Beginners Security Basics Presentation. Presented by Tom Crittenden RASCALs 2015

Transcription

1 Beginners Security Basics Presentation Presented by Tom Crittenden RASCALs 2015

2 What we ll Discuss This will be mostly about you your practices and things you can do (or not do). Safe (at least safer) Practices for and Internet use Web practices. PC Security Programs (brief) including antivirus, and firewalls Updates and monitoring A quick look at File Encryption Caveat: The opinions expressed are my own, and do not necessarily represent RASCALs or their Board of Directors. In other words don t take my say (or anyone else s). We ll do a general Q&A at the end of the presentation. Please hold questions to the end. We ll also breeze through most of the Web Browser suggestions I m being lazy and not deleting them from this general discussion of PC Security. 11/12/2015 2

3 Glossary CP Control Panel IE Internet Explorer (web browser) IMHO In my humble opinion PC Personal Computer (as in it's your PC, not mine do your homework). I ll use PC generically for laptops, desktops, tablets, etc. W10(or 8 or 7) Windows 10 or 8 or 8.1, or 7 11/12/2015 3

4 Safe(r) Be cautious about all s, but especially unsolicited. Don t open an if you re not sure of the sender or the topic. Don t open attachments unless you re sure about the sender and content. Even if it s from someone you know make sure it s something you would expect from the sender. If in doubt send an to the sender (or call) for confirmation they sent it. Don t click on links they may be spoofed. Copy the link from the , and paste in in the browser use Sandboxie if you re not sure about the sender. If you do want to open an attachment save it first this gives your antivirus another shot. Use and pay attention to SPAM filters if your provider has SPAM settings set them up. Use Throw away s for web purchases, surveys etc. Save your personal for things like friends, family, and select web sites (e.g. financial). You can create free accounts at Google, Yahoo and others. Delete the throw away account if it s getting too much SPAM. Be careful about putting personal information in s even with encrypted settings it s only secure to your provider, but not all the other Internet nodes it goes through including the receiver. Take the RASCALs Basics class. 11/12/2015 4

5 Phishing Cautions Phishing s are increasing, and increasingly clever. They want your personal information for theft or ID theft. First defense is to not open suspicious mail. Use plain text until you ve confirmed the . Don t click on links (again). For example if the is supposed to be from your bank, go directly to your bank site in your browser and not from the link. Using a Password Manager to log into a site avoids the phishing link. A Password Manager allows you to use Strong Passwords (10-12 in length, mix of upper and lower case, numbers, and special characters) and then only have to remember the Password Manager password. I also back up my passwords in a file that s kept in a safe location. Don t give out personal information including usernames and passwords either on a web site or in replying to (or sending) s see previous step, and also security. Don t respond to: You ve just won; Too good to be true. Use an anti-phishing filter many antivirus suites and some clients have them. Use browser add-ons and firewall filters to prevent the phishing site from displaying in case you did accidentally click on a phishing link. See safe(r) browsing. Use anti-phishing settings and add-ons in your web browser. 11/12/2015 5

6 Don t Get Hijacked You probably know someone who had their hijacked maybe you got a phishing or Spam from them. Below are some steps to reduce the chances of you re being hijacked Choose a strong password. A strong password uses letters, numbers and special characters and is longer than eight. Also change it periodically, and immediately change if you suspect usage. Use unique password(s) for your account(s). Avoid sharing your address on the Internet. Placing your address in public forum messages or otherwise spreading it around in full view online is an invitation for spammers to spoof your . Essentially, spammers collect addresses and send out spams that appear to come from those addresses. Don't make it easy for spammers to find and use your address. Use throw-away. Use anti-virus software and keep it up to date. Use an program with a spam filter. Most applications have spam filters built in that will filter out potentially dangerous s that could give hackers an in-road into your account or computer. Flag spam s that aren't caught automatically and don't open s from unknown senders. Don't give out your address or password. Any person or web site that asks for your password is most likely not legitimate. Your provider will never ask you to give out your password or type it into an online form on another web site. The same goes for phone calls from people who may be pretending to be from technical support. If you have any doubt, contact the company directly to verify the request or determine if a web page is legitimate. If using webmail (with a browser) be sure to use a secure (HTTPS) connection. Be careful with untrusted computers (such as libraries). If you must use one, consider a Password Manager like RoboForm To Go so key loggers can t grab your password. 11/12/2015 6

7 Safe(r) Web Browsing 1 According to a Google study about 10% of all web pages have malware. This number is old and may be higher. Whenever possible stay with web sites you know and trust. If you do a search pick the site(s) you know for information. I mentioned Sandboxie earlier it s a great program if you re going to sites you don t know. More later. Always question and be suspicious. If you re not sure about something use the web for research. For example before trusting xyz site put xyz site complaint into your favorite search engine (e.g. Google). Then search again using xyz site problem. This technique can also be used to research software, things to buy, etc. Use web site rating add-ons to get security information about sites. Examples are Web of Trust and MacAfee Site Advisor. Use secure web sites as much as possible. Your browser will show a padlock symbol, and the site name will start with (the s means secure). Use strong passwords again that s 8 or more characters that include upper case letters and numbers random is best. 11/12/2015 7

8 Safe(r) Web Browsing 2 Use extra caution if ordering online (secure site, known business). Ask friends and family for recommendations don t forget the RASCAL list server (currently suspended for new membership) to get opinions from your fellow RASCALs. Use a different password for every site especially financial sites, and set a schedule to change them. Did I mention using a Password Manager. Clear your browser history and cookies including flash cookies. Don t save passwords in browser. Consider private browsing. Choose your Browser I prefer ones like Firefox that are easy to set securely (e.g. Private Browsing). IMHO IE has had too many security holes for me to be comfortable. Take the RASCALs Internet Basics class. 11/12/2015 8

9 What is an antivirus program? Detection is the first line of defense. Antivirus (AV) programs use signature files (that are updated from the vendor site) to detect known malware, and heuristic algorithms to detect new in the wild problems. Detection includes looking at all files and s downloaded or copied to the PC. Files are also scanned when opened or saved. The second line of defense is removal once infected. No AV program does all of these 100% effectively. Windows had not come with antivirus, until Windows 8 (finally). Even so I prefer others to the one supplied. Remember that most failures of antivirus and firewalls start with your and web practices. 11/12/2015 9

10 Do I need a firewall From The very short, very easy answer is: *!#@ yes! With all that's happening on the internet these days it's simply too risky to sit "naked" on the internet unless you really know what you're doing. I firewall monitors the traffic between your PC and the outside. It prevents unwanted access (inbound-intrusion) from the Internet. It also controls what can access the Internet from our PC (outbound) to reduce the chance of malware (e.g. key loggers) from connecting to the Internet. Having a good firewall, antivirus, and anti-adware all help keep you secure. But, the most important security device is you. If you aren t careful about what you view and download (e.g. latest game, picture of Paris Hilton), no amount of protection will keep bad stuff off your PC. It s also important to keep your Windows, AV and other programs up to date. A security hole (e.g. Adobe Reader April, 2009) will leave you vulnerable even if you AV, Windows, and firewall are up to date. Programs like Secunia PSI can help keep applications up to date ( Windows 7 and 8 come with an OK firewall I prefer third party that include features like web filtering. 11/12/

11 Updates & Monitoring To make sure your security software is doing it s best you need to keep it up to date, and also monitor them. Many (most?) security programs have built in checks for data files (e.g. antivirus) and program updates. If possible I prefer the option to tell me a program update is available, rather than automatically update (except for Windows updates). What I DON T like are programs that run a background process every time Windows runs just to check for updates (like Adobe Reader). I prefer a program that checks when I run the program. One update program I like is Secunia PSI (Personal Software Inspector). You install the program, and PSI checks against an extensive database for needed security updates. Common offenders include Adobe products (including Flash), and browser updates. Two others I ve used to check for updates are FileHippo and Glary Utilities. 11/12/

12 What is Sandboxie Sandboxie is isolation software that puts a box around an application (like a Web Browser). Red arrows show changes from running program (browser, etc) into your computer. Without Sandboxie, the changes go directly to the disk. Sandboxie sets up an isolated storage it controls. 11/12/

13 Secunia PSI Secunia PSI is primarily to find programs that need updating for security reasons. Download, install, and run PSI make sure you have an Internet connection when starting PSI. It will run a scan (be patient it takes awhile), and you will probably see a report like this with one or more programs. Insecure programs have updates. End of Life usually means you need to remove, and then download a new version of the program. 11/12/

14 File Hippo and Glary File Hippo available from the FileHippo software download site evaluates your installed programs to see if updates are available. You can also set it to display beta versions if you wish. After scanning, a web browser opens with a list. You can download from the FileHippo site or (my preference) go to the various software site(s) and download. Glary Utilities has a similar function I use both as one will sometimes show an update not identified by the other. 11/12/

15 Do I Need File Encryption? Below is from a recent PC World Article It's all too easy to neglect data security, especially for a small business. While bigger organizations have IT departments, service contracts, and enterprise hardware, smaller companies frequently rely on consumer software, which lacks the same sort of always-on security functionality. But that doesn t mean that your data is unimportant, or that it has to be at risk. Encryption is a great way to keep valuable data safe whether you re transmitting it over the Internet, backing it up on a server, or just carrying it through airport security on your laptop. Encrypting your data makes it completely unreadable to anyone but you or its intended recipient. Best of all, much of the software used in offices and on personal computers already has encryption functionality built in. So, how important is your data? Do you have personal files on your PC (even things like contact lists)? Is the personal data on a laptop, tablet, external hard drive, or flash drive that is vulnerable to loss or theft? Are you willing to take the steps to protect your data? 11/12/

16 MS BitLocker BitLocker full disk encryption is available on the Pro versions of Windows 7, 8, & 10. Setup is done from CP. BitLocker works best if you have a Trusted Platform Module (TPM) chip, but can work without it, but requires some configuration in Group Policy settings. 11/12/

17 MS BitLocker You can use BitLocker on thumb drives and external hard drives as well. You ll need a password (did I mention Password Manager?). 11/12/

18 Other Encryption If you don t have (or want) Windows Pro there are other software packages that can be used to encrypt data. One I ve used is VeraCrypt, which is a successor to TrueCrypt. I can encrypt all or some data on a drive, and also be used on external devices. 11/12/

19 Review The first and most important security device is you! Follow safe practices. Use SPAM, Phishing, and malware checking software. Follow safe browsing practices. Use caution with unknown sites. Use Web Security Programs including browser settings, addons and firewall filtering to reduce the chance of going to a bad site or clicking on a bad link. Use strong passwords. Keep PC Security Programs including antivirus, and firewalls up to date. We did a brief look at file encryption. Take the RASCAL classes on Internet, , Security Basics, Antivirus and firewall, Isolation Software among others. 11/12/

20 Questions & Resources PC Security or any others? Windows Live Mail help didn t help much. Try a Google search on Live Mail 2011 plain text. One site I found helpful was Web of Trust (works with Firefox and others, and common search providers) Glary Utilties: FileHippo: ccleaner: (Note: Piriform has some other neat utilities including Speecy that gives detailed information about your PC hardware. Manage flash cookies see site or Google flash cookies (see also Better Privacy): Sandboxie: Darik s boot & nuke: (wipes disks prior to PC disposal) TOR project: (Note the irony of how many security websites are not themselves secure TOR is a rare exception.) VeraCrypt (replaces TrueCrypt): CyberGhost: RoboForm: Wi-Fi for dummies: Avast free: AVG free: Firewalls Zone Alarm and Comodo 11/12/