Archive Page 3

Browser Wars

Firefox LogoWhat web browser do you use?  If you’re like over 60% of the population (as of May), you probably use Internet Explorer, most likely because it comes with Windows.  There are a number of other choices out there, and they all have things to offer that IE does not.

What does this have to do with security?  Well, for starters, Windows includes Internet Explorer with the base operating system.  Because of the way the components of IE are tied to the components of Windows, Microsoft successfully argued to the antitrust courts that it was impossible to truly uninstall IE.  Sure, as a result of those antitrust proceedings you can have a different browser as your default, but IE is still there, hiding in the background.  Because of this collusion between IE and Windows, I believe IE has an easier path into the operating system in the event of a security breach.  What I mean by this is that a malicious website that exploits a vulnerability in IE is more likely to break through into Windows itself, as opposed to a similar vulnerability in a browser that is simply installed on top of the operating system.

My browser of choice is Mozilla Firefox.  There are many reasons for this.  First of all, in my experience it loads pages considerably faster, and crashes less often.  Second, it is extremely customizable.  You can load different themes to totally change the look and feel of the browser, and you can install add-on applications that perform different tasks to make the browser more useful to you.  Since you can choose which add-ons you install, your browser can become very personalized.

NoScript LogoAgain, what does this have to do with security?  A lot of these add-ons are used to enhance the security of an already reasonably secure browser.  For instance, I use an add-on to block advertisements, which can prevent certain malicious pop-ups from loading.  My favorite add-on is known as NoScript, which is an amazing tool if you can deal with how it breaks certain sites.  NoScript effectively disables all scriptable components of any website, include Javascript and ActiveX.  Without scripts, it is practically impossible to have a malicious site compromise Firefox.  Of course, many sites use these scripts to provide basic functionality – YouTube, for instance.  The point is you can pick and choose which sites you want to enable scripts on, and any other site will be script-less the first time you visit it. Play around with it, I’m sure you’ll get to enjoy the feeling of only allowing sites to run scripts that you specify.

 What’s your choice for the most secure browser?  Let me know in the comments.

Finally – The A in CIA

The Happy CustomerLadies and gentlemen, we’ve arrived at the A in our CIA acronym. As a review, C=Confidentiality and I=Integrity. Can you guess what the A might mean? Here’s a hint: Remember the last time you went to the ATM with your hot date and you had no money? What was that embarrassing message that the machine seemed all to quick to tell you in front of your now very cool date? No funds _______. If you said “available”, you’re the genius that you think you are (okay, maybe dateless, but take the compliment anyway).

For computer systems, the availability of information is paramount. When information isn’t available productivity can be affected, possibly costing the company money and more then a few angry customers. Therefore, information must be reliable and accessible in a timely fashion so that tasks and responsibilities won’t be impeded.

Let’s say, in our date scenario above, you decide to call the bank to find out what’s going on with your account. The teller would like to help you, but she can’t access the database for one reason or another. In this example, not only does the bank have an embarrassed customer, but now a mad one too.

Unfortunately, most of us have experienced a time when we needed information and it wasn’t available. That’s why it’s critical that mechanisms (which we’ll discuss later) are put in place to ensure the availability of resources to maintain productivity and to keep those customers happy.

Integrity and Computers – Say What?

Picture of man and computerOkay, think of the biggest weasel you’ve ever worked with. Okay, calm down. I can detect your blood boiling. Take a deep breath. Now, think of why s/he’s such a weasel. I detect another deep breath is in order here. If one quality that they lack is integrity, then you’ve already identified the second term in our CIA acronym that we’re going to discuss today – although I’ll bet many other words came to mind first.

Now I know you’re saying what in the world does integrity have to do with computers. I’m sure you must be thinking that my computer, at its worst, could never be as terrible as that *&*^% weasel. Well, when our computer systems lack integrity, the accuracy and reliability of the data stored on them is much like that weasel that you work with – unreliable. When there’s no integrity with our computer systems, unauthorized modification of data isn’t prevented. And as a result, data can end up in unintended destinations, often contaminated, corrupted and maliciously modified.

As an example, let’s say that that weasel accidentally made a mistake in a database entry and charged a customer $50,000 for a bill instead of $50… and tried to creatively blame you. Thanks to that weasel, (or too bad for you if s/he’s convincing) the data is now corrupted. The customer has now been inconvenienced by having to straighten out this error. And now your job might be on the line – but of course you’ll go into Soprano mode and prevent that from happening.

When hardware and software don’t work in a concerted effort to maintain the accuracy and reliability of data, trouble ensues. And while later on we’ll uncover ways to harden systems and educate/train users on ways to avoid such costly errors, for now, just note that integrity is critical to making sure that the correct data ends up in the correct destination.

Your computer needs updating

Windows LogoDo you update your computer regularly?  Surprisingly, many people don’t.  Whether you are using Windows, Macintosh, or Linux, it’s important to update your system often.  Every software vendor releases updates to their system, whether for compatibility or security reasons.  When one of these updates is released, it clues everyone into the fact that there may be a bug in the system, so it’s in your best interest to make sure you get that bug fixed before someone has a chance to use it against you.

For Windows users, if you are running Windows XP or later, you should be using Automatic Updates.  Automatic Updates is a feature that allows you to configure Windows to automatically download (and optionally install) any new security updates that Microsoft releases.  I personally have chosen to configure it to download the updates automatically and then prompt me when they are ready to install, so I can choose to install them at a convenient time.  You may also choose to have the updates downloaded and installed automatically, but that may cause you to lose data if you leave your computer with applications open and Windows tries to restart after applying the updates.

If you prefer to have more control over the updates Microsoft is sending your computer, you can choose to use the Windows Update site.  Here you can pick and choose what updates you want to install – but I recommend you install anything Microsoft considers a “Critical Update.”  You can also find updates that have nothing to do with security, such as new versions of Windows Media Player.  Windows Update is also the method you should use if you have an older version of Windows.

If you want to be even more comprehensive with your updates, go to Microsoft Update.  This site includes everything you get from Windows Update, but also adds updates to other Microsoft Applications besides Windows, such as Microsoft Office.  Don’t forget that any software, not just your operating system, can have problems, so be sure to update them as well.

Speaking of which, pay attention to what other applications are loaded on your computer.  Almost every computer has a Java client installed. Java is often the target of security researches, and consequently is updated frequently.  Fortunately, if you have a recent version of Java, it should prompt you to download and install the latest version whenever there is an update.

Your antivirus program is probably configured to download new virus definitions on a regular basis, but does it ever update the program itself?  Some do, but others require you to manually perform updates.  I will try to put together a post on the methods to update AV programs in the near future.

Well, this post ran a little longer than I expected it to, so I’ll have to give you the methods for updating Macintosh and Linux systems another day.  Hopefully this gives you a little more information on the methods to update your Windows System.

Keeping Those Secrets

Young lady looking into computer Last time we met, I asked you to remember a short acronym. Do you recall? No, well here’s a hint: There’s an intelligence agency with the same acronym? If you said CIA, muy bien! If not, you’re the recipient of Colbert’s Tip of the Hat – Wag of the Finger. And if you don’t know what that means, then unfortunately my friend, you’re probably missing out on one of TV’s wittiest and funniest shows.

Now, let’s proceed. Can you recall the last time that you told someone something in confidence,hoping that they’d honor your request not to go blabbering to the world? How far would you go to prevent them from disclosing your deep dark secret? Soprano fans, please don’t answer.

In the world of computer security, confidentiality is critical. It’s one third of the triad known as C-I-A. We’ll soon discuss the other two. Without it, all kinds of information that should be kept confidential is now unleashed, as if from the mouth of your blabbering friend. For example, some of those secrets can be a company’s trade secrets, marketing plans, credit card information, or your grandma’s secret family recipe.

Whatever that information is, it’s valuable and its disclosure can ruin a company’s productivity and profitability, raise the possibility of legal and liability issues, not to mention your grandma possibly disowning you.

Of course, sometimes we honestly disclose information that we didn’t know was confidential, but this doesn’t change the fact that information that should have remained secret is now exposed. This is why valuable information must be safeguarded while it resides on systems, while in transit and once it reaches its final destination. And yet with all the efforts made to maintain this confidentiality, there are still those who manage to obtain sensitive information. We’ll investigate these efforts later.

So, to wrap up, keep in mind that confidentiality is the means to prevent the unauthorized disclosure of resources and data. Think of it as efforts to ensure that information remains confidential, like keeping your friend’s trap shut and hopefully preventing your grandma from kicking you out of the family.

Computer Security and Why You Should Care

Picture of computer with lockSeeing too many pizza commercials on TV yesterday, I finally succumbed to the advertisements and made a quick phone call to Dominos (advertising is indeed powerful). Usually when I call them, I’m on and off the phone in about 2 minutes. Not so today. I was put on hold for about 4 minutes. Very unusual. Afterwards, the employee gets on the phone, asks me for my order and then has to put me on hold again because the computer was slow. He apologized and finally said, “Ya know, computers are great, except when they’re not working.” True, but what about my pizza? Thankfully, my order was entered and I got my wonderful pizza while still trying to figure out how Sanjaya from American Idol made it as long as he did! Oh well. Some things we’ll never know. But I digress.

I use that example above because most of us use our computers with an expectation that everything will work fine. While we’re busy emailing co-workers or friends or enjoying the wonderful world of blogging, once we click that ’send’ button or that ‘publish’ button, we expect our information to be sent, in tact, to the recipient, with no problem. Right? Well, as we know, sometimes there are hiccups in the process and things just don’t go as we’d like.

This got me thinking about the use of computers in our lives and how many of us rely on them for our everyday activities. According to the Computer Industry Almanac, in 2005, there were 1.08 billion people online. Projections for 2010 are a staggering 1.8 billion. This means more people, more activity and an increasing need for more security. Security for what? Security from whom – you ask? We shall see.
Continue reading ‘Computer Security and Why You Should Care’

(The Myth of) Privacy at Work

Personal PrivacyDo you spend much time at work browsing personal sites, such as shopping or online banking? Do you check your personal email while at work? Not only is this usually against the corporate policies at most companies, you are putting yourself at risk by doing so.

Many people incorrectly assume that they have an expectation of privacy while using “their” computer at work. This can vary from state to state and country to country, but in most places, any activity on company-owned equipment is subject to review and monitoring by the company. This activity can include emails, web traffic, and any documents saved on company equipment.

Aside from the legitimate monitoring that your employer may be performing, there are other reasons why you should avoid using your work computer for personal purposes. Your computer is not an island. In most cases, your computer will be on the same network as a number of your coworkers. Being part of the same network means that one of your coworkers could potentially access data stored on your computer, or capture your web and email traffic as it traverses the network. While this scenario is somewhat unlikely, on many corporate networks there are few controls in place to prevent this, and little to warn you if this is occurring.

Your work computer is intended for just that; work-related activities. Save your personal web browsing and email for times when you are on a trusted computer, such as your home computer. In most cases, your personal information will be far safer there than at work.

The dangers of Autorun

Windows Logo

Autorun is a feature of Windows that has been around since the Windows 95 days. Autorun is one of those features Microsoft “borrowed” from the Mac to make Windows more user-friendly. In case you are not aware of what Autorun actually does, when you insert a CD, or a USB hard drive or flash drive, Windows will perform one of two actions, depending on whether a certain file is present on the CD or drive.

The first option is that Windows will find a file on the drive called autorun.inf. This file contains instructions for Windows to perform when it detects this media has been inserted into the system, such as a program to run. Some of you may already realize why this is a problem, but I’ll get to that in a minute.

The second option is that Windows doesn’t find an autorun.inf file. Windows will then scan the drive and pop up with a dialog box asking you which action you want to take, such as viewing the files, launching Media Player to play music or video files found on the drive, or viewing pictures found as a slideshow.

The first option is a serious security risk. Why? Because with Autorun enabled, Windows will automatically, and without prompting you, launch whatever program is specified in autorun.inf. This program could be a virus, a keylogger, or any number of equally dangerous programs. One recent application of this method is known as podslurping. Podslurping is the simple process of taking an iPod with a specially configured autorun.inf file, and plugging it into an unsuspecting system that has Autorun enabled. The program that is executed automatically searches the drive for files “of interest,” such as Word docs, Excel spreadsheets, and Powerpoint presentations, and copies them to the iPod. It does this silently and quickly, and allows the owner of the iPod (or podslurper?) to walk away with valuable information without attracting much suspicion.

So what can you do to nullify the insidious nature of Autorun? You have a few options. The first, which is a bit too much of a manual process for me, would be to hold down the “shift” key on your keyboard whenever you insert a CD or USB storage device. This would not prevent someone else from podslurping when you are away from your desk, however. The method I prefer is a registry change to disable Autorun for good. Here are the instructions from Annoyances.org:

Windows 2000/XP

  • Run the Registry Editor (REGEDIT.EXE).
  • Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom.
  • Double-click the Autorun value, and type 0 for its value. (If it’s not there, create it by selecting Edit -> New -> DWORD Value, and typing “Autorun” for its name.)
  • You may have to log out and then log back in for this change to take effect.

For other methods of disabling Autorun, and for older operating systems such as Windows 98, go to http://www.annoyances.org/exec/show/article03-018.

Where do you keep your passwords?

Keepass logo

OK, I’m starting to get repetitive with these password posts, but I promised in my last post that I would mention some ways to keep track of all your passwords.

As you probably know already, the less places you share your passwords between, the more secure you are. So, the most secure way to manage passwords is to never repeat them. So, if you have accounts on 15 different websites, and 5 different computers, and you have security in mind, you should have twenty different passwords you use on a regular or occasional basis, and you should be changing those passwords regularly (hopefully quarterly, or semi-annually at least).

At best, I think I can probably keep track of around 8-10 passwords at a time, and even then I start to confuse them, and have to try a few passwords on some sites before I get it right. I hold very little hope of remembering 20 passwords for very long. In fact, between personal and work-related accounts, I probably have closer to 40 or 50 passwords to manage.

So how do I keep track of my passwords? I write them on a yellow Post-It note and tape it to my monitor, of course.  That’s secure, isn’t it?  Well, if I wanted to be a little more diligent about keeping my passwords secure, I would use a tool such as KeePass Password Safe.

KeePass is a secure database for your passwords.  It is also Open Source, and free to download and use.  It allows you to create groups for your passwords so you can be more organized, and it also allows you to enter in the address of any website you have an account on, and auto-type the username and password when you load the site.  The entire database is encrypted using standard algorithms such as AES, TwoFish, or Rijndael.  You can also use either a password, a key file (stored on a USB key or hard drive), or a combination of the two to restrict access to the database.

I highly recommend this tool as a way to keep track of your passwords in a secure manner.  And since it’s free, you don’t have to spend any money to try it out and see if it works for you.  Check it out here, KeePass Password Safe 

EndPointScan, check all your computers for connected devices

GFIThis is a sponsored review of EndPointScan.

We already talked about how to lock down the USB ports. This is not always possible, so, at least a good way to know what devices are or have been connected to the computers in our network is needed.

This is what EndPointScan provides. With an easy and simple installation, this application allows to specify a list of computers from our network that will be scanned. The only thing we will need to do is going to EndPoint Security site and click on Scan my network.

For this, we will need Internet Explorer, as this is an ActiveX control which will be downloaded and executed locally. Once we have executed it, it will provide a detailed report of the devices that have been connected to the computers: iPods, external harddisks, floppy drives,…

EndPointScan

Not only this, but it also will tell us the threat level of each device and the computer risk level, so we know where we should concentrate on.

It requires Windows 2000, XP or 2003 and administrator rights in the computer. Using it is completely free, so there’s no harm in trying it to see if it works for you.