Security for Your Personal Computer

by Eric Schechter -- version of 13 Aug 2000. I am not yet an expert on the information discussed below, but it's too important for me not to discuss it. I would be grateful for corrections or other comments; I may update the online version after a while.

Introduction: How much security do you need?

The need for computer security has gradually been increasing. When your computer is accessing the internet, the internet may also be accessing your computer. Even if you don't have any secrets or valuable information on your computer, your computer files be wrecked by youthful hackers who are just "out looking for a good time" -- a joy ride, as it were. You do lock your car, don't you? Even if you don't have any data on your computer that you fear losing, you would be severely inconvenienced if the hackers erase your hard disk. Also, your computer can be used as a stepping stone by hackers who want to wreck other computers.

To get some idea of how vulnerable you presently are, you might visit the website of Gibson Research Corporation, and click on the "Shields Up!" section. It will test your present setup and tell you how safe you are or aren't. -- For general reading about new developments in security, you may want to look at ZDTV's "CyberCrime" website, or in particular its page about firewalls, or see Cable Modem Information Network's tutorial on security.

How much security do you need? There is no simple answer to this. More money buys greater security, but no security is perfect. Your need for security increases if you use a system that is online all the time, such as @Home's cable modems, because you are a non-moving target.

To beef up your security, you might start at ACIS's security web page. It includes some free advice (for instance, turn off file-sharing!!) and also a bit of free software. However, I have talked with ACIS's head of security, and he says that ACIS is not presently able to provide you with all the software you really ought to have. In particular, you might feel the need for a firewall.

Antivirus software

Members of the Vanderbilt community can get antivirus software for free at ACIS's antivirus web page.

Firewalls

See introduction to firewalls.

I've begun looking at some of the low-cost security software; here are some of the products that I've heard the best things about:

ZoneAlarm 2.0 -- Windows freeware. It does not support Internet Connection Sharing, as pointed out by Chris Pirillo.
BlackICE Defender -- Windows, $40, money-back 30-day guarantee. PC Magazine called this one of the Best Products of 1999. A weakened demo version is available for free. However, Black Ice was totally ineffective against a recent hacker attack discussed by Steve Gibson.
Norton Internet Security 2000 (Windows, $54, advertised on tv, 30-day shareware)
DoorStop Firewall (Macintosh, $49 for education users)

I saw some other inexpensive programs at a computer store recently. These firewalls support internet connection sharing -- but I don't have any reviews of these products yet:

You can find reviews of most computer products by typing their names into the Search blanks at either of

http://www.cnet.com/ or http://www.zdnet.com/

Security alerts

Firewalls and antivirus software are the two biggest things you can add to your system to protect yourself, but they aren't enough. No fixed set of software is enough; hackers keep thinking up new ways to attack you. You may want to follow the news, e.g. by frequently checking some website such as ZDTV's "Cybercrime" site.

There are various news services that you can subscribe to; some of them are free. In particular, members of the Vanderbilt community can subscribe to the Vanderbilt AntiVirus Mailing List. If you subscribe to that, you'll get email messages -- typically one or two a wek -- warning you about new threats and what to do about them. They deal not only with viruses, but with other security topics too. For instance, one recent message announced that people who use java on recent versions of Netscape are vulnerable to a new type of hacker attack. Until a remedy is found for this problem, Netscape users should turn off their java capability.