Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software Windows

Data Security on Windows Machines? 118

Posted by Cliff from the keeping-prying-eyes-(and-fingers)-at-bay dept.
mcskoufis asks: "I am running my own company from home, offering various Internet related services to customers. I have rented a server which runs Linux and there are no current security or performance problems. However, because I cannot afford to have a business site with several geeks investigating into network security, I have some sensitive data on my Windows box at home which need to be safe from malicious marketers/kiddies having fun/etc. More and more marketing companies are working on very dirty tricks to gather email addresses and also turn windows (mainly) machines into mass mailing servers without the owners knowledge. With the latest worm attacks and also the sophistication of them, I feel even more and more vulnerable each day. Bearing in mind the fact that it is impossible to switch to Linux at home for a number of reasons and also that because of the business I need to be online 24/7/365 what the Slashdot community suggest as the best way to have a secure environment for my data while using Windows? Anti-virus software has proven to be not enough and firewalls create problems while performing daily business tasks on the server from home."
This discussion has been archived. No new comments can be posted.

Data Security on Windows Machines? More

Data Security on Windows Machines?

Comments Filter:

  • A few ideas (Score:5, Informative)

    by DetrimentalFiend ( 233753 ) * on Wednesday March 24, 2004 @04:20PM (#8659975)
    Now I don't really know how much this would help, so please correct me if I'm wrong, but maybe it'd be helpful to work in a normal user account. Most people that I know in the windows world just log in as administrator for daily work, but that seems kind of like working as root in Linux. Now, I understand that user security isn't as strong in Windows, but I wonder if you could lock it down enough that programs wouldn't install without your knowledge.

    Besides that, good virus software (we've got McAffe at work and are happy with it), using the firewall capabilities of XP (if you have it), and not using Outlook (if you can) would be good ideas. If you're really paranoid, and know how to configure it well, a Cisco pix box may add a little more security too.

    About your issues with firewalls disrupting daily activities on your server, you should look into VPNs. PPTP is very simple to set up, but has problems with man in the middle attacks. IPSec can be a pain to get working with windows, but it is possible. SSL tunnels probably would be the best way to go, and they're not too hard to set up.

  • WindowsUpdate (Score:4, Informative)

    by cloudless.net ( 629916 ) on Wednesday March 24, 2004 @04:20PM (#8659983) Homepage
    http://windowsupdate.microsoft.com It doesn't make your data 100% secure, but it is the bottom line action you must take. By the way, it is a good idea to disable any services that you don't need.

  • firewalls create problems while performing daily business tasks

    AFAIK, there's no way around sacrificing convenience for security (or the other way).

    If you really need some of those "convenient" business network traffic, you can try to setup a VPN so your Windows box remains behind a secure firewall.

  • "firewalls create problems while performing daily business tasks on the server from home"

    Depending on your level of knowledge and the type of traffic you're seding to-from work, any linux based solution should be able to facilitate your needs. Mind you, mroe complex problems may require more complex solutions.

  • Get a "Work" workstation (Score:5, Informative)

    by duffbeer703 ( 177751 ) * on Wednesday March 24, 2004 @04:27PM (#8660068)
    Buy a cheap computer that is strictly for business. Don't let your wife or kids on it and don't install games or surf for pron on it.

    I'd also suggest buying a smart card reader and storing all of your private keys on the card.
    • And, while you are at it, install linux on it and windows under VMWare workstation. Configure it, and you'll have a solid, solid box.
    • > Buy a cheap computer that is strictly for business. Don't let your wife or kids on it and don't install games or surf for pron on it.

      Buy a cheap computer that is strictly for pr0n and work. Don't let your wife and kids on it. (Well, if your wife digs it, what y'all do is your own business.)

      The only secure machine is the machine not on a network. Assuming sufficient pr0n on the machine, you won't have to connect it to a network!

  • Firewire (Score:2, Informative)

    by Hungus ( 585181 )
    Keep data on a removable drive of some type. Don't send documents via email. Your machine may need to be on and connected 24/7 (which I kind of doubt that you couln't segregate some things but you don't want to and that is fine) but that doesn't mean all your data needs to be avaiable online all teh time eitehr. firewire, usb and even hotswappable ata/sata/scsi drives are pretty darned cheap these days, so use one of them after all a hacker can;t get to your data or email if its not there right?

  • I've done this for years. (Score:5, Informative)

    by HotNeedleOfInquiry ( 598897 ) on Wednesday March 24, 2004 @04:28PM (#8660079)
    Set up a Windows server. No users, just file service. Don't let anyone use it, don't install more than a bare Windows installation. Set its network protocol to Netbeu or IPX *only*. Very important *no* TCP/IP. Don't let anyone muck with it.

    Set your user machines to both TCP/IP and Netbeu or IPX, depending on which the server is set for.

    Set your firewall to only allow mail, http, https and whatever else might be essential.

    No guarantees, but like I said, it's worked for me for years.
    • I agree with this comment (although I am unsure about the IPX Netbeu stuff, it does sound correct). In addition use a current version of windows for the server. Just upgrading to win2k3 server alone, will help to improve your security. Also be sure to run windows update every time a patch is released. You can tell windows to do this automatically.
      • The reason he would use IPX is that 99% of the vulnerabililties run over TCP/IP, and there will be no transport between your internet and the server (if you have TCP/IP turned off on the server) and will keep the script kiddies out! PS IPX will also let you play nice starcraft games over local LAN, woot!
      • Also be sure to run windows update every time a patch is released. You can tell windows to do this automatically.

        Yes, and it REBOOTS automatically too. Which is more or less acceptable for a server in the basement that no one uses, but not so good for a server with a bunch of users and a dodgy hardware problem that requires cold reboots (the Adaptec SCSI card didn't re-init properly for some reason when reset, it had to be powered off and it took me ages to figure out what the hell was causing the box t

        • Of course, you can tell it NOT to reboot automatically, you know.
          • No, I didn't know. It wasn't an option at the time, it may have been updated since. The options, IIRC, were the same as in XP: Notify, Download but not update, and Download and Update automatically.

            The Helpfile says:

            If you are logged on to your computer, Windows notifies you and gives you the option to delay the restart. Be sure to save any work prior to the scheduled installation time.
            Of course, you're not normally logged in to a server box. At night.
            • Yes, by telling it to Download and tell you when there's updates you prevent it from rebooting automatically. Setting it to Download and Update automatically, and then complaining that it does what you told it to do when you told it to do it is stupid. The updates are not installed until a reboot takes place, so in order to pdate automatically, it must reboot. That's why they give you a time and day to choose as well.

              Not to mention that it shouldn't be too hard to figure out what's rebooting the server sin

              • tell you when there's updates you prevent it from rebooting automatically.

                But it doesn't APPLY the patches. OK, we'll try this again: It's a server. It's not continually manned. Actually, it wouldn't even have a monitor attached to it unless I had to figure out WTF was happening to it. There's no option for mailing me when there's an update that needs installing/rebooting.

                Let's say I set it to download, but not update. It downloads security patches. Now, the server sits there, displaying a little icon

    • This method is flawed. Security through obscurity is no security at all.
      • I don't believe that this is security through obscurity, unless you count firewalls under that category (which they aren't).
      • It sounds solid to me, in what way do you personally gain for that guy to use less "obscure" methods? I don't wee Microsoft improving thier cutting-edge security as fast as they promote it. And untill they have something better I think alternative networking may be a good plan (like alternative OS for others).

        As I see it, if it works, it works. I'll tell you this one thing, my Commodore 64 hasn't been hacked in decades!

    • It appears that he's concerned about his daily-use machine. As far as that goes a file server as you describe it could/should be running Linux anyway.
      Even so, any virus/worm that gets into the workstation that looks for content on network drives is still going to find his data...

    • All the solutions you state, have been in place. The only thing I didn't know was the TCP/IP setting. Will try it out.

      My question relates to the fact that even with tight security precautions (unpriviledged user, norton antivirus, inactive non essential services and so on) the blaster worm got through to my system. Thankfully it was just meant to hit the windows website off. But how long before something even more disasterous hits the net?

      Have also used ZoneAlarm firewall, but could not connect to sev

      • Blaster got through because you had no firewall in place and obviously did not download the required CRITICAL updates from Microsoft. Visit windows update every day is the first lesson to take away from this.

        Secondly, I use Zonealarm and manage 8 servers on the net remotely. ZoneAlarm doesn't block based on ports, it's a program policy based firewall that blocks access to processes that are not trusted (they are not trusted until you click "allow this program to access the internet").

        Go to "Program Co

      • My question relates to the fact that even with tight security precautions (unpriviledged user, norton antivirus, inactive non essential services and so on) the blaster worm got through to my system. Thankfully it was just meant to hit the windows website off. But how long before something even more disasterous hits the net?

        The patch was out before the worms hit, so you probably didn't run Windows Update often enough. DCOM is not listed in services (it's bound to RPC, but that one can't be disabled). If y

  • Especially as you say that you cannot have a firewall, you have to assume that anything on the networked machine will eventually be hacked and your data stolen.

    Viruses aren't the issue: the Microsoft software that came with your machine has all the vulnerabilities the hackers need.

    Of course, you haven't told us what's so valuable about your data. Will your business immediately fold if it leaks out? Are you worried about having your customer list stolen? Do you have customer credit card numbers on you

    • I suppose that Gnome.org and GNU Savannah were running windows?

      Software has holes, period. There was a time not so long ago that people would laugh if the words "Unix" and "Security" were used in the same sentence. At this point, there is little difference between Windows, Linux and Commercial Unix.

  • Encryption (Score:2, Interesting)

    by students ( 763488 )
    Could you incript the particular files that are sensitive, so that by the time a cracker decrypted them, they were useless? This wouldn't work for a database that was accessed constantly without code editing, but for most applications, it would work well. WinPT [winpt.org] was the first application I found, but there must be many of them.
    • Actually, that is an interesting concept, and Windows 2000 comes with built-in file encryption if you don't want to spend a lot of money. (I assume XP does as well.)

      Works quite well, too -- it's tied to your logon account and is secured so that anyone who doesn't have your logon account gets an access denied error when they try to open the file. If you have services that need to access that file, you can secure it under the service account and the service will be able to access it transparently. Doesn't wo
    • Encryption doesn't give you the protection you want! MSFT file system encryption is pretty-good for laptops, in case it is ever stolen, but it can be defeated by spyware because spyware would run as the same user (or higher) who encoded the file. As the same user, it has the same right to decode the file. Suggestion for working from home: 1) Remove Everyone (which happens to include non-authenticated users) from your rights access to your disk drives and registry. 2) Create different users, one for your

  • Pull the cord. (Score:5, Insightful)

    by molo ( 94384 ) on Wednesday March 24, 2004 @04:32PM (#8660136) Journal
    If you really want it to be secure, de-network it. No ethernet, no modem, no wifi. Use another machine for network connectivity and put the data you want to take over (that is known to be clean) on a floppy or cd-r.

    Then get some good locks and a security system. Nothing trumps physical security.

    -molo
    • you could also add a "hacker" detection box to your net cable, it should be armed with scissors so any time when someone tries to hack you, it just cuts the network cable and everything will be ok :p.

      ok seriously now, i think you should try to look at some system balancing e.g. if some of your services really need windows then a windows machine could do it but for the security of data keep the data on a shared network drive (on linux or bsd box). so if the windows machine goes down with a big whistle (beli

      • if some of your services really need windows then a windows machine could do it but for the security of data keep the data on a shared network drive (on linux or bsd box).

        Why a shared network drive on a Linux or BSD box? Does he really need two different operating systems to keep up-to-date? Security comes from knowing your system inside and out. The security of any given box has much more to do with the knowledge and diligence of the administrator than with his/her choice of operating system. All tha

  • What I use.. (Score:5, Informative)

    by zcat_NZ ( 267672 ) <zcat@wired.net.nz> on Wednesday March 24, 2004 @04:34PM (#8660155) Homepage
    Internet (ADSL) firewalled by a FreeBSD server. Linux could do the same job. I also have spamassassin+amavis+clamav scanning my mail, and I keep all my files on a samba share, which is backed up to another server via a cron job.

    The only two windows machines on my network are actually my kids games machines (Windows, because there's very little good educational software for Linux yet!)

    I've replaced Outlook and Internet Explorer with FireFox and ThunderBird. I've also got open-office installed. Original files, drivers, and games CD's are all on the Samba server. Anything they type up or scan in gets saved on the Samba server. If anything weird happens to the Windows boxes, I simply nuke-and-pave.

    I haven't had any problems with Viruses or anything yet, but the kids don't tend to download stuff or share their email addresses too widely.
    • This is more or less what I was thinking -- only more detailed and stated more elegantly. What I am at least mildly curious about is why switching platforms is out of the question. In my case, I do ASP.NET programming so I am stuck with Windows until VS.NET is capable of running on *nix or Mac OS. If not for this "little problem" I could be on linux *tomorrow* since there is nothing else that ties me to the Windows platform...

  • Not foolproof, but low-maintanence and works (Score:5, Informative)

    by DaveJay ( 133437 ) on Wednesday March 24, 2004 @04:42PM (#8660254)
    Here's what I do to keep my wife's Windows laptop (with sensitive film production information on it) from being hijacked:

    1. Up-to-date anti-virus and zonealarm firewall on the laptop;

    2. Mozilla and Thunderbird for web browsing and email;

    3. A Mitel SME (formerely e-smith) Linux box between the laptop and the internet -- the firewall is very unobtrusive, but effective -- and the distro itself is low-maintenance;

    4. No wireless;

    5. Important but not commonly updated information backed up on CD-R and removed from the machine (you can't get information off the machine if it isn't there).
  • Oh ye of little faith...
    Switch now before its too late

    http://www.newsforge.com/business/03/08/13/12582 52 .shtml?tid=16
  • Why not setup a really secure firewall? Say a PF OpenBSD one. Disable ssh and everthing else you can live without if the machine is at your house. I don't see how that could interfere with any business needs?

    Ofcourse a firewall like that will not protect you from your own stupidity (if that is a factor, ie opening emailed viruses etc) or certain windows flaws, but as far as a firewall can go in security enhancement, you can't go wrong with a properly setup PF wall.
  • Firewalls don't create problems... they solve them. You need to have a firewall if you're connected to the Internet. Period. Whatever problem you're having simply needs to be solved. Cars don't technically need locks... they can "create problems" if you lock your keys in the car. But would you buy a car without locks?

    As far as anti-virus: keep your machines patched and don't open spam. In concert with a firewall, you should be fine.
  • You have a lot of open ended questions. But I'll take a shot. Your machine needs to be on 24/7 but does your sensitive data? If you only need that data when you are on the machine, spend 100 bucks and get a removable hard drive. As far as firewalls go, are you doing any tuning? If the defaults are too restrictive change them, having only one port firewalled is better than having none. As far as worms go, try and avoid the programs that help them propogate, namely outlook and IE, I use webmail and surprise s

  • Please Re-examine (Score:4, Informative)

    by ratboy666 ( 104074 ) <{moc.liamtoh} {ta} {legiew_derf}> on Wednesday March 24, 2004 @05:06PM (#8660552) Journal
    "Bearing in mind the fact that it is impossible to switch to Linux at home for a number of reasons and also that because of the business I need to be online 24/7/365 what the Slashdot community suggest"

    So you need Windows. Which is ok -- put Linux on another box, and secure it. I just bought a Compaq with 128MB of memory, 20GB or so hard drive, 400Mhz processor for 100$ CDN (80$ US or so). Used.

    Something like that would make a good firewall for you.

    Alternately, home routers also have reasonably firewalling. My SMC Barricade (gasp, yet, I know that a REAL geek wouldn't use one) offers the ability to drop in-bound traffic, and only allow certain ports through. This can provide you 80% of what you need (it does for me). Staying on top of patches can bring you the rest of the way. Just don't enable the "DMZ" feature!

    As you mentioned, you have external hosting -- which means that you don't have to allow incoming HTTP, or SMTP. If you don't need to administer externally (and since you use Windows, you *probably* don't), you don't need port 22. So, close off ALL inbound connections. Just leaves you with FTP as an issue -- some router boxes will accomodate, or you can learn to love the PASV command (and, AFAIK, MS browser FTP does that automagically).

    If you AREN'T using a small home router, GET ONE. They are even cheaper (I have seen brand new units selling here for $20 CDN, approx. $15 US).

    Don't forget a good backup plan, just in case you get rooted (or other disaster strikes).

    Still, buying a cheap box or two is reasonable. One for a "real" firewall, and another for SAMBA, and other internal services (DNS).

    Ratboy

  • Personally, I have an old P3-500 box running Mandrake 9.2 (only 'cos that's the distro I'm familiar with) that's hooked up to my ADSL connection.

    Firewall services are provided by Shorewall, and I use a combination of fetchmail, qmail, qmail-scanner, spamassassin, clamav, maildrop and courier-imap to clean my incoming mail.

    On my Windows XP boxes, I use Norton AntiVirus 2004, and Spybot - Search and Destroy.

    All in all, I find this reaches a decent balance between functionality and security, and I've never

  • A few things:

    1. Add a firewall if you don't have one. IPCop on an old Pentium will work (and be less hassle hardware-wise than the 386 or 486 it could also run on), which you can probably get for free by asking around.

    2. Encrypt the data on your hard-drive. DriveCrypt [securstar.com] looks pretty good for that and can encrypt the entire drive as well as specific directories.

    3. PGP/GPG-sign your email. Thunderbird [mozilla.org] does this with a simple plugin (takes about 15 minutes to set up). The commercial PGP works with Outlook
  • I would recommend to simply

    -use a non-administrator account on the PC for regular work
    -maintain Windows updates
    -use strong passwords
    -turn off all unnecessary services
    -configure only required networking
    -don't leave access "holes" like telnet, FTP, VNC, Remote Desktop, etc.
    -don't use dynamic IP services
    -don't put the PC in a DMZ
    -don't use the work PC for ANYTHING other than work-related stuff
    -maintain firewalls as needed either through a router, ZoneAlarm, or both

    Continually be vigilent and aware of things-
  • Do you pay for business liability insurance coverage? Of course you do. Local and state licensing requirements force you to, but even if you didn't anyone who's been in business for a while would tell you that you need it. What does this insurance cost you per $1,000 of coverage?

    However, because I cannot afford to have a business site with several geeks investigating into network security, I have some sensitive data on my Windows box at home which need to be safe from malicious marketers/kiddies having fu

  • If you want a secure WindowsXP system, you're going to have to get an expert to do it (or spend the time to learn yourself). There are a lot of steps to take, at a minimum. These are the basic mandatory steps though:

    - Good router/firewall at gateway (all ports closed by default, then open what you need and no more)
    - Clean WindowsXP install, all updated drivers/patches, ALL unnecessary services turned off, ALL unneccesary startup software turned off, and any unused windows components uninstalled (a good win
  • ..some some 'Security through Obscurity' [ibm.com]?

    When was the last time an OS/2 WARP Server was rooted? When was the last time OS/2 had a virus?

    Then again, when was the last time OS/2 WARP Server was available for purchase?

    Damn. If only I still had a copy...

  • Anti-virus software has proven to be not enough and firewalls create problems while performing daily business tasks on the server from home.

    You seem to have a cheap/free/software-only firewall. Try this Router/Firewall/VPN/File and ftp server [usr.com]. It's basically a linux-based router with an Intel IXP422 processor. Disclosure: I work there [usr.com], but aside from that, it's a pretty sick little toy.

    Unlike most cheap/software-only firewalls, you can configure the firewall on many levels (initial/final/input/output/WAN

  • Physical Security! (Score:4, Insightful)

    by Goyuix ( 698012 ) on Wednesday March 24, 2004 @05:48PM (#8661032) Homepage
    I worked for a graphics design lab (they thought they were a "branding" firm) for some time, and try as I might, they could not be convinced to purchase a firewall - as it was stuck in limbo as part of buying a new system/moving locations....

    What I ended up doing was simply keeping the sensitive documents etc. on a zip disk that I kept ejected except when I was modifying a list or looking up something. The rest of the time it was ejected. Granted, you would probably want some encryption on it as well, to further protect yourself but really physically separating your data from your computer should be paramount.

    I would like to echo getting decent anti-virus, running windows update, using some sort of firewall, run with less priviledged accounts, etc.... all good practices as well.
    • I agree with the parent post - keep your sensitive information physically disconnected when you don't need it. I would advocate a firewire or usb hard drive though. Assuming that you're not constantly accessing the drive for long periods of time, their performance is more than adequate. Simply disconnect when you don't need the data. This also means that you can carry your data around if you need it. I've got a 40Gb usb2 drive and I love it.

      The other thing that I would look at closely is which version of W

  • Poor man's firewall. (Score:4, Insightful)

    by Asprin ( 545477 ) <gsarnold@yahoo.cMOSCOWom minus city> on Wednesday March 24, 2004 @05:56PM (#8661112) Homepage Journal

    My first advice is to sacrifice an old PC to a real standalone OpenBSD or Linux firewall.

    If that's not possible, go to CompUSA and plunk down $50 for an internet connection-sharing NAT box. (LinkSys, NetGear, etc. usually call them modem-sharing/gateway/routers [*SHUDDER*]) If you aren't willing to invest in building and maintaining a real rule-based standalone firewall on a PC using Linux or OpenBSD, this is probably the next best thing and you can't beat the price. IT IS NOT TOTAL SECURITY - you still have to deal with internal threats (ActiveX, spyware, viruses, etc.) be aware thatthe models that are based on Linux kernels may actually be hackable to serve a terminal prompt (though I don't think it's been done) but the NAT/masquerading it provides will block incoming connections and hide your internals, and for most home/so users with Cable/DSL/Wireless connections, a NAT box plus Spybot S&D and Avast AntiVirus should be sufficient.

    If that's too risky, do what GNU does - keep the real (sensitive) data offline on an unnetworked box.

  • I'm going to assume that the Windows system at home is some kind of workstation, in addition to being a data repository of some kind, and that based on your comments, you need secure, remote access to this system. I'm also assuming that you want to maintain the confidentiality, integrity, and availability of your data.

    Some of my suggestions are processes. Some of them are specific technologies or products. In order of increasing complexity (and ridiculousness), do the following:

    1. Regularly backup y
  • You are a bit vague about what you are doing, so we have to guess a little. Here is one approach:

    1. Run your Linux server as you do, it seems to work.

    2. Take your MS Windows offline. No network connection at all.

    Do whatever you want on that computer. If it is incommunicado you are safe from long distance interlopers.

    Ah, but now you are going to say you do need to get some data across between the two. Okay:

    3. Get another computer, put Linux on it, set it next to your Windows box. Keep it secure*.

  • Freeware windows security 101 (Score:5, Informative)

    by cgenman ( 325138 ) on Wednesday March 24, 2004 @06:42PM (#8661552) Homepage
    "firewalls create problems while performing daily business tasks on the server from home"

    Not a well-configured software one. It's not as safe as a hardware firewall, but it is a heck of a lot safer than running around with your pants down, not knowing when your machine is connecting and what it is sending. It makes it difficult to connect *to* the machine, but your home winbox shouldn't be a remote server anyway.

    Grab ZoneAlarm [zonelabs.com] NOW, and put up with a few extra dialog boxes until it is trained.

    Furthermore, good Antivirus software will detect many trojans. Get AVG [grisoft.com] if you have alredy abandoned your AV of choice.

    This must sound like free windows security 101 by now, but get AdAware [lavasoftusa.com] and / or Spybot [safer-networking.org], and schedule a regular download / check for once every week.

    For encrypting sensitive or old data, you can either use windows built-in encryption (which uses your user password, enable this now if your machine is fast enough) and / or pick up a (non-free) copy of Dekart Private Disk [dekart.com], AKA The Bat! Private Disk [ritlabs.com], a simple encrypted virtual disk creator. Anything you really don't want people to see should go here... Just remember to shut it down when you're done.

    Furthermore, don't use I.E. and don't use Outlook. What many people refer to as "computer" viruses or "windows" exploits are really just I.E. exploits or Outlook viruses. Firebird, I mean, Thun... Firefox [mozilla.org] is a powerful little internet surfer, which while not as flexible as my beloved Opera [opera.com] (ducks), does render pages faster, is more beginner friendly, and is free. Thunderbird [mozilla.org] is a good mail replacement, though pegasus mail [pmail.com], Opera's built in e-mail client, and the non-free The Bat! [ritlabs.com] are all good choices. If you want the most security possible, try Secure Bat [ritlabs.com]. At 140 dollars per copy, it isn't cheap, but it does encrypt all of your personal files and utilizes hardware token authentication to ensure that you really are who you say you are.

    Finally, don't forget to regularly back up your disks to something not normally connected to the computer. For simplicity's sake, I'd attach an external USB drive and run Polder Backup [xs4all.nl] once a week, removing the drive when done. For a more automated approach, get a PC controllable X10 [smarthome.com] unit, and have it turn on and off the external USB drive, so that backups can be completely automatic.

    • That's it, this is slashdot so where I'd otherwise let this go, I have to be anal and reem you.

      "Firebird, I mean, Thun... Firefox"

      What you really wanted to say here was:

      "Phoenix, I mean, Firebir... Firefox"

      Thunderbird is the email app and still called Thunderbird AFAIK.
      • It was actually just a general comment on the confusing naming issues brought up by the mozilla people. People seem to get the assorted thund-fire-foxy-bird stuff confused all of the time, none of which is helped by the total lack of theming with the larger mozilla name. Personally I think they should just break down and call thunderbird "Charazard" and firefox "Flareon."
  • I am running my own company from home, offering various Internet related services to customers. Oh my do I feel bad for his customers. Hey I want to start a business coding from my house, Can anybody teach me C?
    • Can anybody teach me C?
      No problem! Ask Slashdot is always glad to help. Repeat after me...
      #include <stdio.h>
      void main(int argc, char *argv[])
      {
      printf("Hello, world!\n");
      }
      You just need to take it from here! Your first task is to modify this to become a *nix clone by inserting choice SCO source code...(*rimshot*)
      Lighten up, it's a joke.
  • You might want to encrypt it. Windows has EFS built in, which some people recommend. I'm a happy customer of Jetico BestCrypt, which i highly recommend.

    Encryption might be helpful against a physical break-in or computer theft. It might also aid against _some_ successful hacking, provided that you do not keep an encrypted volume mounted (thus accessible) when not necessary. This won't help if you've been rooted and keylogged, though.
  • then just forget about it.

    on a more serious note, have the computer behind firewall(or 2, one firewall off the computer). maybe even have the computer behind nat if that's not too much of an extra effort(this all just to make it harder, that windows might have open services by mistake).

    don't use outlook, don't use ie. sure you can have proxys for both that would scan for malicious stuff and not let it go through but really would you trust that?

    update frequently(maybe with windowsupdate even). however, if
  • 1. Whether you like it or not, firewall and open up what you need, that's both inbound and outbound, do NOT get a linksys router or other silly piece of hardware that believes in the concept of "trusted" interface. Be sure to have it NAT, although never get the impression that NAT is security in itself.

    2. Dedicate purpose, do not use one machine to fill multiple roles, instead use different systems for different tasks and run firewalls on each that are configured for just what traffic needs to go in and o
    • 1. Whether you like it or not, firewall and open up what you need, that's both inbound and outbound, do NOT get a linksys router or other silly piece of hardware that believes in the concept of "trusted" interface. Be sure to have it NAT, although never get the impression that NAT is security in itself.

      No one force you to use the DMZ. If that is not what you meant, I'd sure like to know because this didn't make much sense to me.

      15. Bios password the systems, prevent floppy booting, etc, change these pas
      • "No one force you to use the DMZ. If that is not what you meant, I'd sure like to know because this didn't make much sense to me."

        You are aware that most of the hardware firewalls permit ALL outbound traffic by default and allow all traffic in that is initiated from inside the firewall?

        "Useless, if they can get to the BIOS it usually means that they have physical access. This means that they can just pull a quick jumper, or use something like CMOSRAM.EXE to wipe all the existing settings (and password)."
        • You are aware that most of the hardware firewalls permit ALL outbound traffic by default and allow all traffic in that is initiated from inside the firewall?

          I gotcha, now I understand what you meant by a trusted interface. I thought you meant setting a DMZ to a machine inside the trusted zone or something, I just misunderstood.

          Thanks for the clearing up
  • There is always a trade off between security and convenience. If you secure your data, it will probably get in your way somewhere along the line.

    The most drastic solution is to take the computer off the internet. The fact is that if it is on the internet, it could potentially be cracked.

    The next possible solution is to change away from windows. Since you don't want Linux you may want to consider a Mac with OSX or a second hand SGI with IRIX. But to be honest, if you don't know what you are doing then
  • Like, for instance, BlackIce. THEN your Windows box will be secure fer SURE!

    Uhmmm... Oops. [computerworld.com]
  • Reasonable security is possible, assuming the attackers do not have physical
    access to the system. (If you have to protect against your family or your
    landlord, you're screwed.)

    First, get rid of Outlook. No, I mean it, get rid of Outlook. (This includes
    Outlook Express.) 100.0% of all known email-born viruses and worms[1] have
    exploited Outlook exclusively; get rid of Outlook, and you can stop worrying
    about email-borne malware.

    This leaves the issue of stuff that comes in over open ports, exploiting
    various
    • > put your Windows system behind a NAT gateway. You can use a dedicated
      > Linux box for this (IP Masquerade)

      Incidentally, this doesn't have to be expensive, since it isn't doing a
      whole lot other than sitting between your Windows system and the internet.
      It needs whatever it needs to connect to the internet (a modem, if you're
      on dialup), but you might be able to scavange that off your Windows system
      if the modem you have has hardware flow control. Assuming you don't need
      this Linux box for anything else
  • Google for it, I used it way back in the day (on Windows NT, 4 years ago almost) it's GREAT!

    Basically, it's really simple, it starts up on login, and how it works, is it'll prompt you when a program attempts to access the internet, and you say [yes/no (and remember choice)] and it will block or allow that program, really simple, fast UI, I NEVER got a virus in almost 3 years of windows.

    Windows Update maybe once a month never hurts
  • Simple - Buy a second computer, unplug the first from the internet, and never reconnect it.
  • -Lock down the registry with permissions -Change hard drive permissions to authenticated users instead of everyone -Do NOT use administrator all the time -Use the run as service to run as administrator when needed -Use Steve Gibson's Socket Lock [grc.com] to prevent the berkely sockets form being abused -Subscribe to Microsoft's Security Bulletins -Turn off all unnecessary services -Use Group Policy editor to clear swap file on shut down and do not enumerate SAM for anonymous users -Enable Full security auditting -Di
  • patch often,
    install appropriate AV software if needed,
    backup,
    keep sensistive data on more secure machines/areas.
  • I've worked with windows for a few years, even did some work under a MSCE wannabe back in the day. I've seen windows boxes 'hardened' out the wazoo, with much pain, bloodshed, tears, and the like. Windows has major flaws that can be exploited long before patches are out.
    If you have critical (read: confidential and/or mission critical) data, never, ever trust a single hard drive and windows. I learned this the HARD way.

    Find some slow hardware (a PII will do the trick if you don't need a ton of crypto), slap
  • If you wish to secure Windows box, never connect it to Internet at all. Connect it to trusted Linux networked computer instead. Do not use NAT in this case! Use samba etc. for data exchange between Windows and Linux. Download all you need manually with linux then copy to windows.

  • I don't know who told you that MS Windows could be online 24/7/365, but they told you a porky. According to uptime statistics on Netcraft, the *BSDs and Linux systems in general have MUCH longer uptimes than MS Windows systems. Having Unix systems with uptimes of over a year is not at all unusal, having MS Windows systems with uptimes approaching a month is unusal.

  • How To (Score:1)

    by jo42 ( 227475 )

    1) Format C:

    2) Download OpenBSD, FreeBSD or some Linux distro of the month before performing step #1.

    3) Install download from previous step.

    4) Profit!!! you clod.

    Surf some pr0n [empornium.us].

Slashdot Top Deals

When it is incorrect, it is, at least *authoritatively* incorrect. -- Hitchiker's Guide To The Galaxy

Close