorun.inf" ?

While opening some optical drives (CDs) or pen drives you might have noticed that they contain autorun.inf file in it. Some people assume that it is some Virus/Malware which might infect their computer. But actually autorun.inf is just a script for invoking any event when some CD or Pen Drive is Inserted in PC. This feature is actually a part of shell32.dll.

You can set your own custom icon and your own custom file to start when media is inserted in computer. If you are a geek, then you can accomplish much more and impress your friends with some smart autorun scripts while burning CDs for them!

A sample of autorun.inf file looks like as shown below:

[autorun]

open=autorun.exe

icon=autorun.ico

label= My Thumb Drive(98XXXXXXXX)

Taking above examples I’ll explain functions of commands here-

Open – Specifies which file to start when media is Inserted.

Icon – Specifies the Icon to appear in Windows explorer

Label – The Volume of Drive to Appear in Window Explorer

If you are lazy at writing this codes you can try a free tool, Autorun.inf Maker.

You can bypass events written in autorun.inf by pressing shift key while inserting Pen Drive or CD. This is useful when you are unsure about what Pen Drive or CD might contain. However, I recommend you to use some good antivirus like AVG or Avast which takes less load on system and detects any unwanted threats. There is also an antivirus Program which is made for this purpose only which is mentioned here.

Download Autorun Maker

Read More

How to Disable and Re-enable USB Storage Devices

As per the Microsoft knowledge base article 823732 which contains instructions on how to disable USB storage access for a certain group of users this diabling and re-enablement of USB ports is based on a simple registry entry.

To disable the access to USB port, in windows XP and 2000, follow the steps below
1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. Locate, and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
4. In the right pane, double-click Start.
5. In the Value data box, type 4, click Hexadecimal (if it is not already selected), and then click OK.
6. Quit Registry Editor.

To re-enable a disabled port, follow these steps below
1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. Locate, and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
4. In the right pane, double-click Start.
5. In the Value data box, type 3, click Hexadecimal (if it is not already selected), and then click OK.
6. Quit Registry Editor.

Read More

Windows XP Security Console

Windows XP Security Console

Usage: Download  Windows XP Security Console.  Double click the EXE file you downloaded and extract the contents to your hard disk. The EXE and CHM (Help) file need to be in the same folder.  There is no uninstaller, but be advised, any restrictions that have been put in place will remain in place, even if you delete the application. So, if you're going to remove the application, make sure that you change any settings that you want to, before you remove it.  For additional security, this utility and its help file are small enough to fit on a floppy disk.  Extract the files to a floppy, run the utility from there, change the settings you wish, then put the floppy away somewhere safe.

Download

Read More

Tips to Prevent Computer Fraud

Computer fraud is growing in frequency and sophistication every day. Through the extensive coverage of the Internet, identity thieves and other criminals are reaching across states, countries and continents to fraudulently obtain personally identifiable information about individuals and businesses. There are, however, a number of ways to avoid becoming a victim of fraud on your computer.

Email Precautions:

• If you receive emails from senders you don't know, delete them immediatelywithout opening them and do not reply to unsubscribe as this can tip off phishers that they have reached a valid email address.
• If you get any type of unsolicited email or pop-up message that asks for any type of personal information, don't respond to it and notify your Internet Service Provider (ISP) immediately.
• Never send personal or sensitive business information via unsecured email. Any information sent through unsecured email messages may be intercepted and stolen.

Online Precautions:

• Install and keep anti-virus/anti-spyware software on your computer updated.
• Do business only with reputable online firms.
• Don't keep personal or business information, passwords or account numbers online or on websites.
• If you are conducting any type of business online, make sure you are doing so on a secure web connection. If you see the characters https:// in the web page address in your browser, you are visiting a secure website that uses encryption to protect your identity and your information. If you only see http://, don't enter any personal information because the page in not a protected web site and could be intercepted during transmission.
• Know who you are dealing with online. Don't complete forms that ask for personal information if you don't know exactly where they are going and what they will be used for. Review the Web site privacy policies of sites with which you deal.
• If you bank online, make sure you stay at your computer for the entire transaction, and then be sure you sign off completely when you are done.
• Ask to have your account and credit card statements sent to you onlinedirectly from your bank or credit card company.

PNC's website is protected by sophisticated encryption strategies that shield your personal information from hackers. When you use our contact form or secure messaging within Online Banking the information you send to the bank cannot be intercepted and read, and communications from PNC are protected as well. Never send personal or account information through unsecured e-mail.

Read More

ADMINISTRATOR ACCOUNTS AND VIRUSES

Every new account created on a Windows XP PC is a full-blown Computer Administrator account. You shouldn’t use Administrator accounts for everyday work, that most users only need a limited user account.
Many Windows XP experts suggest that you create two accounts for each user:

• An Administrator account that you can use to install hardware and software and make major changes (such as adding a new account)
• A plain, limited account for everyday work

The rationale is straightforward: If you’re using an Administrator account and you accidentally run into a virus (or a Trojan horse, worm, or the next big, scary security threat), that bad program automatically inherits your authority. So if you’re using an Administrator account, the bad program can wipe out your hard drive or do just about anything it likes. In actuality, though, the level of protection afforded by running as a limited user isn’t all that great. Malicious programs that can crack Outlook’s address book, for example, can certainly attack the address books of all accounts on the computer, whether they’re Administrator accounts or limited user
accounts. And any program that deletes My Documents can get all the My Documents folders on the machine, guaranteed.
Anyway, your antivirus software should be looking for malicious programs and protecting your entire machine. That’s simply not the job of an Administrator account. Of course, if you’re using a limited account and you bump into a virus, Trojan horse, worm, or some other form of sniveling scumware, the program can’t do as much damage. Because malware inherits your authority (and limited user accounts don’t have much authority), you may be slightly better off. Slightly. After all, you still have a virus infecting your machine.

Read More

General security Measures

General security

• Choosing and Protecting Passwords
• Understanding Anti-Virus Software
• Understanding Firewalls
• Coordinating Virus and Spyware Defense
• Debunking Some Common Myths
• Good Security Habits
• Safeguarding Your Data
• Real-World Warnings Keep You Safe Online
• Keeping Children Safe Online

Choosing and Protecting Passwords

Passwords are a common form of authentication and are often the only barrier between a user and your personal information. There are several programs attackers can use to help guess or "crack" passwords, but by choosing good passwords and keeping them confidential, you can make it more difficult for an unauthorized person to access your information.

Why do you need a password?

Think about the number of personal identification numbers (PINs), passwords, or passphrases you use every day: getting money from the ATM or using your debit card in a store, logging on to your computer or email, signing in to an online bank account or shopping cart...the list seems to just keep getting longer. Keeping track of all of the number, letter, and word combinations may be frustrating at times, and maybe you've wondered if all of the fuss is worth it. After all, what attacker cares about your personal email account, right? Or why would someone bother with your practically empty bank account when there are others with much more money? Often, an attack is not specifically about your account but about using the access to your information to launch a larger attack. And while having someone gain access to your personal email might not seem like much more than an inconvenience and threat to your privacy, think of the implications of an attacker gaining access to your social security number or your medical records.

One of the best ways to protect information or physical property is to ensure that only authorized people have access to it. Verifying that someone is the person they claim to be is the next step, and this authentication process is even more important, and more difficult, in the cyber world. Passwords are the most common means of authentication, but if you don't choose good passwords or keep them confidential, they're almost as ineffective as not having any password at all. Many systems and services have been successfully broken into due to the use of insecure and inadequate passwords, and some viruses and worms have exploited systems by guessing weak passwords.

How do you choose a good password?

Most people use passwords that are based on personal information and are easy to remember. However, that also makes it easier for an attacker to guess or "crack" them. Consider a four-digit PIN number. Is yours a combination of the month, day, or year of your birthday? Or the last four digits of your social security number? Or your address or phone number? Think about how easily it is to find this information out about somebody. What about your email password—is it a word that can be found in the dictionary? If so, it may be susceptible to "dictionary" attacks, which attempt to guess passwords based on words in the dictionary.

Although intentionally misspelling a word ("daytt" instead of "date") may offer some protection against dictionary attacks, an even better method is to rely on a series of words and use memory techniques, or mnemonics, to help you remember how to decode it. For example, instead of the password "hoops," use "IlTpbb" for "[I] [l]ike [T]o [p]lay [b]asket[b]all." Using both lowercase and capital letters adds another layer of obscurity. Your best defense, though, is to use a combination of numbers, special characters, and both lowercase and capital letters. Change the same example we used above to "Il!2pBb." and see how much more complicated it has become just by adding numbers and special characters.

Longer passwords are more secure than shorter ones because there are more characters to guess, so consider using passphrases when you can. For example, "This password is 4 my email!" would be a strong password because it has many characters and includes lowercase and capital letters, numbers, and special characters. You may need to try different variations of a passphrase—many applications limit the length of passwords, and some do not accept spaces. Avoid common phrases, famous quotations, and song lyrics.

Don't assume that now that you've developed a strong password you should use it for every system or program you log into. If an attacker does guess it, he would have access to all of your accounts. You should use these techniques to develop unique passwords for each of your accounts.

Here is a review of tactics to use when choosing a password:

• Don't use passwords that are based on personal information that can be easily accessed or guessed.
• Don't use words that can be found in any dictionary of any language.
• Develop a mnemonic for remembering complex passwords.
• Use both lowercase and capital letters.
• Use a combination of letters, numbers, and special characters.
• Use passphrases when you can.
• Use different passwords on different systems.

How can you protect your password?

Now that you've chosen a password that's difficult to guess, you have to make sure not to leave it someplace for people to find. Writing it down and leaving it in your desk, next to your computer, or, worse, taped to your computer, is just making it easy for someone who has physical access to your office. Don't tell anyone your passwords, and watch for attackers trying to trick you through phone calls or email messages requesting that you reveal your passwords

If your internet service provider (ISP) offers choices of authentication systems, look for ones that use Kerberos, challenge/response, or public key encryption rather than simple passwords  Consider challenging service providers that only use passwords to adopt more secure methods.

Also, many programs offer the option of "remembering" your password, but these programs have varying degrees of security protecting that information. Some programs, such as email clients, store the information in clear text in a file on your computer. This means that anyone with access to your computer can discover all of your passwords and can gain access to your information. For this reason, always remember to log out when you are using a public computer (at the library, an internet cafe, or even a shared computer at your office). Other programs, such as Apple's Keychain and Palm's Secure Desktop, use strong encryption to protect the information. These types of programs may be viable options for managing your passwords if you find you have too many to remember.

There's no guarantee that these techniques will prevent an attacker from learning your password, but they will make it more difficult.

 

Understanding Anti-Virus Software

Anti-virus software can identify and block many viruses before they can infect your computer. Once you install anti-virus software, it is important to keep it up to date.

What does anti-virus software do?

Although details may vary between packages, anti-virus software scans files or your computer's memory for certain patterns that may indicate an infection. The patterns it looks for are based on the signatures, or definitions, of known viruses. Virus authors are continually releasing new and updated viruses, so it is important that you have the latest definitions installed on your computer.

Once you have installed an anti-virus package, you should scan your entire computer periodically.

• Automatic scans - Depending what software you choose, you may be able to configure it to automatically scan specific files or directories and prompt you at set intervals to perform complete scans.
• Manual scans - It is also a good idea to manually scan files you receive from an outside source before opening them. This includes
• saving and scanning email attachments or web downloads rather than selecting the option to open them directly from the source
• scanning media, including CDs and DVDs, for viruses before opening any of the files

What happens if the software finds a virus?

Each package has its own method of response when it locates a virus, and the response may differ according to whether the software locates the virus during an automatic or a manual scan. Sometimes the software will produce a dialog box alerting you that it has found a virus and asking whether you want it to "clean" the file (to remove the virus). In other cases, the software may attempt to remove the virus without asking you first. When you select an anti-virus package, familiarize yourself with its features so you know what to expect.

Which software should you use?

There are many vendors who produce anti-virus software, and deciding which one to choose can be confusing. All anti-virus software performs the same function, so your decision may be driven by recommendations, particular features, availability, or price.

Installing any anti-virus software, regardless of which package you choose, increases your level of protection. Be careful, though, of email messages claiming to include anti-virus software. These messages, supposedly from your ISP's technical support department, contain an attachment that claims to be anti-virus software. However, the attachment itself is in fact a virus, so you could become infected by opening it .

How do you get the current virus information?

This process may differ depending what product you choose, so find out what your anti-virus software requires. Many anti-virus packages include an option to automatically receive updated virus definitions. Because new information is added frequently, it is a good idea to take advantage of this option. Resist believing email chain letters that claim that a well-known anti-virus vendor has recently detected the "worst virus in history" that will destroy your computer's hard drive. These emails are usually hoaxes.  You can confirm virus information through your anti-virus vendor or through resources offered by other anti-virus vendors.

While installing anti-virus software is one of the easiest and most effective ways to protect your computer, it has its limitations. Because it relies on signatures, anti-virus software can only detect viruses that have signatures installed on your computer, so it is important to keep these signatures up to date. You will still be susceptible to viruses that circulate before the anti-virus vendors add their signatures, so continue to take other safety precautions as well.

Understanding Firewalls

When anyone or anything can access your computer at any time, your computer is more susceptible to being attacked. You can restrict outside access to your computer and the information on it with a firewall.

What do firewalls do?

Firewalls provide protection against outside attackers by shielding your computer or network from malicious or unnecessary Internet traffic. Firewalls can be configured to block data from certain locations while allowing the relevant and necessary data through . They are especially important for users who rely on "always on" connections such as cable or DSL modems.

What type of firewall is best?

Firewalls are offered in two forms: hardware (external) and software (internal). While both have their advantages and disadvantages, the decision to use a firewall is far more important than deciding which type you use.

• Hardware - Typically called network firewalls, these external devices are positioned between your computer or network and your cable or DSL modem. Many vendors and some Internet service providers (ISPs) offer devices called "routers" that also include firewall features. Hardware-based firewalls are particularly useful for protecting multiple computers but also offer a high degree of protection for a single computer. If you only have one computer behind the firewall, or if you are certain that all of the other computers on the network are up to date on patches and are free from viruses, worms, or other malicious code, you may not need the extra protection of a software firewall. Hardware-based firewalls have the advantage of being separate devices running their own operating systems, so they provide an additional line of defense against attacks. Their major drawback is cost, but many products are available for less than $100 (and there are even some for less than $50).
• Software - Some operating systems include a built-in firewall; if yours does, consider enabling it to add another layer of protection even if you have an external firewall. If you don't have a built-in firewall, you can obtain a software firewall for relatively little or no cost from your local computer store, software vendors, or ISP. Because of the risks associated with downloading software from the Internet onto an unprotected computer, it is best to install the firewall from a CD or DVD. If you do download software from the Internet, make sure it is a reputable, secure website. Although relying on a software firewall alone does provide some protection, realize that having the firewall on the same computer as the information you're trying to protect may hinder the firewall's ability to catch malicious traffic before it enters your system.

How do you know what configuration settings to apply?

Most commercially available firewall products, both hardware- and software-based, come configured in a manner that is acceptably secure for most users. Since each firewall is different, you'll need to read and understand the documentation that comes with it to determine whether or not the default settings on your firewall are sufficient for your needs. Additional assistance may be available from your firewall vendor or your ISP (either from tech support or a website). Also, alerts about current viruses or worms  sometimes include information about restrictions you can implement through your firewall.

Unfortunately, while properly configured firewalls may be effective at blocking some attacks, don't be lulled into a false sense of security. Although they do offer a certain amount of protection, firewalls do not guarantee that your computer will not be attacked. In particular, a firewall offers little to no protection against viruses that work by having you run the infected program on your computer, as many email-borne viruses do. However, using a firewall in conjunction with other protective measures (such as anti-virus software and "safe" computing practices) will strengthen your resistance to attacks.

 

Coordinating Virus and Spyware Defense

Using anti-virus and anti-spyware software is an important part of cyber security. But in an attempt to protect yourself, you may unintentionally cause problems.

Isn't it better to have more protection?

Spyware and viruses can interfere with your computer's ability to process information or can modify or destroy data. You may feel that the more anti-virus and anti-spyware programs you install on your computer, the safer you will be. It is true that not all programs are equally effective, and they will not all detect the same malicious code. However, by installing multiple programs in an attempt to catch everything, you may introduce problems.

How can anti-virus or anti-spyware software cause problems?

It is important to use anti-virus and anti-spyware software. But too much or the wrong kind can affect the performance of your computer and the effectiveness of the software itself.

Scanning your computer for viruses and spyware uses some of the available memory on your computer. If you have multiple programs trying to scan at the same time, you may limit the amount of resources left to perform your tasks. Essentially, you have created a denial of service against yourself. It is also possible that in the process of scanning for viruses and spyware, anti-virus or anti-spyware software may misinterpret the virus definitions of other programs. Instead of recognizing them as definitions, the software may interpret the definitions as actual malicious code. Not only could this result in false positives for the presence of viruses or spyware, but the anti-virus or anti-spyware software may actually quarantine or delete the other software.

How can you avoid these problems?

• Investigate your options in advance - Research available anti-virus and anti-spyware software to determine the best choice for you. Consider the amount of malicious code the software recognizes, and try to find out how frequently the virus definitions are updated. Also check for known compatibility issues with other software you may be running on your computer.
• Limit the number of programs you install - Many vendors are now releasing packages that incorporate both anti-virus and anti-spyware capabilities together. However, if you decide to choose separate programs, you really only need one anti-virus program and one anti-spyware program. If you install more, you increase your risk for problems.
• Install the software in phases - Install the anti-virus software first and test it for a few days before installing anti-spyware software. If problems develop, you have a better chance at isolating the source and then determining if it is an issue with the software itself or with compatibility.
• Watch for problems - If your computer starts processing requests more slowly, you are seeing error messages when updating your virus definitions, your software does not seem to be recognizing malicious code, or other issues develop that cannot be easily explained, check your anti-virus and anti-spyware software.

Debunking Some Common Myths There are some common myths that may influence your online security practices. Knowing the truth will allow you to make better decisions about how to protect yourself. How are these myths established? There is no one cause for these myths. They may have been formed because of a lack of information, an assumption, knowledge of a specific case that was then generalized, or some other source. As with any myth, they are passed from one individual to another, usually because they seem legitimate enough to be true. Why is it important to know the truth? While believing these myths may not present a direct threat, they may cause you to be more lax about your security habits. If you are not diligent about protecting yourself, you may be more likely to become a victim of an attack. What are some common myths, and what is the truth behind them? Myth: Anti-virus software and firewalls are 100% effective.  Truth: Anti-virus software and firewalls are important elements to protecting your information.  However, neither of these elements are guaranteed to protect you from an attack. Combining these technologies with good security habits is the best way to reduce your risk. Myth: Once software is installed on your computer, you do not have to worry about it anymore.  Truth: Vendors may release patches or updated versions of software to address problems or fix vulnerabilities. You should install the patches as soon as possible; some software even offers the option to obtain updates automatically. Making sure that you have the latest virus definitions for your anti-virus software is especially important. Myth: There is nothing important on your machine, so you do not need to protect it.  Truth: Your opinion about what is important may differ from an attacker's opinion. If you have personal or financial data on your computer, attackers may be able to collect it and use it for their own financial gain. Even if you do not store that kind of information on your computer, an attacker who can gain control of your computer may be able to use it in attacks against other people (see Understanding Denial-of-Service Attacks and Understanding Hidden Threats: Rootkits and Botnets for more information). Myth: Attackers only target people with money.  Truth: Anyone can become a victim of identity theft. Attackers look for the biggest reward for the least amount of effort, so they typically target databases that store information about many people. If your information happens to be in the database, it could be collected and used for malicious purposes. It is important to pay attention to your credit information so that you can minimize any potential damage. Myth: When computers slow down, it means that they are old and should be replaced.  Truth: It is possible that running newer or larger software programs on an older computer could lead to slow performance, but you may just need to replace or upgrade a particular component (memory, operating system, CD or DVD drive, etc.). Another possibility is that there are other processes or programs running in the background. If your computer has suddenly become slower, you may be experiencing a denial-of-service attack or have spyware on your machine.

Good Security Habits

There are some simple habits you can adopt that, if performed consistently, may dramatically reduce the chances that the information on your computer will be lost or corrupted.

How can you minimize the access other people have to your information?

You may be able to easily identify people who could, legitimately or not, gain physical access to your computer—family members, roommates, co-workers, members of a cleaning crew, and maybe others. Identifying the people who could gainremote access to your computer becomes much more difficult. As long as you have a computer and connect it to a network, you are vulnerable to someone or something else accessing or corrupting your information; however, you can develop habits that make it more difficult.

• Lock your computer when you are away from it. Even if you only step away from your computer for a few minutes, it's enough time for someone else to destroy or corrupt your information. Locking your computer prevents another person from being able to simply sit down at your computer and access all of your information.
• Disconnect your computer from the Internet when you aren't using it. The development of technologies such as DSL and cable modems have made it possible for users to be online all the time, but this convenience comes with risks. The likelihood that attackers or viruses scanning the network for available computers will target your computer becomes much higher if your computer is always connected. Depending on what method you use to connect to the Internet, disconnecting may mean disabling a wireless connection, turning off your computer or modem, or disconnecting cables. When you are connected, make sure that you have a firewall enabled.
• Evaluate your security settings. Most software, including browsers and email programs, offers a variety of features that you can tailor to meet your needs and requirements. Enabling certain features to increase convenience or functionality may leave you more vulnerable to being attacked. It is important to examine the settings, particularly the security settings, and select options that meet your needs without putting you at increased risk. If you install a patch or a new version of the software, or if you hear of something that might affect your settings, reevaluate your settings to make sure they are still appropriate.

What other steps can you take?

Sometimes the threats to your information aren't from other people but from natural or technological causes. Although there is no way to control or prevent these problems, you can prepare for them and try to minimize the damage.

• Protect your computer against power surges and brief outages. Aside from providing outlets to plug in your computer and all of its peripherals, some power strips protect your computer against power surges. Many power strips now advertise compensation if they do not effectively protect your computer. Power strips alone will not protect you from power outages, but there are products that do offer an uninterruptible power supply when there are power surges or outages. During a lightning storm or construction work that increases the odds of power surges, consider shutting your computer down and unplugging it from all power sources.
• Back up all of your data. Whether or not you take steps to protect yourself, there will always be a possibility that something will happen to destroy your data. You have probably already experienced this at least once— losing one or more files due to an accident, a virus or worm, a natural event, or a problem with your equipment. Regularly backing up your data on a CD or network reduces the stress and other negative consequences that result from losing important information (see Real-World Warnings Keep You Safe Online for more information). Determining how often to back up your data is a personal decision. If you are constantly adding or changing data, you may find weekly backups to be the best alternative; if your content rarely changes, you may decide that your backups do not need to be as frequent. You don't need to back up software that you own on CD-ROM or DVD-ROM—you can reinstall the software from the original media if necessary.

Safeguarding Your Data

When there are multiple people using your computer and/or you store sensitive personal and work-related data on your computer, it is especially important to take extra security precautions.

Why isn't "more" better?

Maybe there is an extra software program included with a program you bought. Or perhaps you found a free download online. You may be tempted to install the programs just because you can, or because you think you might use them later. However, even if the source and the software are legitimate, there may be hidden risks. And if other people use your computer, there are additional risks.

These risks become especially important if you use your computer to manage your personal finances (banking, taxes, online bill payment, etc.), store sensitive personal data, or perform work-related activities away from the office. However, there are steps you can take to protect yourself.

How can you protect both your personal and work-related data?

• Use and maintain anti-virus software and a firewall - Protect yourself against viruses and Trojan horses that may steal or modify the data on your own computer and leave you vulnerable by using anti-virus software and a firewall. Make sure to keep your virus definitions up to date.
• Regularly scan your computer for spyware - Spyware or adware hidden in software programs may affect the performance of your computer and give attackers access to your data. Use a legitimate anti-spyware program to scan your computer and remove any of these files. Many anti-virus products have incorporated spyware detection.
• Keep software up to date - Install software patches so that attackers cannot take advantage of known problems or vulnerabilities . Many operating systems offer automatic updates. If this option is available, you should turn it on.
• Evaluate your software's settings - The default settings of most software enable all available functionality. However, attackers may be able to take advantage of this functionality to access your computer. It is especially important to check the settings for software that connects to the internet (browsers, email clients, etc.). Apply the highest level of security available that still gives you the functionality you need.
• Avoid unused software programs - Do not clutter your computer with unnecessary software programs. If you have programs on your computer that you do not use, consider uninstalling them. In addition to consuming system resources, these programs may contain vulnerabilities that, if not patched, may allow an attacker to access your computer.
• Consider creating separate user accounts - If there are other people using your computer, you may be worried that someone else may accidentally access, modify, and/or delete your files. Most operating systems (including Windows XP and Vista, Mac OS X, and Linux) give you the option of creating a different user account for each user, and you can set the amount of access and privileges for each account. You may also choose to have separate accounts for your work and personal purposes. While this approach will not completely isolate each area, it does offer some additional protection. However, it will not protect your computer against vulnerabilities that give an attacker administrative privileges. Ideally, you will have separate computers for work and personal use; this will offer a different type of protection.
• Establish guidelines for computer use - If there are multiple people using your computer, especially children, make sure they understand how to use the computer and internet safely. Setting boundaries and guidelines will help to protect your data.
• Use passwords and encrypt sensitive files - Passwords and other security features add layers of protection if used appropriately (see Choosing and Protecting Passwords and Supplementing Passwords for more information). By encrypting files, you ensure that unauthorized people can't view data even if they can physically access it. You may also want to consider options for full disk encryption, which prevents a thief from even starting your laptop without a passphrase. When you use encryption, it is important to remember your passwords and passphrases; if you forget or lose them, you may lose your data.
• Follow corporate policies for handling and storing work-related information - If you use your computer for work-related purposes, make sure to follow any corporate policies for handling and storing the information. These policies were likely established to protect proprietary information and customer data, as well as to protect you and the company from liability. Even if it is not explicitly stated in your corporate policy, you should avoid allowing other people, including family members, to use a computer that contains corporate data.
• Dispose of sensitive information properly - Simply deleting a file does not completely erase it. To ensure that an attacker cannot access these files, make sure that you adequately erase sensitive files
• Follow good security habits - Review other security tips for ways to protect yourself and your data.

--------

Real-World Warnings Keep You Safe Online

Many of the warning phrases you probably heard from your parents and teachers are also applicable to using computers and the internet.

Why are these warnings important?

Like the real world, technology and the internet present dangers as well as benefits. Equipment fails, attackers may target you, and mistakes and poor judgment happen. Just as you take precautions to protect yourself in the real world, you need to take precautions to protect yourself online. For many users, computers and the internet are unfamiliar and intimidating, so it is appropriate to approach them the same way we urge children to approach the real world.

What are some warnings to remember?

• Don't trust candy from strangers - Finding something on the internet does not guarantee that it is true. Anyone can publish information online, so before accepting a statement as fact or taking action, verify that the source is reliable. It is also easy for attackers to "spoof" email addresses, so verify that an email is legitimate before opening an unexpected email attachment or responding to a request for personal information
• If it sounds too good to be true, it probably is - You have probably seen many emails promising fantastic rewards or monetary gifts. However, regardless of what the email claims, there are not any wealthy strangers desperate to send you money. Beware of grand promises—they are most likely spam, hoaxes, or phishing schemes. Also be wary of pop-up windows and advertisements for free downloadable software—they may be disguising spyware
• Don't advertise that you are away from home - Some email accounts, especially within an organization, offer a feature (called an autoresponder) that allows you to create an "away" message if you are going to be away from your email for an extended period of time. The message is automatically sent to anyone who emails you while the autoresponder is enabled. While this is a helpful feature for letting your contacts know that you will not be able to respond right away, be careful how you phrase your message. You do not want to let potential attackers know that you are not home, or, worse, give specific details about your location and itinerary. Safer options include phrases such as "I will not have access to email between [date] and [date]." If possible, also restrict the recipients of the message to people within your organization or in your address book. If your away message replies to spam, it only confirms that your email account is active. This may increase the amount of spam you receive
• Lock up your valuables - If an attacker is able to access your personal data, he or she may be able to compromise or steal the information. Take steps to protect this information by following good security practices . Some of the most basic precautions include locking your computer when you step away; using firewalls, anti-virus software, and strong passwords; installing appropriate patches; and taking precautions when browsing or using email.
• Have a backup plan - Since your information could be lost or compromised (due to an equipment malfunction, an error, or an attack), make regular backups of your information so that you still have clean, complete copies (seeGood Security Habits for more information). Backups also help you identify what has been changed or lost. If your computer has been infected, it is important to remove the infection before resuming your work (see Recovering from Viruses, Worms, and Trojan Horses for more information). Keep in mind that if you did not realize that your computer was infected, your backups may also be compromised.

Keeping Children Safe Online

Children present unique security risks when they use a computer—not only do you have to keep them safe, you have to protect the data on your computer. By taking some simple steps, you can dramatically reduce the threats.

What unique risks are associated with children?

When a child is using your computer, normal safeguards and security practices may not be sufficient. Children present additional challenges because of their natural characteristics: innocence, curiosity, desire for independence, and fear of punishment. You need to consider these characteristics when determining how to protect your data and the child.

You may think that because the child is only playing a game, or researching a term paper, or typing a homework assignment, he or she can't cause any harm. But what if, when saving her paper, the child deletes a necessary program file? Or what if she unintentionally visits a malicious web page that infects your computer with a virus? These are just two possible scenarios. Mistakes happen, but the child may not realize what she's done or may not tell you what happened because she's afraid of getting punished.

Online predators present another significant threat, particularly to children. Because the nature of the internet is so anonymous, it is easy for people to misrepresent themselves and manipulate or trick other users. Adults often fall victim to these ploys, and children, who are usually much more open and trusting, are even easier targets. The threat is even greater if a child has access to email or instant messaging programs, visits chat rooms, and/or uses social networking sites

What can you do?

• Be involved - Consider activities you can work on together, whether it be playing a game, researching a topic you had been talking about (e.g., family vacation spots, a particular hobby, a historical figure), or putting together a family newsletter. This will allow you to supervise your child's online activities while teaching her good computer habits.
• Keep your computer in an open area - If your computer is in a high-traffic area, you will be able to easily monitor the computer activity. Not only does this accessibility deter a child from doing something she knows she's not allowed to do, it also gives you the opportunity to intervene if you notice a behavior that could have negative consequences.
• Set rules and warn about dangers - Make sure your child knows the boundaries of what she is allowed to do on the computer. These boundaries should be appropriate for the child's age, knowledge, and maturity, but they may include rules about how long she is allowed to be on the computer, what sites she is allowed to visit, what software programs she can use, and what tasks or activities she is allowed to do. You should also talk to children about the dangers of the internet so that they recognize suspicious behavior or activity. The goal isn't to scare them, it's to make them more aware.
• Monitor computer activity - Be aware of what your child is doing on the computer, including which web sites she is visiting. If she is using email, instant messaging, or chat rooms, try to get a sense of who she is corresponding with and whether she actually knows them.
• Keep lines of communication open - Let your child know that she can approach you with any questions or concerns about behaviors or problems she may have encountered on the computer.
• Consider partitioning your computer into separate accounts - Most operating systems (including Windows XP, Mac OS X, and Linux) give you the option of creating a different user account for each user. If you're worried that your child may accidentally access, modify, and/or delete your files, you can give her a separate account and decrease the amount of access and number of privileges she has.

If you don't have separate accounts, you need to be especially careful about your security settings. In addition to limiting functionality within your browser (see Evaluating Your Web Browser's Security Settings for more information), avoid letting your browser remember passwords and other personal information (see Browsing Safely: Understanding Active Content and Cookies). Also, it is always important to keep your virus definitions up to date (seeUnderstanding Anti-Virus Software).

• Consider implementing parental controls - You may be able to set some parental controls within your browser. For example, Internet Explorer allows you to restrict or allow certain web sites to be viewed on your computer, and you can protect these settings with a password. To find those options, click Tools on your menu bar, select Internet Options..., choose the Content tab, and click the Enable... button under Content Advisor.

There are other resources you can use to control and/or monitor your child's online activity. Some ISPs offer services designed to protect children online. Contact your ISP to see if any of these services are available. There are also special software programs you can install on your computer. Different programs offer different features and capabilities, so you can find one that best suits your needs. The following web sites offer lists of software, as well as other useful information about protecting children online:

• GetNetWise - http://kids.getnetwise.org/ - Click Tools for Families to reach a page that allows you to search for software based on characteristics like what the tool does and what operating system you have on your computer.
• Yahooligans! Parents' Guide - http://yahooligans.yahoo.com/parents/ - Click Blocking and Filtering underRelated Websites on the left sidebar to reach a list of software.

Read More