NWA-PCUG Newsletter Article, August 2006
CERT Publishes Home Network Security Guidelines
By Ira Wilsker
APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

Iwilsker@apcug.net
(click to email author)


WEBSITES:
http://www.cert.org/tech_tips/home_networks.html - SECURITY GUIDELINES http://www.cert.org/incident_notes/IN-2000-07.html - DISPLAY FILE TYPES http://www.cert.org/tech_tips/malicious_code_FAQ.html - DISABLE SCRIPTING

Nowadays, it is common for the typical household to have several computers which are frequently networked. While all computers with internet or other external access can be threatened by viruses, worms, Trojans, hackers, and crackers, computers that are networked may possibly represent a greater threat to safe computing. This is because an attack on one inadequately protected computer on a network may possibly result in an attack on all of the computers on the network. Businesses often allocate resources and funds to protect their network systems, and may even employ cyber security professionals, but many home users often lack the skill, knowledge, or resources to properly secure their home networks.

It has been well documented in computer security circles that as corporate and government systems and networks are hardened, home users, especially those with broadband internet access, are more likely to become the targets of computer attacks. Some pundits have stated that as much as 80 percent of the spam email that we receive on a regular basis is not being sent to us by the spammers themselves, but by armies of zombie computers, mostly home-based personal computers that have been infected by a form of malware that has allowed control of the computer and its internet connection to be unknowingly hijacked by an unscrupulous third party for profit. There are actually "generals" of these armies of zombies who advertise their illicit battalions of high jacked computers for the use of spammers and worse. There is also evidence in security circles that these computers have been used for more than spamming, such as coordinated denial of service attacks that can shut down government, corporate, or academic computer networks. It may be hard to believe that our personal computers, apparently sitting quietly online, may have already been captured and turned against us for illicit purposes.

It has been imperative for quite some time that we harden our home computer networks for reasons of both personal security and national security. An insecure computer on a home network can easily be used as a weapon against us.

The CERT Coordination Center of the Software Engineering Institute at Pittsburgh's Carnegie Mellon University recently published its updated "Home Network Security Guidelines". This document, online at http://www.cert.org/tech_tips/home_networks.html covers much more than just home network security, and the threats that we all face, but also explains the technology and jargon of home network security. In addition to antivirus software, anti-spyware software, and a firewall, there are other techniques and strategies that all of us home network users must implement. Following a detailed and readable discourse explaining and defining the types of threats that we face, CERT lists a dozen recommended steps that we should take if we have a home network.

According to CERT:

  • Consult your system support personnel if you work from home. If the user connects to the employer's network using a "Virtual Private network", or VPN, the employer will likely have policies and procedures covering home network security when connected to the VPN.

  • Use antivirus software. There are now well over 100,000 viruses and other forms of malware circulating that can attack our systems. This illicit software can damage our data, steal our personal information (identity theft), cripple our operating systems, and commit other forms of destruction or interference with our ability to utilize our computers and its data.

  • Use a firewall. Firewalls are available in both hardware and software formats, with both varieties having a proper place in our home network security. According to CERT, intruders are constantly scanning home computers looking for vulnerabilities. A firewall may provide some protection against these scans and subsequent attacks. CERT explains that since no firewall is totally impervious to attack, other security measures must be followed even if a firewall is installed.

  • Don't open unknown email attachments. Email attachments are a common way of infecting computers. Since many viruses and worms hijack email address books, the old adage of only opening email attachments from people you know may not presently offer adequate protection, as malware will apparently often come from known sources. Human engineering, or tricking people to open illicit attachments, is another common way of infecting computers and networks. This is one of the major reasons why antivirus software, which is frequently updated, is an absolute necessity. While also not impervious to attack, updated antivirus software is a good, though not perfect, defense to email borne attacks.

  • Don't run programs of unknown origin. Unless you are absolutely sure of the source of a program or file, good practices dictate that questionable programs should never be run. Just because a program has apparently been forwarded by an acquaintance or coworker does not verify its pedigree. It is also a good practice not to forward programs received via email, or found on the internet, as they may contain a nefarious hidden component.

  • Disable hidden filename extensions. By default, Windows hides, or does not display file extensions (usually three letters preceded by a dot, such as .exe or .com), if the file type is a "known" file type referenced in the file association table. Because of this, many dangerous email file attachments may be misrepresented as to the type of file. For example we might think that "PrettyGirl" is a ".jpg" file that will display an image, but if the extension is hidden, it may be an executable file capable of infecting our computer and network. Instructions on disabling hidden file name extensions is available at http://www.cert.org/incident_notes/IN-2000-07.html

  • Keep all applications, including your operating system, patched. Software publishers often publish and release security related updates and patches for their software. Microsoft, for example, often has a "Patch Tuesday" where it releases numerous patches for various Microsoft products. Antivirus software publishers currently release updates as frequently as hourly containing updated virus signatures, offering protection from some of the latest viruses. Some other software publishers also release security patches on an irregular basis. It should be noted that as of July 11, 2006, Microsoft will no longer release security patches and updates for Windows 98 and ME.

  • Turn off your computer or disconnect from the network when not in use. This is one of my personal favorites, a technique I preach about whenever possible. Just because today's broadband is advertised as "always on" does not mean that the computer must always be left on. If a computer is on, it may be vulnerable, and if unattended, may be even more vulnerable to attack. There are other reasons for turning off computers when not in use, other than security issues. Properly shutting down a computer (Start - Turn Off Computer - Turn Off) also cleans and releases the memory, closes the registry, and performs other vital housekeeping tasks.

  • Disable Java, JavaScript, and ActiveX if possible. Some malicious code may be imbedded on scripts, or small executable files, often written in Java or Microsoft's ActiveX. While disabling all Java, JavaScript, and ActiveX may result in a more secure computer, there are also countless totally legitimate websites and utilities that depend on those utilities in order to function properly. In my opinion, this is a personal choice item. It should be noted that in many of the newer generation of browsers there is some form of built-in security to help restrict illicit code from executing from a webpage.

  • Disable scripting features in email programs. Many email programs, such as Microsoft's Outlook and Outlook Express, use the same scripting functions as many browsers. Because of this, some harmful emails use this scripting vulnerability to attack computers. For this reason, email security can be increased by disabling Java and ActiveX in email programs, but then some legitimate attachments may not function.

  • Make regular backups of critical data. The three most important words in computing are backup, backup, and backup. If our hard drives should fail, we will lose our valuable information unless it is backed up. There are many backup utilities available, as well as a variety of hardware and media for backups. There is no good reason for not having a current backup of all critical files. This becomes painfully apparent when our hard drive fails, and out data is lost.

  • Make a boot disk in case your computer is damaged or compromised. In the event of a security breach, hard drive failure, operating system problem, or other calamity, a boot disk may help in recovering from the problem. Boot disks can be on floppy, CD, and in some cases a flash drive. Boot disks may also include recovery, repair, or antivirus utilities. It is imperative that boot disks be created and tested prior to when they may be needed.

    CERT has done an excellent job enumerating the risks that we face with our home computer networks, and providing the solutions that we should follow in order to harden our machines from attack. It would be a good practice to enhance both our personal computing security, as well as our national security, by implementing these practices.

    Click here to return to top


  • ==================================================================