Specifications
47
20.3 Software Security Patches
Microsoft provides a convenient way to install the latest security patches with Windows Update. As with
anti virus software it is important to get the latest updates. Once vulnerability is discovered information is
quickly distributed on the web. The best insurance is the latest patch.
20.4 Spyware
Companies find every more clever ways to obtain information about customers. This has led to a technique
called spyware. Spyware gets installed with many applications and sends information about usage back to
the company. The application periodically contacts the company to send information about user activity.
Another method is a 1-pixel tag in HTML To render the tag the browser must connect to the link,
depending on the ID of the tag the company is able to learn if and when you access the page. More
worrisome are programs such as Real Jukebox that reports which songs were played.
It is possible to configure the firewall to block access to specific sites, but often time’s spyware connects to
sites that you frequent and cannot restrict access. Some personal software firewalls such as Zone Alarm
monitor both incoming and outgoing traffic by application. This allows the user to specify what to allow
into and out of the PC.
Gibson Research created a spyware removal tool called OptOut. That is no longer supported and has been
taken over by Lavasoft Ad-Aware. This program searches for know spyware programs and browser
cookies, allowing the user to remove them.
20.5 Configuration
To make configuration easier most programs and operating systems use default settings. Check these
carefully to make sure they do not compromise system integrity.
Windows Configuration Tips:
Disable VB scripting
By default each network interface is bound to all services. Make sure any machine that has direct
access to the Internet does not have File and Print Sharing” bound to the interface used to access
the Internet
Change passwords and account names, do not use defaults.
Write down user names and passwords and store them in a safe and secure location away from the
computer so you have access when you forget them. Don’t worry you will forget them.
Don’t run public servers on your LAN, let the hosting service do it
Don’t allow use of modems in networked machines. They are a potential backdoor to your LAN
20.6 Social Engineering
Sad to say many security breaches are not the result of compromising technical security barriers. They
result from individuals inadvertently giving out privileged information.
Security Tips
No reputable entity will ever ask you for your password. If there is a problem with the password
you may be issued a new one but you will never be asked to give someone your password.
Limit the amount of personal information you divulge. You need to disclose enough information
to conduct the transaction that is all. Often times you can operate under an alias such as in chat
rooms and forums.
The web makes it easy to download and install software. You have no way of knowing if it is safe.
Just because you are running antiviral software is no guarantee. It is possible to get infected before
the antiviral program is updated.