North Dakota Information Technology Department (ITD)Best-practices are a critical component of effective security and apply to a wide range of topics:
Adware is software that is often deceptively loaded on your PC without notifying you that it will load and what it will do. Usually this type of software collects information on web sites you have visited, provides additional popup windows with copies of your web browser running with unsolicited advertisements (hence the term adware) or automatically loads numerous web browser windows when you open your web browser (i.e., Internet Explorer) or potentially changes your list of Favorite web locations to visit or your home page of your web browser. The objective is to target unsolicited advertisements to the PC user and tempt the user to visit the unsolicited site and/or purchase unsolicited products. A more deceptive adware software tool may try to trick the user into supplying personal information (including user names, passwords, account names/numbers, banking information, etc.). These latter, more malicious adware and mass mailing techniques are referred to as Phishing.
Spyware and unauthorized adware are two examples of "deceptive" software. Deceptive software includes programs which take over your home page or search page without first getting your permission. There are a number of ways deceptive software can get on your system. A common trick is to covertly install the software during the installation of other software you want such as a music or video file sharing program.
Whenever you are installing something on your computer, make sure you carefully read all disclosures, including the license agreement and privacy statement. Sometimes the inclusion of adware in a given software installation is documented, but it may appear at the end of a license agreement or privacy statement.
Sometimes deceptive software gets silently installed on your system without any warning at all. If you use Internet Explorer as your Web browser, this can happen if your Internet Explorer security setting is set to its lowest value. Make sure to keep this setting at the medium level or higher. Doing so will help you control what is being installed on your computer. (We'll discuss this more in a moment.)
Have you ever had an experience where you were repeatedly asked to accept a download even after you said "no"? Creators of deceptive software often use such tricks to get you to load their software. If this happens to you, do not click "yes". Instead, try to close the Web page that first asked you to accept the download by hitting the "X" in the corner of the window. Alternatively, quit Internet Explorer and restart it to begin browsing the Internet again. If you visit a Web page that continually displays these tricky pop-up windows, that Web site may not be worthy of your trust.
Microsoft provides useful information about spyware/adware.
Any machine connecting to the Internet should utilize a firewall. There are two types of firewalls. Software firewalls usually run on PCs. Hardware firewalls are separate devices designed to efficiently protect computers. They are usually used by businesses, organizations, schools and governments. All firewall protection creates a barrier between the computers and the Internet. Firewalls should be configured to filter out unauthorized or dangerous information and prevent intruders from scanning and retrieving personal or sensitive information from the computer. Periodically check your firewall manufacturer's web site for product updates and patches.
Properly safeguarding your personal computer (PC) is one of the most important ways of protecting your information from corruption or loss.
Malicious code can take forms such as a virus, worm or Trojan. It can hide behind an infected web page or disguise itself in a downloadable game, screen saver or email attachment.
Computer viruses are programs that spread or self-replicate. They usually require interaction from someone to be activated. The virus may arrive in an email message as an attachment or be activated by simply opening a message or visiting a malicious web site. Some viruses consume storage space or simply cause unusual screen displays. Others destroy information. If a virus infects your PC, all the information on your hard drive may be lost and/or compromised. Also, a virus in your PC may easily spread to other machines that share the information you access.
Viruses can exhibit many different symptoms. If your computer behaves erratically, employees are advised to contact their organization computer support representative. At home, disconnect the PC from the Internet and run a full virus scan.
Worms are similar to viruses because they self-replicate, however, they do not require any user interaction to be activated. Worms spread because of vulnerabilities or "holes" in software.
Trojans (also known as backdoors) are malicious code hidden in a legitimate program that, when executed, performs some unauthorized activity or function. This can range from stealing your password and credit card information to allowing someone to take control of your computer. To prevent installation of Trojans on your machine:
Denial-of-service attacks are an assault upon a network or web site that floods it with so many additional requests that regular services are either slow or completely interrupted. In some instances, a group of remotely controlled, compromised desktops are combined to jointly attack a target system.
Hoaxes are email messages that resemble chain letters, offer free money, or contain dire warnings and offers that seem to be too good to be true. If you receive a hoax via email, delete it. Sharing hoaxes slows down mail servers and may be a cover for a hidden virus or worm.
Computers are now accessible via a variety of means. A person can even download data from the Internet to a cell phone. While convenient and fun to use, some good practices will help protect your information.
Laptops, PDAs and Cell Phones are more easily stolen or misplaced because of their size. Remember, if your laptop is gone, your data is too. Small computer devices carry information that must be protected.
If you use a laptop, remember the following:
People are constantly finding security holes (i.e. vulnerabilities) in computer software which could be used to infect your computer with a virus, spyware or worse. When vulnerabilities are discovered, the software vendor typically issues a fix (i.e. patch) to correct the problem. This fix should be applied as soon as possible because the average time for someone to try to exploit this security hole can be as little as a few days.
Phishing attacks use 'spoofed' e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers and credit card companies, phishers are able to convince up to 5% of recipients to respond to them.
As with most scams of this type, the recent US Bank and Citicorp scams attempt to obtain personal information from bank customers. Phishing scams attempt to obtain information such as account numbers, credit card numbers, user-id's, passwords, social security numbers, phone numbers, addresses and other personal information.
If you receive an email that requests this type of sensitive information, you should be suspicious of it. Banks, credit card companies, Paypal, Ebay, Stock brokerage companies, and most companies doing business online will not request personal account information via an email or a link in an email. If you have doubts phone the institution directly and use a url entered yourself to access their web site.
Microsoft has outlined Steps that you can take to help identify and to help protect yourself from deceptive (spoofed) web sites and malicious hyperlinks. In addition Microsoft offers advice on how to help protect yourself from phishing. Just as they do in the physical world, scam artists will continue to develop new and more sinister ways to trick you online. But following these five easy steps will help protect you and your information.
Is your machine:
Is your organization:
Home users may wish to call their ISP and/or anti-virus vendor.
During an emergency or disruption, critical information - the information necessary to run your organization's systems, record activities or satisfy legal and/or business requirements - may be damaged. The best way to protect information is to copy it and store it in a secure location.
Remote Access allows users to access data from outside locations using dial-up equipment and public telephone lines or cellular/wireless phones on the Internet. Because this form of access is designed for off-site use that may extend after normal business hours, extra measures are required to prevent unauthorized access.
Information is a critical asset. Therefore, it must be protected from unauthorized modification, destruction and disclosure. Security breaches can take several forms. The best defense against security breaches are conscientious and alert users. You are the most important person for early detection and prevention. Examples of breaches include:
If you discover a security breach, you should report the breach to your Information Security Officer or manager immediately.
Social Engineering is an approach to gain access to information through misrepresentation. It is the conscious manipulation of people to obtain information without their realizing that a security breach is occurring. It may take the form of impersonation via telephone or in person and through email. Some emails entice the recipient into opening an attachment that activates a virus.
Spyware is software that is often deceptively loaded on your PC without notifying you that it will load and what it will do. Usually this type of software collects personal information (including web sites visited, user names, passwords, etc.) without the knowledge of the user. This information is collected by remote computers without the users knowledge and can be used to perform illegal activities and/or subject the user to unwanted communications from companies that they have no desire to interact with. Spyware is related to adware, however, it is often embedded in software downloads for free software without informing the user that it will be included in the download/installation process.
Steps to Prevent Spyware from Being Loaded On Your PC:
Microsoft provides useful information about spyware/adware.
Spyware is software that collects personal information from you without first letting you know what it's doing and without letting you decide whether this is OK or not. The information spyware collects can range from all the Web sites you visit to more sensitive information like usernames and passwords. You might be the target of spyware if you download music from file-sharing programs, free games from sites you don't trust, or other software programs from an unknown source.
Spyware is often associated with software that displays advertisements, called adware. Some advertisers may covertly install adware on your system and generate a stream of unsolicited advertisements that can clutter your desktop and affect your productivity. The advertisements may also contain pornographic or other material that you might find inappropriate. The extra processing required to track you or to display advertisements can tax your computer and hurt your system performance.
The key is whether or not you (or another user of your computer) have been properly notified of what the software will do and that you have provided consent to have that software installed on your computer. In other words, is the software being deceptive in what it does or how it gets onto your computer?
Spyware and unauthorized adware are two examples of "deceptive" software. Deceptive software includes programs which take over your home page or search page without first getting your permission. There are a number of ways deceptive software can get on your system. A common trick is to covertly install the software during the installation of other software you want such as a music or video file sharing program.
Whenever you are installing something on your computer, make sure you carefully read all disclosures, including the license agreement and privacy statement. Sometimes the inclusion of adware in a given software installation is documented, but it may appear at the end of a license agreement or privacy statement.
Sometimes deceptive software gets silently installed on your system without any warning at all. If you use Internet Explorer as your Web browser, this can happen if your Internet Explorer security setting is set to its lowest value. Make sure to keep this setting at the medium level or higher. Doing so will help you control what is being installed on your computer. (We'll discuss this more in a moment.)
Have you ever had an experience where you were repeatedly asked to accept a download even after you said "no"? Creators of deceptive software often use such tricks to get you to load their software. If this happens to you, do not click "yes". Instead, try to close the Web page that first asked you to accept the download by hitting the "X" in the corner of the window. Alternatively, quit Internet Explorer and restart it to begin browsing the Internet again. If you visit a Web page that continually displays these tricky pop-up windows, that Web site may not be worthy of your trust.
Read on to learn how to help avoid infecting your computer with deceptive software and to find out what to do if you are already infected.
Most computer systems today rely on a Userid / password combination to control access and to protect the data that resides on the systems. This means that the strength of the protection mainly relies on the length and complexity of the password that people choose to use. It is easy to select passwords that are easy to remember and are similar to previous password used. Passwords should be easy for individuals to remember but they should also be hard for others to guess.
Here are some best practices when choosing, maintaining, and protecting your passwords:
Explore using two words separated by a number or punctuation, like "Pro%F0otball" or "l|0n&dog"
Take a word and change the case on some of the letters. Then, either insert a letter or punctuation, or replace some letters with numbers or punctuation (but avoid common substitutions like a->4, I->1). Even better, use a combination of insert/replace: (Example: bomber -> b0mBer -> b0m&Ber -> %0m&Ber)
This may be the best option for creating a complex password without having to remember it. Start by choosing an area of the keyboard to use for your password. Next, decide on a pattern for the password. For example, take the upper-left quadrant of the keyboard and create two lines using 2ws3ed3e or, better yet, combine that sequence which shift characters to get 2ws#ED3e. With this method, you don't have to memorize any passwords, you simply have to remember where the pattern starts on a keyboard.
Wireless networks and laptops are very popular for their ease of use and portability. The Internet can be reached via radio waves without having to plug your machine into a network. It is with the same ease of connecting that malicious individuals connect to unprotected networks. Attackers conduct drive-by eavesdropping, called 'war driving' to listen in on unsecured devices in homes and businesses. Take the following steps to secure any wireless equipment. Consult your equipment's manual for specific details.
Copyright © 2012 North Dakota Information Technology Department - ITD
Download Adobe Reader to view, print and collaborate on PDF files.
As ALWAYS the people are very helpful and friendly...TOP NOTCH JOB!