Your Security Policy
It doesn’t need to be formal, but everybody who wants anxiety free computing needs some kind of Security Policy. Ignorance isn’t bliss when there are so many threats. And the biggest aren’t from the Internet. Let me scare you first and reassure you later. Consider a few common scenarios from my computer consulting experience:
Careless users
Teenagers
Your teenage son gets on your computer and decides he needs a ton of free music – which he gets just by joining an online music sharing service. What he doesn’t know is that by downloading and installing that music sharing software he could be setting up your computer as a “world wide music server”. Then anyone on that world-wide service has access to your computer, in order to download his shared music.
Suddenly your computer is wide open to hackers. Also, such services sometimes make money by accepting money to install advertising, spyware, 3rd party cookies and other bad stuff onto your computer. After all – with your son providing them with access to your machine, why shouldn’t they?
Relatives
What if your Uncle Fred wants to give you a free copy of some of his software, so you don’t have to buy your own copy? Aside from stealing bread from the mouths of the programmers and others in the company that wrote that software, dear Uncle Fred doesn’t realize that his computer is infested with viruses. He puts the CD he burned into your PC and installs the software, along with a few invisible viruses. Neighborhood kids sharing games, music or videos are excellent computer infection vectors too. And even if someone on your network has their own computer, your home network can allow their malware to spread.
Guests
Your in the process of buying stuff online or doing online banking when the doorbell rings. It’s your new neighbor asking for a copy of that recipe you mentioned. While you’re off in the kitchen searching through your paper recipes, your neighbor is looking at your credit card details on your unattended computer screen.
Employees
One of your employees wants to do some work for you on his computer at home. So he needs some of your software. It’s expensive software, so you don’t want to make him buy his own copy. You loan him your company copy of the program CD. A week later, your program starts crashing just when you need it most - you have to re-install the program immediately or miss your client’s deadline. Late Friday night you discover that your employee still hasn’t brought the program CD back from his house – and he and his family have gone out of town for the weekend.
Bad Guys
Occasional visitors with bad intent
Your office cleaning service has just hired a new guy with criminal intent. He likes to “keep track of every lock that ain’ t locked when no one’s around”, to quote a song.
One of your employees left her computer on overnight, so some maintenance software can run all night. But no screensaver password is enabled. Now the cleaning guy is wandering through your employee’s Windows files looking at your financial information and discovering your employee’s insecure file where passwords are listed. In the desk drawer he also finds a slightly hidden company credit card. In a place your employee thinks is safe, but is actually obvious to one “experienced in the art” he finds a written list of passwords and credit card info.
Risky computing
You’ve been really busy, so you haven’t taken time to make a full backup image of your hard drive for a month or two. You figure you’re pretty safe anyway, since you’ve been uploading your work documents to one of those online backup services at the end of every workday for a couple of months now. Too bad the web is so slow that you can’t back up your whole computer that way.
Suddenly your hard drive starts making clanging sounds, then Windows crashes with a blue screen and a “STOP_ERROR…” message.
Oh no! You call your computer consultant. She can’t get there for a few hours, then says you need a new hard drive and she needs to go buy one and then install it. An hour later she’s done and needs your latest full backup image to restore everything. Turns out that two month old backup image file is bad (you never tested it) and you didn’t keep any older ones. But all is not lost – you find an old hard drive from last year that was replaced when she installed your current larger one. She installs that old drive as a secondary “slave” drive, re-installs Windows on your new drive, gets your printers and network running, downloads a dozen Windows updates from Microsoft (with a computer restart after each), gets your Internet connection and email working and re-installs, configures and tests all your programs (except the ones you can’t find the disks or license keys for) – finally she downloads your backup documents from that Internet backup site.
After a non-billable day of expensive consulting time, you’re back in business – kind of. There’s a big gap in your stored work product, between what’s on the old hard drive and what you backed up online. You’ve lost a lot of important email and there were probably lots of things on your failed hard drive you don’t even remember having – but will painfully miss eventually.
Another learning experience
You’ve learned the hard way why you should make a validated full image backup of your whole hard drive (and an emergency recovery CD), not just back up your work product. And why you want to keep several older backups too. If you’ve been computing for a few years, it takes many hours to re-install Windows and all your programs and hardware and to get your network and Internet connections working and secure again – to say nothing of your years of emails and the risk of loosing all that stuff you don’t even remember you have.
Cracked!
You notice that your computer is busy all the time and is constantly accessing the Internet. You get an email from your bank saying your credit cards have been compromised and they have disabled them. They are sending new credit cards – sorry you won’t get them for a few “business days”.
Your computer has been ‘hacked into’ – actually the correct term is “cracked” and “hacker” should be “cracker”. I’m a “hacker” myself (someone who builds stuff, usually electronic or high-tech devices, out of junk and surplus equipment – ‘hacker’ is an old praise term with mad scientist implications). Someone who breaks into other people’s computers is correctly called a “cracker”. The mass media often make these dumb mistakes and confuse everyone.
Anyway, your credit card info was stolen and sold online. Furthermore your computer is now a “zombie”, under the remote control of the cracker, or someone he sold that control to. Oh joy! Your computer is now spewing email spam, viruses and spyware onto the Internet, or is forced to serve as a member of a vast zombie computer army in a DOS (Denial Of Service) attack on the Pentagon’s computer network.
Natural Disasters
Power problems
A thunderstorm develops while you’re busy working. The lights flicker, the power goes down and your computer dies while you’re saving some QuickBooks bookkeeping data. After a few minutes, the lights come back up and you start up your computer. Your QuickBooks company file is trashed and you have to restore it from last weeks backup – loosing a half hour of bookkeeping work.
Not too bad, right? So, you go to restore your backup file from your external USB hard drive. But for some reason you can’t access that drive! Turns out the power company sent you a big electrical surge when your power came back up – quite a common thing really. That surge fried your backup drive. Your computer has some (limited) surge protection built in, so it survived – this time.
Hot Time – Summer in the city
It’s the middle of summer and a real scorcher today. And your home office has no air conditioning. You’re running 5 Windows programs at once and you launch a 6th one. Suddenly your computer shuts down and won’t restart. When you get close to it, to try the power button again, you smell a hot electrical insulation smell. After twenty minutes, it lets you turn it back on again – a typical “processor overheat incident”. Is your computer permanently damaged? Prematurely aged?
OK, enough computer nightmares. I hope you’re convinced by now that you need a security policy.
Here are some concepts behind a Security Policy you can customize for your own situation:
Limit Computer Access
No one but you is allowed to use your business computer. Your employees, family members and everyone else must use their own computer. You enforce this with a Windows password login where only you know the password. If you use a network, you have one desktop folder where you move things which you want to share over that network – no one can access any of your other folders over your network – especially the boot drive root (the main folder of your hard drive – which contains all your other folders).
Because you realize that anyone who knows much about computers can get to your data without even starting Windows, you also put the same password you used for Windows into your motherboard’s BIOS setup settings (see your computer manual or Google your computer vendor’s web site to find out how to access your BIOS setup).
In this way no one can start your computer without your password – unless they’re pretty darn computer savvy. If you want even more protection, you need a lockable computer case which you indeed keep locked. Even then, someone could just carry your computer off.
This is a good time to point out that security is never 100% secure. You do what you can and don’t sweat the small stuff. Most problems are caused by ignorance, angry employees or petty criminals, not skilled burglars.
Naturally, you memorize your password and keep it to yourself. And you don’t hide a written copy someplace – since those who know you best are the most likely suspects and can most easily find your “hidden” password note.
You also use a Windows screensaver. It automatically activates after 10 or so minutes of computer inactivity and is itself protected with your Windows password. That way, if you leave your computer unattended for a while, no one can see what’s on your screen or get into Windows.
You protect against cracking attempts by securing all hardware “service ports” on your computer. To do this, you use the software firewall supplied with your AVG Internet Security product and turn off the Windows firewall (not good to have 2 software firewalls running at the same time). For even better (incoming only) security, your cable modem or DSL modem/router comes with an NAT (Network Address Translation) hardware firewall – they almost all do. Chances are that’s already completely setup and you don’t need to touch it.
You know your software and hardware firewalls are working well because you went to Steve Gibson’s cool web site and used his “Shields Up” test to actually try to crack your computer’s service ports – and you got an “all green” (or at least no red squares) as a result. Now you know your computer is either invisible or at least closed to hackers.
Security Smarts
You get smart
You take the time to understand online threats – like the dangers of file sharing sites for music or movies. And you’re using all the features of your AVG Internet Security software, so it will warn you if you stumble across a dangerous web site – while it blocks those annoying pop-up ads from all web sites.
Password protect your passwords
You don’t allow written passwords to be hidden around your office. Instead, you buy an inexpensive password protected database program, install it on all your computers and make sure people keep all passwords, credit card numbers and such in there – using a memorized (not written) password to protect it. That way, you can memorize just one password to protect them all.
No info in your spare parts bin or backups
When you upgrade your hard drive by buying and installing a larger one, you don’t leave all your data on that old drive – where someone could easily steal it. Maybe you leave the old drive in your computer for a month as a backup, or wipe it and use it as additional storage space – but once you are done with it you “scrub it clean” of data, such that no one can run a data recovery program and get all your info back again. Your JV-16 ‘Power Tools’ program can do that for you (and a lot more).
Inoculate from malware infections
You install and automatically update an excellent anti-virus and anti-spyware program, such as AVG Internet Security. You also have Windows Update set to automatically download Microsoft’s updates – but to ask you before actually installing them (see my previous post).
Scan and track media
Before you install (or let anyone install) anything from external media, like a CD, floppy disk or memory stick, you scan it with your anti-virus program.
Whenever you save something to external media, you know it’s virus free – because you have your anti-virus program set to do an automatic scan of your whole computer every night. So, you attach a little green adhesive dot to that media, meaning that it’s known to be virus free. If you ever insert that media into someone else’s computer, you remove that little green dot – because (if the media is writable) it may have picked up an infection from that ‘foreign’ computer.
“Neither a borrower nor a lender be”
You never ever let your program CDs, textbooks, manuals or other vital stuff out of your office. But you keep a printed inventory of all your computer hardware and software off-premises for insurance purposes. Every 6 months to a year, you make a new computer inventory using the free ‘Belarc Advisor‘ program.
Backup often – backup right
You have an excellent full backup program, like Acronis ‘True Image’, which makes a full “image” type backup of your whole main hard drive – such that you can completely restore your Windows installation and everything else – to “bare metal” (like a new computer or a new hard drive) if need be, with a minimum of time and fuss. And you can use the same backup to restore individual files or folders. You understand that not backing up EVERYTHING could result in error-prone, expensive and time-consuming re-installations of Windows and other programs. You realize that you can’t rely on the company that made your computer to help you restore your data. They will only help you return your computer to the state it was in when you bought it – that is, working, but with none of your programs on it. Without your own full backup all that will accomplish is to erase anything you might have been able to save.
You backup every night to an external USB hard drive. You have 2 such drives (high quality drives made by Seagate) and you keep one off-premises, in case of a fire or other serious office disaster. You swap these backup drives once per week, so you will never lose more than 1 week’s work. Each drive contains not only the last backup, but several older ones – that’s why you bought large drives. You’ll keep an eye on the price of the new solid state (no moving parts) hard drives, since they will be so much more reliable – once they become affordable.
You keep a few old backups before you backup program deletes them to make more room, because you realize that you might not catch a problem file, which needs to be restored, until after the bad version of that file has been backed up – overwriting the last good version. You’re also sure to set your backup program to “validate” each backup it makes. Even though that makes backups take twice as long, you really need to know that each backup is a perfect one.
Once a month you make an ‘archive’ backup of critical data to a large memory stick, so that older info you may need in the future, and which will eventually be lost as your oldest backup files get deleted, is always available. Because backups slow down your computer, you backup at night – using a schedule which does not conflict with your nightly anti-virus scan. You (optionally) save backup time by doing a full backup only once per week, but backing up all new or changed files every night (called an “Incremental” backup).
When you installed your Acronis ‘True Image’ backup software, you took their advice and burned their “Emergency Recovery” program to a blank CD. Now, if you have a computer disaster, you have only to start your computer up from that Emergency Recovery CD and the tools are right there to easily restore everything to your hard drive, or to a new hard drive or even to a new computer – whether Windows can run or not. All you need in addition to that CD is the backup file from your external USB hard drive. And if you make major changes to Windows or install new hardware or get a new computer, you’ll remember to burn a new Emergency Recovery CD.
Safe clean power – Automatic shutdown
When those inevitable power outages happen, you know you’ll be safe because you have your computer, monitor and Internet connection devices plugged into an excellent UPS (Uninterruptible Power Supply) unit, like the ones from APC. You’ve connected their USB cable to your computer and installed their software, so when the power goes down, the UPS battery will keep your stuff running long enough for their software to gracefully shut Windows down – even if you’re not around.
And their surge protector will protect your phone lines and power lines from most surges and electrical noise (maybe even from lightening strikes) because you’ve got all your phone and critical power lines plugged into your UPS.
It’s also comforting to know that your Vonage VOIP (Voice Over Internet Protocol) phone service will still run during power outages – since you’re also running that off your UPS. Not good to loose your Internet phone service during disasters!
Chill out
It’s a summer scorcher of a day and your home office is sans air conditioning. But your computer is humming along happily without overheating – because you made sure it had enough cooling fans installed in that “thermally well engineered” high quality case you made part of your system design. And because you installed it in a location with lots of free air space all around it, rather than trying to jam it into some kind of office furniture. Last week you opened up the case and cleaned all the dust from the fans, heat sinks and hard drives with a small dry brush and a can of compressed air. You do that every couple of months – so you know cool air is getting to all those hot electronic chips and hard drives. You realize that nothing prematurely ages a computer like excess heat.
Well, I hope that wasn’t too grim or scary and that you’ll implement a Security Policy and get some peace of mind.
Please comment and let me know what I’ve left out and how to deal with whatever that may be – thanks!
Until next time – here’s to safe and secure computing…
_jim coe










