NWA-PCUG Newsletter Article, November 2005
October is National Cyber Security Awareness Month
by James Katz, Editor,
Capital PCUG Monitor
editor@cpcug.org
(click to email author)


The month of October is designated as National Cyber Security Awareness Month once again this year by the National Cyber Security Alliance (NCSA), a not-for-profit public-private partnership dedicated to promoting awareness and education about computer security. Working with sponsors in the government, such as the Department of Homeland Security (DHS) and the Federal Trade Commission (FTC), as well as corporate and computer industry partners in the private sector, the NCSA began the initiative of celebrating October as Cyber Security Awareness Month last year to increase the computing public’s attention to computer security issues, enhance their recognition of computer threats and vulnerabilities, and motivate them to better prepare for, prevent, and respond to computer security risks.

The goal of the NCSA initiative is to reach millions of users in homes, small businesses, schools, colleges, and universities, as well as those in corporations and government. According to NCSA President, Ken Watson, the mission of the NCSA is “to reach out to all Americans -- not just the computer experts,” through a campaign of media announcements and national and regional events, such as presentations, workshops, conferences, and fairs, dealing with topics like identity theft, computer scams, safe behavior practices on the Internet, and child safety online. (For information about events in your area, check with your local college or university, look at the listings at http://www.staysafeonline.info/events/index.html, or go to the Multi-State Information Sharing Analysis Center’s Web site at http://www.cscic.state.ny.us/msisac/ncsa/oct05/index.htm to find out what events your state government may have planned.)

Threats to Security
More and more people are using computers to connect to the Internet to communicate with others, conduct their personal banking, and shop and make purchases online. As computer users spend more time online, and make more use of broadband connections or wireless networks to do so, they become increasingly at risk for harmful attacks if they do not take steps to protect their computers.

And the risk is there and growing. According to the DHS, computers connected to the Internet are scanned to assess their setups and weaknesses an average 17 times a day. Estimates attributed to the FBI suggest that one in four computers will be hacked this year. Phishing scam attempts have been reported by Symantec, the security software vendor, to now exceed over 33 million each week. At the same time, 49 per cent of people surveyed were not able to recognize such e-mail as a Phishing scam, as indicated by research by the University of Pennsylvania’s Annenberg Public Policy Center. A study of home users conducted for NCSA last year by America Online (AOL) found that 63 percent of respondents admitted to ever having a virus on their computers. And, according to the NCSA’s Ken Watson, “Industry projections note that by year end, Internet users will have been confronted by an estimated 100,000 forms of malicious code. About 91 percent of PCs today are infected with spyware programs that send information from your PC to an unauthorized third party.” He further pointed out that “more than 185 million Americans own computers connected to the Internet -- cyber security should become second nature, just like brushing our teeth.”

Despite growing threats to the security of information and technology systems, attitudes and practices of computer users have changed little, if at all, even as reliance on computing and information technology is increasing at all levels of use. Even though surveys have found that computer users’ concerns about cyber security risks have increased over past years, users have failed to make prevention or response measures a priority.

Perhaps it is due to users perceiving the pervasiveness of cyber threats as far less common than the reality. In a survey of average computer users, the NCSA found that many people fail to grasp the level of risk: over 30 percent reported believing they were more likely to be struck by lightning, win the lottery, or be audited by the IRS than become the victim of a cyber attack or privacy breach. Yet the actual odds of suffering a cyber attack are about 70 percent, while the odds of each of the other events are well under one percent.

The Need for Cyber Security
The risk of an attack is great, and the consequences of failing to prevent the potential damage can be devastating. You may not even realize the full extent of the consequences if your system is hacked or infected with malicious software (“malware”), such as a computer virus, worm, or Trojan horse. Some of the consequences can include:

• Data loss: The data you collected and the work you spent so much time producing can be destroyed. If you do get hacked or infected, you need to be able to identify what was damaged, and then restore the data from your backup systems. Computer downtime can cost money as well as time while files or hardware are fixed, and time and effort must be re-directed to restore or redo the original work.

• Corruption of data: If your data is not completely lost, it may be corrupted. If the data has been changed, but not destroyed or removed, this may be hard to discover. If you do, you will have to figure out which data is good and which is bad, and this can be difficult and painstaking. If you don’t discover there is corrupted data right away, you may be working when you experience a “cascade failure,” a problem that occurs when failure in one system takes down adjoining systems in a progressive series. Problems may then spread throughout your systems before the errors are discovered. It can take substantial time and effort to track down the initial problem and restore your computer’s systems from backups.

• Theft of data: Some kinds of data are more attractive targets than others. Of course, anything associated with money is a prime target, such as credit card numbers and banking account information. Personal data, such as social security numbers, are often sought for identity theft to commit fraud.

• Misuse of data: Your work may be stolen by others at your school or business and represented as their own, or your personal photos or information could be taken and made public. If your records, trade secrets, financial data, or other sensitive information wound up in the hands of your company rival, business competitors, or even a stranger seeking to cause embarrassment, could you be at risk for losing the grant, account, promotion, job, or reputation you’d been working hard to achieve?

• Noncompliance with legal responsibilities: If your computer is hacked or infected and used to send out pornography or spam e-mail, you may be held legally liable for allowing such unlawful practices. Even if you did not know of it or intend for such e-mail to be sent, you could be judged at fault for failing to prevent or stop it from happening.

• Becoming part of a larger problem: Infection of your computer or network with a malware that sends out numerous e-mails can perpetuate the problem of spam and propagate more infections. If your computer is taken over by a hacker and used to take part in an attack on a federal or corporate mainframe computer, then your computer could possibly become an instrument of cyber terrorism intended to disrupt financial or governmental operations.

As this last factor points out, cyber security not only is a concern for each of us individually, it is a concern for us collectively. As Ron Teixeira, NCSA’s Executive Director remarked, “The scope and impact of existing and emerging online threats requires an ongoing partnership between government, businesses, schools, and consumers. Working together, we can make the Internet safer for everyone.” Making your personal computer secure can play a crucial part in protecting the nation’s Internet infrastructure.

Cyber Security Practices
To determine whether you’ve made the security of your computer system or network a priority, consider the following questions:
• Do you select strong passwords and keep them private?
• Do you use a password protected screen saver?
• Do you keep your computer locked up when not in use?
• Do you make sure important and sensitive personal information is not stored on your system?
• Do you use a software or hardware firewall, or both, and have you configured it properly?
• Do you use anti-virus and anti-spyware software, and do you keep them up to date?
• Do you exercise caution when opening e-mail attachments?
• Do you know where to report spam or fraudulent e-mail?
• Are you aware of the risks in file sharing?
• Do you download and install operating system and application software security patches as they become available?
• Do you back up your important files?

According to a number of cyber security experts, the first step in keeping your computer secure is to limit access to it by unauthorized users. If you use your computer in a setting where others are around, such as in a library or office, this means physically securing the machine. Locking up the computer when not in use, and using password protected access and screen savers keeps strangers from sitting down at your machine and exploring your files. Passwords should be strong (i.e., difficult to guess or discover), and never shared with others. As Cliff Stoll, an authority on security, suggested, “treat your password like your toothbrush -- don’t let anyone use it and get a new one every six months.” You can use random password generators, such as those found at sites like http://www.securityawareness.com/files/rpg.exe or http://toad.net/cgibin/cgiwrap/spwgroup/lc.pl, If you suspect your password has been learned, change it immediately.

To limit access to your system by way of the Internet be sure to use firewall software or hardware, or both. And be sure it is configured correctly to allow in and out only those communications you want. According to the NCSA survey conducted by AOL, mentioned earlier, only 37 percent of the respondents currently used some sort of firewall on their computer; 87 per cent believed they had set up their firewall correctly, yet 72 percent were found to have an improperly configured firewall on their computer.

Despite using a firewall, sometimes viruses, spyware, and other malware can still get into your computer system, often through e-mail or file sharing.

Security experts say you should make sure you have anti-virus and anti-spyware software installed, and scans are being run (at least on a weekly basis). To avoid having to rebuild your entire system after malware has taken root, it must be detected, quarantined, and deleted before damage is done. And be sure to keep the protective software current by updating it regularly, if not automatically; protective software is useless if it doesn’t know what the latest threat is to protect against. A number of different protective software applications are available, either free or at low cost; the National Capital Technology and Computer User’s Group has a comprehensive table, with links to sources, comparing various anti-virus and anti-spyware programs on their Web site at http://www.nctcug.org/protection.html.

To minimize the risk of receiving malware through e-mail, it is best to not respond to any messages, click on any web page links, or open any attachments you have any questions about. Experts recommend that you use encrypted e-mail, and not send confidential or sensitive information via e-mail. If you get questionable or apparently fraudulent e-mail, you should report it to the network administrator, your Internet Services Provider, and the appropriate authorities.

More Precautions
A number of other precautions are recommended to protect your computer from harm and to preserve your data and privacy. If you use a wireless network, be sure to secure it with the appropriate protocols. If you use a broadband connection, turn off your computer or disconnect it when not in use so that unwanted communications cannot be sent or received when its activity is not monitored.

Be careful about what is getting into your computer by other means, as well. Do not use software that has not been obtained from a known source. Do not share files from your computer, and use caution in loading files from others through removable media, such as floppy disks, CDs, zip drives, tape cartridges, and other types of storage. And be sure to keep secure any of these removable media on which you’ve stored your data; keep removable data storage media locked up, destroy the material when you’re finished with it, and make sure your computer’s hard drive is wiped clean when time to dispose of it.

One important cyber security practice that is often overlooked is that of backing up your data and your systems. Consider how secure you’d feel if you couldn’t rely on the information you’re working with, or depend on your computer to operate properly. If any of your cyber security measures are breached, and your computer files are deleted, corrupted, or intentionally or accidentally falsified, or if your hard drive fails, at least you can re-establish a reliable system if you have your information safely backed up. Make sure that you back up your data on an on-going basis, that what is backed up can be restored, and that you have copies of your operating system and software applications, with all their security patch updates.

Vigilance Rewarded
NCSA’s initiative to raise awareness about cyber security nationwide and empower people to improve their security knowledge and preparedness includes a number of events during the month of October, and a variety of resources all year long. You can find out more, and pick up cyber security tips, at the NCSA Web site, http://staysafeonline.info. More cyber security information is available at other sites, such as http://www.cybercitizenship.org, http://www.ftc.gov/bcp/conlineedcams/infosecurity, and http://www.cert.org. An assortment of items about cyber security, as well as links to other articles, is also available at http://www.microsoft.com/security/default.mspx.

The fact is that no computer connected to a network can be assured of being 100 percent secure 100 per cent of the time. No one security measure is sufficient to protect your computer from all threats at all times. Each measure requires continual care to make sure it is operating, and all necessary updates and security patches are obtained and installed on a regular and timely basis.

Cyber security may seem like a substantial burden, but the effort is an investment that can be greatly rewarded. If you are not interrupted by a security breach, you can focus on moving forward rather than spending your time trying to recover and catch up. Continually seeking the latest information about cyber security, keeping yourself educated about security issues, staying vigilant about computer vulnerabilities, and consistently exercising good protective practices online can make the difference in preventing the hardship of destroyed data, lost time, duplicated effort, and disrupted progress.

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.

Click here to return to top



==================================================================