Archive

Archive for February, 2008

Dial up internet service difficult to target by attackers

February 27th, 2008

Traditional dial-up Internet services are sometimes referred to as “dial-on-demand” services. That is, your computer only connects to the Internet when it has something to send, such as email or a request to load a web page. Once there is no more data to be sent, or after a certain amount of idle time, the computer disconnects the call. Also, in most cases each call connects to a pool of modems at the ISP, and since the modem IP addresses are dynamically assigned, your computer is usually assigned a different IP address on each call. As a result, it is more difficult (not impossible, just difficult) for an attacker to take advantage of vulnerable network services to take control of your computer.

Broadband services are referred to as “always-on” services because there is no call setup when your computer has something to send. The computer is always on the network, ready to send or receive data through its network interface card (NIC). Since the connection is always up, your computer’s IP address will change less frequently (if at all), thus making it more of a fixed target for attack.

Dial up internet providers often include the option of an accelerator program. It will often be called Hispeed or some variation on that name. This name is not meant to trick you into signing up for dial up when you think you’re getting broadband, but it can be easy to make the mistake. Hispeed dial up is not equal to DSL and cable connections. The accelerator programs will compress images and text as well as cache (store) pages so that your browsing experience is much more efficient. Downloading and uploading speeds will remain the same. Broadband connections, on the other hand, will download and upload content faster than dial up, because the actual connection speed is faster.

What’s more, many broadband service providers use well-known IP addresses for home users. So while an attacker may not be able to single out your specific computer as belonging to you, they may at least be able to know that your service providers’ broadband customers are within a certain address range, thereby making your computer a more likely target than it might have been otherwise.

Now a days still dial up have demand in the world. It is not fully vanished. Due to some advantages and especially the security reasons some may prefer this solution. http://www.dial-up-place.com is a place where one can get the list of dial up service provider and other information to cater your needs ina best way.

Internet security , , , , ,

Information security is important for all businesses

February 25th, 2008

‘Security is important for large enterprises, but not for a small company like mine.’ Not true! Security is essential for large enterprises that provide access to systems and networks for hundreds or thousands of people. But it is also an important concern for a small or medium sized enterprise. If you answer ‘yes’ to any of the questions below, then security is an important issue for you. · Is any of your important company or personal information (whether yours or that of employees, customers, contractors or partners) stored on a computer? · Do you or your employees access any important information (including banking, credit card, supplier or delivery information) across an internal network? · Do you have a company website? · Do you or your employees use the Internet at work? · Do you or your employees use e-mail at work? If you answered ‘yes’ to one or more of these questions, then the security of networks and information systems is an essential part of your business. You need to take steps to review the security of your systems and networks and make sure that it is up to the task. Possible Solutions: ‘OK, so I need to consider security, but what can I do? We’re not a technology company, I don’t have an IT department, and I’m not a technical expert.’ Unfortunately, ignorance is no excuse for inaction. In these days of higher levels of network connectivity and ‘intelligent’ viruses, info rmation on an unsecured system can be quickly compromised, or the system itself can be used as a launching point for attacks on other systems and networks. Even if you’re not an expert, you still need to take steps to protect your company. Even with limited resources and expertise, there is much you can do to help secure your system and network access. Consider the questions below. Are you taking these steps? · Do you have a firewall on your computer if you have Internet access (especially broadband access)? · Do you have software to prevent and detect viruses transmitted by email or in documents? · Is security an important criterion when you choose software or service providers? · Do you understand the security functions of the software and hardware you already have? · Has anyone in your company taken a computer course to become more familiar with these functions? · If you have the resources and it’s appropriate, have you consulted a local expert on the configuration and deployment of your IT system? · Have you checked if there are resources from government, a local trade association or chamber of commerce that relate to computer security? · Have you taken steps to physically secure your computers, especially laptops and portables? · Do you regularly back-up data? And test your back-ups? · Do you require your employees to use passwords? · Do the passwords used contain both letters and numbers? · Are passwords kept securely (not written down or shared, for example) and changed at least every three months? · Do you try to train your employees on information security? · Have you told your administrative support and reception staff what information they may and may not give to callers and visitors? Call to Action: ‘All these things apply to my business, but it sounds overwhelming!’ Like any challenge, security in its entirety can seem overwhelming. This guide provides you with a roadmap for how to start and what questions to ask. However, there is no onesize- fits-all security solution. And there is no free magic bullet. Information security costs both time and company resources. But security is an essential part of doing business today. Information security may require some specialist knowledge, but the approach is not all that different from how you maintain the physical security of your business. For example, when you installed the doors and locks on your premises, you probably considered the following factors: · Usability · Functionality · Security · Reliability · Cost · Maintenance. Your systems and network access are no different. Choosing and installing general software applications and specific information security measures requires the same calculation of factors and costs. The steps you take to ensure the physical security of your business probably seem like second nature. But they are a learned response to known threats and vulnerabilities. Locked doors, secure filing cabinets, and a safe or cash register are all security steps that 7 we take for granted as just part of doing business. Securing our networks and information systems should be no different. Just as with other purchases, good information security requires both initial effort and ongoing checks. You need to do your research before buying security software, hardware or services. While you should expect the technology to work well, you still need to carry out the right checks to ensure that it’s working correctly. Appropriate features must be set and adapted to work with your existing computers, software and network connections.. . Many security vulnerabilities are created when people install a new application and simply leave all the default settings in place, making them much easier for unauthorized users to manipulate. It may seem complicated or overwhelming at first, but over time your actions should become so familiar and automatic that they constitute a ‘culture of security’. No one expects people running small businesses to review software code or understand the intricate workings of hardware. But you can and should read the relevant information, ask pertinent questions and get explanations of issues that don’t seem clear. By taking the initiative and showing that security is important to your business, you can go a long way to making sure that your information systems develop in a secure way. In some cases, for example when making significant changes to your information systems, you may need expert assistance in the initial configuration and deployment of the system. But it’s essential to keep asking the experts what they are doing and why, and to satisfy yourself that the choices made reflect your business needs and improve the information security of your business.

Business security , , , ,

Update business security technolgy

February 23rd, 2008

 All computers used in your business should have anti-virus software installed, and the virus definitions must be updated at least once a week (many providers have a one-click update). All incoming and outgoing traffic should be scanned for viruses, as should any disk or CD that is used, even if it is from a ‘trus ted’ source. At least once a month, computers should be scanned for viruses.  If your computers are connected to the Internet, and especially if you use a broadband connection, you must deploy a software firewall. This will help to prevent malicious code from entering your computer and potentially compromising the confidentiality, integrity and availability of your network. It will also help to stop your system being used to attack other systems without your knowledge. Software firewalls for use by nonprofessionals are readily available at a reasonable cost. Your operating system, virus control software or ISP may also offer a firewall. Consumer and popular trade magazines compare firewall functions and features of well known products, and so are a good source of information. Free shareware firewalls are available, but these usually require expert knowledge for correct use. o If your business has a small network that is connected to the Internet, you should consider deploying an ‘all- in-one’ hardware box that contains a firewall, anti- virus program and an intrusion detection system. This will  greatly simplify your use and maintenance of essential Internet security technology.

Business security , , , ,

Perform integrity checks on all new employees

February 21st, 2008

o Perform integrity checks on all new employees to make sure that theyhaven’t lied about their background, experience or qualifications.o Give all new employees a simple introduction to information security, andmake sure that they read and understand your information security policy.Make sure they know where to find details of the information securitystandards and procedures relevant to their role and responsibilities.o Ensure that employees have access only to the information assets theyneed to do their jobs. If they change jobs, make sure that they do notretain their access to the assets they needed for their old job. Whendismissing employees, ensure that they do not take with them anybusiness-critical information.o Make sure that no ex-employees have access rights to your systems.o Make sure your employees know about the common methods that can beused to compromise your system. These include e- mail messages thatcontain viruses and ‘social engineering’ ploys used by hackers to exploitemployees’ helpfulness to gain information that will give them access toyour system. Examples of ‘social engineering’ include a hacker using thetelephone to pose as a systems maintenance engineer or pretending to be anew employee.

Business security , , , ,

Due Diligence control through security audit

February 20th, 2008

Good information security includes knowing who has access to your system and being able to log that access. You also need to have in place a system to make sure that your security procedures are actually followed. The ability to audit and evaluate information security compliance is essential – you can’t manage what you don’t measure!

o You should audit important aspects of your security, for example, who has access to your systems and who has used what information.

o You should have a record for each one of your security procedures. For example, if your procedure says that you test your back-up generator once a week, someone should sign a record to show that this has been done. Keeping good records is essential to audit control.

o Some audit controls may be necessary for legal or regulatory purposes. Good record keeping will clearly demonstrate that you are complying with your obligations.

o An audit should ensure that the procedures you have in place are effective and relevant. It is a trigger to re-assess and re-evaluate the effectiveness of your information security standards and procedures. o Audits are only effective if you follow through on their findings and identify and implement the steps that need to be taken. A good audit trail is not just a paper exercise. If something goes wrong, the trail should let you to see what happened and why. This will help you to keep improving the security of your business.

Computer security analyses , , , , ,

Good information security includes knowing who has access to your system

February 19th, 2008

There is little information in security policy literature about quality measurement or improvement ofpolicy. Instead, the literature concentrates on suggesting what should, or should not be included in asecurity policy (McMillan 1998, Tudor 2001, State of Oregon 1998), and often neglects to take intoaccount other factors such as the psychology of stakeholders (Kabay 1994), or the security culture withinthe organization (Chia, Maynard and Ruighaver 2003).The quality of strategic information security policy is concerned with improving current practice. In otherwords, investigating how organizations develop, implement, use and maintain strategic security policiesand attempting to change organizational practice to improve the overall quality of the resultant policies.As with many organizational initiatives, this will be influenced by stakeholder behavior and beliefs.Importantly, acknowledging that different stakeholders will hold different beliefs about quality, andallowing the addressing of these beliefs will be critical in improving security policy quality.This paper focuses on the development of a set of factors that can be used to determine the quality of aninformation security policy within an organization. The aim of the research is to determine what factorscontribute to the quality of information system strategic security policies for an organization. We did athorough theoretical search through the literature concerning security research, to try and identify thosefactors that were deemed to be important to quality. Although a number of ideas of quality were formed,unfortunately, it was impossible to produce a framework for quality from this research. We next did asearch of other IT related fields, including auditing, software development and data quality and foundmany richer frameworks for quality in these areas. This paper reports on the adaptation of theseframeworks to the information security policy domain.The research draws on two research disciplines, data model quality and software quality, to present aninitial framework for the quality of information security policy. Whilst a number of case studies are beingundertaken as part of this research, we thought it more important to concentrate on the presentation of thequality framework, rather than on presenting the full case analysis as this is still continuing. We do,however, provide some insights to the quality framework through using some of the interesting findingsfrom the case studies which we wish to present in full elsewhere.We will now introduce a framework for security policy quality, discussing each of the quality factors andhow they relate to security policy. We then provide some insights as to whether these quality factors arefound in organizations using some initial results from the case studies currently being conducted.More at http://www.dis.unimelb.edu.au/staff/sean/research/Maynard-PolicyQaulity.pdf

Data Security , , , ,

Information security issues and resources for small and entrepreneurial

February 19th, 2008

There is no ‘one size fits all’ approach to information security, and there are no magicbullets. Information security issues and resources for small and entrepreneurialcompanies helps managers to identify and respond to the security issues that are relevantto their companies. Everyone who uses this guide needs to tailor their informationsecurity policy, standards and procedures to their own company. Each company isunique, with its own set of needs, resources and circumstances. But what everycompany, no matter its size or location, shares is the need to play its role in creating aglobal culture of security.If your company uses a computer, and if that computer is connected to a network,information security must be a part of the way you do business. Information securityisn’t just about technology, and it’s not just for experts. You can radically improve thesecurity of your business – and those you do business with – by taking a few small steps.Using proper passwords, a firewall, virus detection and making regular back-ups willmake a significant improvement in your security and the security of those you deal with.These steps require research and effort to begin with, but will soon become second natureto you and your employees.But remember, security is a continuous process, not an end-state. The extensiveresources on the ICC website give more information on a range of security topics, andfrom experts around the world. Information security issues and resources for small andentrepreneurial companies is simply a starting point for securing the way you dobusiness.For more information and resources on information security, please visit the ICC websiteat http://www.iccwbo.org/home/menu_electronic_business.asp.

Business security , , , ,

A simple cross-browser technique

February 16th, 2008

 This site may harm your computer can avoid by following a simple cross browser technique. Here it goes

1. First, download the blockPorn.pac file (right-click on link, select Save target as…) to a location on your local hard disk that is accessible to everyone

a) Open Internet Explorer
b) Pull-down Tools menu
c) Select Internet Options
d) Goto Connections tab
e) Press the LAN Settings button
f) Check on the Use automatic configuration script checkbox
g) Type-in file:// then the location of the blockPorn.pac file.
For example: file://C:\blockPorn.pac


h) Press OK twice to close both dialogs.

Computer security education , , ,

COMPUTER TAKES A LONG TIME TO START UP

February 16th, 2008

I have often heard about computer taking long time to start. Mostly the problem is heavy load on less rosources like small capacity ram or processor etc. Howevr the below  tips can be considered to overcome this problem.

Click “Start”, then “Run”.
In the “Open” field type “msconfig” and click “OK”.
The utility that opens will have “Tabs” at the top. Click the one that reads “Startup”.
You will see a list of all the programs that run when you start Windows. They will have check marks in the boxes to their left. We do not want them all to start.
Remove all the check marks (by clicking on them) except the ones beside “SystemTray” -  “ScanRegistry” – “LoadPowerProfile” and “Task Monitor.”  Also leave a check mark in anything that has the name of, or abbreviation of, your antivirus program or anything that looks like it might apply to “Norton” products.
Click “OK” at the bottom. You will be asked if you want to re-start your computer – do it. If, in the future, you notice things that you are used to loading when you boot up, but aren’t – and that you want to load – then go back and check their boxes

Computer hardware security , , ,

Using robot.txt as web security

February 11th, 2008
  1. Use the robots.txt file if possible
  2. ROBOTS META tag should be used if you can’t create the above file. It’s okay to use both methods if possible.
  3. If you know which robots you’re trying to prevent from indexing your pages, a particular search engine for example, go to the source of the robot and remove your page if possible. In other words, many search engines are providing ways for you to remove your URLs from their indexes without having to use any of the above methods.
  4. Make your page stand-alone if possible. Meaning, remove links to the page that you’re trying to keep away from robots. More links there are to your page the easier it is for a search engine robot to find your page. If your page is already in search engine indexes, it’s too late to take this preventative step.
  5. If you must have absolute protection from robots, password protect those pages in question. Since all other methods are “agreements” that both parties must acknowledge in order for them to work in full, preventing the page from being served is the only way to guarantee that robots will not be able to touch your pages.
  6. Robot files are good to use if some one restrict the access of certain files but a simple mistake can cost you a lot. If your site is business site and one put disallow certain directories wrongly, it means the search engines wont crawl your certain areas.

Computer security tools , , ,

Dealing with comodo firewall

February 1st, 2008


I was reading some forums about comodo firewall. Some users are not feeling easy in dealing with firewall. Here is a video tutorial to deal with this.

1. Go to http://www.personalfirewall.comodo.co… and download the firewall
2. Do what it says to download
3. set the level on the first screen to custom
4. go to the security tab on the top of the comodo firewall window. then add/remove zone click on your network.
5. stay on that tab and click on define a trusted application for all the applications that you trust and allow to run, the banned application is for files that you dont trust or is causing problems.

Video , , , , ,