Protecting a computer from hackers is not hard but it is not perfect. No computer connected to the outside world is invulnerable. The best security is a plan that includes what to do when the plan fails. One can go all out to protect assets and reputation, but that may be overkill, only you can tell if it is worth the money and effort to protect your organization, yourself, and your reputation. A good plan will approach security with something that is cost effective, and easy to keep implemented.
The first things Don’t be an easy target, social engineering.
Silence is the best reply to a fool – Imam Ali
The most likely hacker attacks are well known to security professionals. The biggest hole is you, that is social engineering. Phishing, installing questionable software from pop-up links, trusting advice from a random web site is bad for security. Being skeptical is your best defense.
Phishing is a hacker technique that uses forged email to harvest usernames and passwords. Most commonly, it will be a request to reset your password from a financial institution or something similar. Don’t click on links in emails from companies you do business with instead go to your browser and go directly to the web site and log in to your account directly without using the link. One should be evaluating the likelihood an email is a fraud every time, big clues are the email is not actually from the organization the email claims to be represented. When in doubt contact the organization by phone, or by email, but don’t reply to this suspect email address, use a support email address from the company’s web site.
Phishing emails can get elaborate, and it is not uncommon for hackers to create a complete illusion with fake web sites that look like the real thing, fake email addresses, and fake telephone numbers. Be skeptical of every link you receive in email. One exception to this maybe when you have requested to reset your password or some other function that requires the organization to send you a link. These are safe for a limited time, don’t click any of these request emails that arrive more than a few moments after you have requested the change.
Don’t install software because a pop up has told you the web site you are on has found vulnerabilities on your computer, or something is out of date. This is almost always a fraud. If you suspect the pop-up warning is correct, then take appropriate actions off of that web page. For example, if a web page displays a pop up your computer is infected, skepticism and good security demands, you close the web page and scan your computer with your virus checking software. It is far more likely, the web site was trying to socially engineer you into infecting your computer or buying suspect software, then your computer is actually infected. If you receive a pop-up saying your Adobe Flash Player is out of date, close that page and open a new browser session, and go directly to Adobe’s web site and look for the updates for your computer.
Don’t accept calls from call centers telling you your computer is infected or your bank account has been hacked. If your bank calls you with such information ask them what department to contact and tell them you will call them back on the main contact number listed on your statement. If you receive a call from a software company ask to call them back on a number you verify yourself. You are far more likely to be contacted by fraudsters than by the actual companies.
Are you starting to see the pattern used by hacker’s social engineering attempts, they are trying to entice you into installing their software rather than the genuine article. They are trying to trick you into sharing passwords, or personal information by fraud and impersonation.
Never share your password with anyone who contacts you unsolicited. In fact, I would advise you to never share your password with anyone ever. That is probably impractical but keep in mind, hackers are clever, and your password can be used in ways you will not imagine until it is used against you. If you must share your password, only do it with someone you trust, someone with who you have regular communication, and only after confirming with them using a different method to contact them. Ask, why they need the password, and how long they need the password? Contacting them using another method is simple. For example, you get an email from your accountant for the password to an account you share. Call the accountant, text the accountant, but don’t respond to the email asking for the password with the question “why they want the password”. It is common for hacked email accounts to anticipate your email asking questions, and to auto-respond convincingly, same with instant messaging, and text messages.
A lot more could go into the first tier but if you can master being skeptical you will go a long way to protecting yourself. If you really need help, you should talk to us – we can help.
The second steps are harden your passwords, computers, and network
Use a password manager, even a bad one, if you are not going to do that, then use a password-protected note on your smartphone but for all sanity don’t use easy to guess passwords, avoid using the same password on different web sites and programs, and use long passwords with unusual characters in the password. I recommend using the Bitwarden password manager but all password managers are all pretty good. We have a series of articles in the works on how to use Bitwarden.
No computer software ever is written is bug-free. Software development is a complex process and uses software from many different sources to create applications and operating systems, it does not age well. All computer software needs to be updated frequently, frequent and scheduled updates are a sign of good software. Patch the software you use frequently and as soon as you can do so without putting your business processes at risk. If you are going to delay patching for a business reason, take extra precautions that the computer is isolated and protected.
Internet connections are a part of nearly all modern software, and software is vulnerable because of those internet connections. Even if the software does not actively use internet connections if it handles data stored in files on the computer it can be compromised by hackers. Word, Excel, Powerpoint, Accounting Software, pretty much all business and personal software uses or creates files and needs to patched. The sooner it is patched the more secure the computer. Regularly patched computers is an absolute necessity. For some of our clients, this is weekly, for most it is monthly. If you are doing it yourself, make sure you have a backup of the computer being patched. Things can and will go wrong while patching your computer.
All computers connected to a network need protection from the other computers on that network.
If you are on public wi-fi, or on someone else’s wi-fi, you can’t trust the other computers on the local network or on the internet. If you are connected to the internet then you are connected to every other computer on the internet and to any local computers sharing that connection (local network). You need a VPN or Virtual Private Network. A VPN will ensure that the connection of your computer is not being eves-dropped by other local computers, and it will ensure that you have known good domain name service. Software VPN’s work well for road warriors but get a good one, from a reputable software company. Many of the VPN software companies are hacker sites in disguise.
Network security is a very deep hole, and it has its own college degree. How much network security do you need? It depends on how much you trust the other computers on your network. If the computers on your local network, or sharing your internet connection are protected by a firewall, and you know they are on a reasonable patch schedule, and you verified they have a reasonable anti-virus policy, you should be able to trust the local computers. The point here is unless you trust the IT people, or you are maintaining the computers on your local network, you can’t trust the computers on your side of the internet connection and you can’t trust the internet. A firewall can help with security, but it is only useful if the local computers are not already burning.
A firewall can be software, or it can be hardware. If you are connecting your computer to the internet, you need a firewall. If you are connecting your office network to the internet, you need a hardware firewall. Some internet routers have simple internet firewalls built-in, they can offer a lot of protection for not much money; however, you really need to turn those features on, and you need to keep your approach simple with an internet router. First, change the password on your internet router, and password-protect your wi-fi. Don’t override settings to allow inbound traffic. If your organization needs to allow inbound traffic, you have grown beyond the internet router and need a good firewall.
Hardware firewalls are highly recommended. Higher-end internet routers will have some of the features you need but not all. A hardware firewall is a dedicated device that’s the only purpose is to impose a firewall break between your network and computers and the internet. They don’t have to be expensive, but they can be. If you have an office with more than one computer sharing an internet connection, you really should consider this a must. In the future, Silicon Business Systems will post some articles on how DIY firewall can be done, but don’t skimp here. A pfsense firewall or even less expensive opnsense firewall can protect a fairly large organization with diverse needs. Both pfsense and opnsense have VPN capabilities built-in. Name brand firewalls usually come with updates and if any computer needs to updated right away it is your firewall.
Virus checking and endpoint protection have evolved over the years and they are not as burdensome as they have been in the past. Many choices exist here and it is hard to distinguish one from another. Endpoint protection has been added to most virus checkers and offers additional protections like verifying your computers software firewall, scanning email attachments, and verifying inbound network connections are legitimate. All valuable. Unfortunately, Microsoft’s built-in virus checking is not adequate. You will need something from a good anti-virus company. Some of the better ones are Symantec, Malwarebytes, Comodo, Norton, etc. Not all of them are equal but most get the job done on Windows.
Let’s address Apple MacIntosh and anti-virus software. It is still true that Macs enjoy the lack of widespread computer virus infections. However anti-virus software provides protection from other types of infection, browser hijacks, and DNS poisoning can and do attack Macs on a regular basis and Macs have been increasingly targeted by virus developers. If you have a solid understanding of computer and network security, you can probably skip anti-virus software but unless you have the skills and the time you probably should not.
The third steps plan for the first two things failing
“We don’t know, what we don’t know” – Donald Rumsfeld.
No matter how well the first two tiers of our plan are implemented eventually they will fail. If they are well implemented, the plan will not fail often, but it will fail. New unknown vulnerabilities exist, and we are only closing the known holes. Plan for the plan to fail. This means having a backup of your data. A backup is not a backup unless you can restore it, so you need to restore your backup as a test every once a while. The test restores will give you a good idea of how long the computer will be out of service while you recover the data. The backup software I use lets me restore to a virtual machine hosted at one of Amazon’s Web Service data centers or Microsoft Azure cloud data centers. The test will also let you predict how your business will be affected by an attack, use this to develop alternative business procedures. For some this will be communicating delays to your customers, for others, this will be continuing with alternative devices and means.
Have a process in place to replace the computer that is currently not working (hopefully while it is being restored) until it is restored to service. This can be hard on small business but it can be done, if you need help coming up with a way, we should probably talk. One is none, and two is one. Multiple backups, off-site at a minimum, and both on-site and off ideally.
Protecting your computer is not hard but it requires a plan and commitment
We can do so much more but this is a start. None of the procedures described here are terribly expensive but it can start to add up. Every plan’s cost needs to measured against the value to the business it is protecting. If you are having a hard time deciding where to put your effort and money, start with the mostly free stuff. Good passwords, no dodgy web site software installations, be skeptical of all email, configure your internet router and block all inbound traffic and of course backup, backup, backup. That will get you a long way.
