Too few people take computer security seriously. One can buy a computer from the supermarket these days. It is no longer regarded as a specialized tool but as a common household device. But nobody told you that you are also the administrator of this powerful device, did they?
Why is security important? Because, if you are reading this, your computer is connected to the Internet. Which means, it is a part of the Internet. Just as you can access other computers (servers) connected to the Internet to use their shared resources (web sites, file servers, e-mail servers and so on), so can others access your computer. So if your computer’s software is insecure, others can exploit those vulnerabilities with various purposes in mind. For example, one could try to access your personal files — things you’d like to keep private, like e-mails and address book, financial reports and credit card information, your medical records, your children’s photos and any sensitive information you have saved on your hard drive. One could try to remotely install programs to give them full access to your computer, thus preparing it to be used in other illegal activities, such as spreading viruses, attacking other computers or websites, or sending millions of spam e-mails.
If such things happen, it’s not the fault of those so-called “hackers”, nor the fault of the producer of your operating system. It’s your computer and your responsibility to manage it. That’s why there’s an “Administrator” or “root” account on your computer. Stop blaming others, it’s not rocket science to secure your computer yourself.
So how does the cat-and-mouse game work? Specialized organizations try to find vulnerabilities in all operating systems, and publish their findings regularily. Since most users use Windows, I’ll focus on it. Every month, new vulnerabilities in Windows’ components are being found, vulnerabilities that can be exploited in certain ways. As soon as such a vulnerability is discovered, Microsoft prepares a “patch” that updates the faulty Windows component; these patches can be downloaded free of charge, and the entire process of discovering newly available updates and installing them is completely automatic through the Internet’s best kept secret: Microsoft’s WindowsUpdate website. On the other hand, “hackers” try to find computers whose administrators didn’t install the patches and which are still vulnerable, and exploit those vulnerabilities to get complete access to that computer.
Let’s make an analogy to make it clearer. Suppose you have a nice barn (your computer) filled with all sorts of goodies (files, resources) for the winter. All your neighbours have similar barns. Everyone is happy with their barns. Once a month, a bunch of city folks with funny hats (security organizations) drive by, and inspect the barns for holes in the walls (software vulnerabilities). Then, they tell about those holes to the builder of all barns (the producer of the operating system) which, in turn, makes plugs to exactly fit each hole (the software patches). These plugs are free and the builder even installs them for free, all you need to do is call them (visit the WindowsUpdate site once a month). Why? Because mice (”hackers”) also learn about those holes in the barns (vulnerabilities), and they will try to get through the known holes to reach the goodies inside (exploit the vulnerabilities). If the barn has all known holes filled with the right plugs, then the mice can’t get in. If one of your neighbours didn’t make the call to the guys with the plugs, his barn will be crawling with squeaking rodents. Get it?
To keep your computer secure, the first step is to elliminate all known vulnerabilities. You do that by visiting the WindowsUpdate website once a month and allowing the site to detect what components need to be updated, to download the patches and install them. Yes, it’s that easy. No, it won’t take forever. Patches released in one month are usually a few megabytes or less, and your computer won’t need all of them; downloading shouldn’t take more than one hour even on a crawling dial-up connection. Is one hour each month too much to spare for the sake of your computer’s security? All you need to remember is to start Internet Explorer and select “Windows Update” from the “Tools” menu once a month. Easy!
If your barn had holes and mice settled in, then apart from plugging the holes you need to eradicate the mice as well. In other words, your operating system’s vulnerabilities are usually exploited by a certain kind of viruses called “worms.” These worms “crawl” through the Internet from one vulnerable computer to another. Once they have found a vulnerable computer, they will infect it and start spreading by finding other vulnerable computers to infect. Preventing the infection is done by patching the vulnerable components, as I have detailed above. But cleaning the worms from your computer is a different task. You could use a commercial antivirus to clean them, but there are free solutions to this problem, too. For example, Symantec, the creator of Norton Antivirus, offers free cleaners for specific viruses. The advantage is that these cleaners are free, are small, and do their job very well. The problem is that you need to know which virus you have in order to get the correct cleaner. This is where Stinger comes in: it is also a free cleaner from McAfee, it’s about one megabyte in size but it knows to detect and remove the most recent and dangerous worms spreading on the Internet — about 50 of them, each with a number of different variants. This is the perfect tool for automagically scanning and cleaning worms in your computer, very simple to use. In other words, Stinger would be the supercat you lock in your barn to find and eat all the mice inside. Is that cool or what?
Enough lecture for today. There’s more to computer security, so make sure you don’t miss the next class. You are one step closer to the rocket scientist diploma you have always dreamed of. Assignment due next time: get Stinger and scan your computer, and install all critical updates for your version of Windows.
