|
Getting
|
|
Introduction to Digital Self-Defense
Computers at the Rochester Institute of Technology come in all shapes and sizes. Regardless of the type of computer or operating system, there are basic concepts and practices that are essential to protect you and your computer as well as other network users at RIT and Internet users around the world. These fundamentals apply regardless of your particular hardware or operating system. Most are required for access to the RIT network under the Code of Conduct for Computer and Network Use (http://www.rit.edu/computerconduct/).
1. Patch your operating system
This is probably the single most important step you can take towards
securing your computer on the RIT network. Attackers are continually
probing and testing for vulnerabilities in applications and operating
systems which could allow them to gain control over your computer. When
a vulnerability is found, software developers release a patch that will
fix the vulnerability, which can be downloaded and installed free of
charge.
Unpatched systems are targets for attackers, and many forms of malicious software (like worms and spyware) use these vulnerabilities to install themselves on your computer. Leaving a system unpatched threatens not only your personal data, but also potentially provides attackers with a platform for launching remote attacks on other computers. Don't become a victim or allow your computer to be used to victimize others!
- Check for patches (Windows) - Go to the Microsoft update website (http://www.windowsupdate.com)
- Check for patches (Mac) - Run software update
2. Choose a secure password and change it frequently
The
FBI and the SANS Institute cite weak passwords as one of the most
critical security threats to networks. Users who leave passwords blank
or use easily guessed words make it simple for attackers to log into a
network and access information. Additionally, some Internet worms have
the ability to "guess" weak passwords and password "cracking" tools are
widely available.
Your password can always be changed using the ITS password utility at http://start.rit.edu for your RIT account (formerly known as DCE).
In order to keep user accounts secure, the RIT Password Standard requires that passwords for the accounts of users and administrators on RIT computing and network resources must:
- Be at least 8 characters long
- Contain both upper and lower case letters and at least one number
- Not be reused (repeated) for at least 6 changes of password
- Be changed every 120 days
- Be a single word, forward or backward, in any language
- Include numbers such as a social security number, birthday, or anniversary date
- Be consecutive numbers or letters
- Contain more than two consecutive repeating characters
- Contain your address or any other information someone could look up about you
- Contain any form of the username or ID
- Be the same as passwords used in other non-RIT situations (such as home computers), applications, or web pages
- Be shared with anyone for any reason
http://security.rit.edu/articles/securepassword.pdf
http://security.rit.edu/faqs/faqs_password.pdf
3. Install Anti-Virus and Anti-Spyware software for weekly scans.
ITS provides free, licensed copies of McAfee AntiVirus for Windows and Virex for Macintosh at no cost. Go to the ITS download page
to download the software and installation instructions. Although it is
true that UNIX and Linux users are less likely to become infected by a
virus or worm, Linux and UNIX systems are still vulnerable to a number
of different forms of malware including rootkits and keyloggers. The
Information Security Office suggests using ClamAV, an open source anti-virus program to prevent system compromise by such means.
Once the software is installed, check for new virus definition updates
on a daily basis. These definitions show your anti-virus program how to
detect and remove new viruses from your computer. Updating your
definitions is a very quick process, and without updates your computer
is vulnerable to the newest (and potentially most dangerous) viruses!
For more details, refer to: http://www.rit.edu/its/services/security.
Viruses aren't the only form of malware you have to worry about these
days - adware and spyware are becoming a major headache for computer
users around the world. Adware and spyware can pop-up advertisements,
slow down your computer, collect personal information about you and
severely damage your computer if left unchecked. Install at least two
anti-spyware programs and run a scan once a week to make sure your
computer is clean.
Currently, Mac and Linux users are relatively safe from
spyware problems - so there aren't any anti-spyware programs to
download. However, for Windows users, the Information Security Office
suggests downloading both Spybot: Search & Destroy and Ad-Aware Personal Edition.
Both are free for personal use, and in combination will remove any
spyware problems. Just like anti-virus, be sure to keep the definitions
up to date before running a scan!
4. Running a Firewall
Think of a firewall like a
gatekeeper between you and the Internet...it allows some programs to
send and receive information from the Internet, and denies others. By
denying access to certain vulnerable programs from the outside,
firewalls can keep some attackers and worms out. By preventing some
programs from sending information out to the Internet, firewalls can
help protect your privacy. While firewalls may sound like the perfect
security solution, they can't stop everything, and are only a part of a
good layered defense.
Windows users have a variety of free firewall packages available to
them, all of which are easily configured. Windows XP users that are up
to date on their patches (and, they SHOULD be) already have a firewall
installed and running by default. Go to the Security Center under the
Windows Control Panel to check if your firewall is running. For a
slightly more advanced and more secure firewall that inform you about
what's going through (or attacking) the firewall, download and install ZoneAlarm Personal Edition.
Macintosh OS X provides a number of security features, including a personal firewall.
5. Use your Common Sense and be Paranoid!
Always keep in mind that attackers are constantly looking for new ways
to get to your personal data and resources. Do what you can to keep
them safe!
Be paranoid!
- Never click on ANY link in an e-mail or instant message without knowing who sent it
- Log out or lock your computer when you leave it
- Try to avoid the more "shady" looking areas of the Internet
- Keep your computers and portable devices physically secured
- Don't post personal information online, even on blog and social networking sites
- Be cautious about anything that appears to be from some form of financial institution
- Research software developers before downloading "free games", "free smilies" or "free screensavers"
Stay safe, and enjoy all the RIT network has to offer!
For more information on computer security at RIT, including free training sessions on basic computer security, brochures and alerts visit the RIT Information Security website at: http://security.rit.edu