5 key things you should know about computer security

Computer security does not come easily.  It requires awareness of the ways in which computers and data are compromised.  To guard against loss, there are 5 key things you should know.

1.   Anti-virus programs are essential, but they’re not enough.

Anti-virus programs will not keep you safe from all attacks.   They are good for blocking older, known viruses, but they’re only as good for that if you keep them up to date.  Since there are always new viruses out there, the time between the virus discovery and an updated version of the virus library is a vulnerable period.

To maximize the effectiveness of your anti-virus program, update it every day.

2.   Vulnerability to malware is PRIMARILY a human-knowledge problem

Many scams are perpetrated by email “phishing” attacks.  These attacks work because the emails look to be legitimate, such as from your bank or a known vendor, complete with logo.

Even worse, it isn’t too hard for attackers to learn about your company by researching public information, and then targeting specific individuals in your company with “spear-phishing” emails.  These emails sound even more convincing because the person’s role is known and maybe even the person’s boss’ name.

There is no substitute for caution: Never click on a link in an email without first examining the detail of where it is going to take you.  You can do this in most browsers by hovering the cursor over the link.  When in doubt, don’t click!

3.   Passwords are often inadequate

When we log in to online services, we depend on passwords to identify and protect ourselves.  But we don’t want to bother with passwords that are long and un-memorable, so our logins are vulnerable to guessing.  In addition, we often use the same password over and over, so once one service is compromised, others can soon follow.

To protect yourself, use a password-generating program to make passwords long and un-guessable.  You can buy a program (such as “1Password”) and use it to keep a secure list of passwords on your computer.  Then you don’t need to remember your passwords and in addition you’ll have a central repository for all of them.  And you won’t use the same one over and over.

4.   Data loss is often caused by human action

There are lots of ways to lose data, and only some of them are caused by hardware failures.  For example, you may mistakenly delete a file, or you may modify data in a file without having a backup.  Also, you may delete your backup files.  Pay attention to what you’re doing when you’re moving or deleting files.  Make extra backups before doing a lot of file operations.

Then of course, you may not have any backups at all, because you haven’t set up an automatic process.  This is unwise.  Always set up an automatic mechanism that will back up your files.

5. Nothing can stop an insider who wants to cause damage

Pay attention to disgruntled employees & visitors.  Be aware of which computers are accessible to anyone who comes to your desk (or other desks).  Set up automatic “log-out” mechanisms, so that if you leave your computer, it will require a password to log back in.  And, of course, know who your visitors are.

Security depends a lot on what you know, what you do, and your willingness to invest the time and money to have the right tools.  Don’t blame insecurity on the malware.  Fix the tools and procedures in your own shop.

 

John will be on a panel Startup Candy: How to Be the Startup Everyone Wants to Work For on March 27 at 6:00 PM in San Francisco.  For a free ticket, visit Founders Space and enter “Levy” as your promotional code.  See you there!

The fastest way to kill your startup is with B players.  How can you attract–and hold onto–hot talent? Get ideas, real-life stories and advice on increasing your odds of funding, innovation, and success when you add smart, creative people to your team.  Our panel will discuss:

  • Why your team matters to investors
  • How to create a killer team
  • How to showcase your team to investors, partners and customers
  • How to identify and reach out to talented individuals
  • How to keep your team engaged
  • How to keep your talent from jumping ship for better opportunities
  • How to position your company as a hot career opportunity

Presenters: Josh Breinlinger of Sigma West Venture Capital; Max Shapiro of PeopleConnect; and John Levy of John Levy Consulting.

Why isn’t software more secure?

What makes software insecure?

Software is often insecure because it is complex, abstract and not completely understood even by the people who create it.  A software specialist who designs a human interaction module may not know much about the database software that the module depends on, for example.

In addition, software runs in a hardware environment (the computer system) that is not completely known by the creator of the software.  For example, when a software package is designed to run in a Microsoft Windows system, the hardware may have been manufactured by any of a dozen companies, each of which has its own detailed hardware environment (including things like BIOS, memory, storage, and input/output subsystems).

And the software itself has to keep changing to keep up with user expectations.  Software that doesn’t get updated gets stale.  [See more about this in my previous blog: stable or static]:

What vulnerabilities are there in software?

Software is vulnerable to many possible conditions that it may not be prepared for.  For example, unexpected inputs can lead to errors: if the software is expecting a number and it gets a value that is outside of reasonable bounds, it may have unpredictable consequences.

In addition, computer hardware can have exception conditions occur during instruction execution, such as dividing by zero.  These exceptions must be anticipated by the software, or else the program can simply terminate without finishing its work.

For example, one of the popular ways for hackers to break into computer systems is to create a “buffer overflow condition.”  If the software does not anticipate this condition, the computer can execute code that the hacker put into a data structure in advance, causing the computer to come under the control of the hacker.

Why are they always discovering new holes & vulnerabilities in our software and systems?  Doesn’t testing take care of these problems?

Proper testing can reduce insecurities and other bugs.  Often, software development organizations simply don’t use the best tools for testing.  But testing every possible case is impossible.  Testing has to be done using human judgment to decide the testing strategy.

[For an excellent exposition on this subject, see Gerald Weinberg’s book, Perfect Software]

Often the failure to do adequate testing is the fault of management.  When a software development project is behind schedule, the temptation to short-change the testing is very high, because testing is usually tacked on to the end of the development cycle.

[For more on this, see my previous blog: good software]

How else is software insecure?

Most software does not run in a vacuum.  Often it is interacting with a human operator.  When a program and a human are interacting, there are plenty of opportunities for misunderstandings.  For example, error messages may be confusing, or the human may take the wrong action in response to a warning message.

The people who make it their business to take advantage of software vulnerabilities – call them hackers or attackers – are becoming more sophisticated.  They may be after money or industrial secrets, and they often know a lot about the system and the person who is interacting with the system.

A whole class of attack, called spear-phishing, is based on deliberately showing misleading information to the human, such as an email that appears to come from the person’s boss.  Vulnerability to these attacks occurs both in the system (email delivery without validation) and in the person (accepting what appears at face value).

What’s an enterprise to do about insecure software?

As a first step, make sure that you have engaged security specialists – people who have studied and are expert in attacks and in security countermeasures.  The specialists should include “white hat” testers – people who deliberately try to break into your own systems in order to demonstrate vulnerabilities.

You should also ask questions of your project managers about tradeoffs being made between testing and quality.   You must recognize that when you choose to emphasize schedule, you often invite lower quality and therefore higher vulnerability.

Never assume that software is of high quality – and therefore invulnerable – until you have seen it demonstrated in actual use by real users.  And even then, expect to find vulnerabilities regularly, and be ready to fix them.

 

TO SUBSCRIBE FREE: https://johnlevyconsulting.com/blog

Just complete the simple form. Takes about 10 seconds. And you’ll also get a free copy of my report, “9 Mistakes That Lead to IT Project Failure.”

John Levy — Turn Around IT
      Helping business get full value from IT

https://johnlevyconsulting.com

PO Box 1419, Point Reyes Station, CA 94956    415 663-1818