Chapter 3
Protecting Your Computer(s)
For most of us, our computer is the starting point for cyber defense. Whether it is a personal computer, a family computer, or a work computer, modern machines can run hundreds (or thousands) of useful programs, store terabytes of data, and of course connect us to the world of the internet. We use our computers daily to look up information, do our work, connect with friends, create documents, shop for necessities, and manage our money. If our computer is compromised—that is, if our computer is under the control of someone else—all of that is put at risk. An attacker who has compromised our computer can access everything we see or do with our computer, and use that information to cause us professional, personal, financial, or emotional harm.
So, protecting our computer is a key security priority. Fortunately, modern personal computers are tough, resilient, and are designed to be able to resist attack. It is unlikely that something will happen to your computer that will damage the machine itself so that you must get a new one or replace its components. However, personal computers are not indestructible. Just as modern cars are incredibly safe against accidents but can not prevent you from driving them into a tree, modern computers can protect you and your data, but can not prevent you from making mistakes or having accidents that are damaging.
This chapter describes ways you can protect your computer and the important data it contains from possible compromise, abuse, or malicious software.
Securing Your Operating System
The first line of defense for your computer is the operating system. Microsoft Windows, Apple Macintosh MacOS, and the various versions of Linux are the three most common personal computer operating systems. However, these operating systems are hardly the only possibilities. Hundreds of operating systems have been developed over the years, with dozens of versions of each operating system. There are literally thousands of possibilities. However, all operating systems are not created equal. Older operating systems are often highly vulnerable to attack, because they lack protections against modern attacks or contain vulnerabilities that have not been fixed by the developers. Unfortunately, newer operating systems require more storage and faster processors that may not be available on older computer hardware.
To secure your operating system, you should do the following:
–Run a modern operating system. Modern operating systems, like Windows 10, MacOS 10, or Ubuntu Linux 18, include protections against modern cyberattacks and are regularly updated with patches for vulnerabilities. Operating system vulnerabilities are found regularly, so you need to be on an operating system that is receiving regular patches against known vulnerabilities. If you have an older computer that can not run a current operating system, it is time to upgrade.
–Patch your operating system. The most modern, most secure operating system will not last long on the internet if it is not regularly patched. Back in 2004, a researcher connected an unpatched Windows XP machine to the internet and found that it was infected with malware 20 minutes later. Today, it would probably be infected faster. You must patch your operating system. Most modern operating systems include auto-update functions that automatically install the latest patches and reboot the computer when you are not using it. Make sure this feature is turned on.
–Maintain your drivers. Another component of your operating system’s security is the software drivers that allow it to support peripherals like graphics cards, cameras, printers, mice, or keyboards. Most of this software is built-in to the operating system or comes from the peripheral manufacturers. Because the software drivers interact directly with the hardware, they can be exploited to compromise a computer’s operating system. Make sure you are running current drivers from the manufacturer’s website. Watch out for third-party drivers and software that claim that they will update all of your drivers to the current versions—many of these tools are malware.
–Watch out for zero-day vulnerabilities. Just because you are running a fully-patched and hardened modern operating system does not make you invulnerable. Attacks called zero-days will succeed against a fully-patched system, along with attacks that exploit an application vulnerability or trick the user in some way. Your computer can still get infected or compromised, even if you have done everything else correctly.
Securing Your Applications
Your next line of defense centers around the applications you use on your computer. For most of us, the most important application on our computer is the web browser, but it is hardly the only application out there. Applications include word processors, spreadsheets, presentation tools, e-mail programs, organizers, financial tools, and of course games. Applications may also include utilities to help maintain your computer or deliver additional functionality like Java application support, Flash video streaming, or Adobe Acrobat document viewing.
To secure your applications, you should do the following:
–Run current versions of applications. Applications, like operating systems, become obsolete. Applications that regularly interact with the internet, like web browsers, are highly vulnerable to attack if they are not current and up-to-date. Older applications may be exploited by cyberattackers to compromise your computer. If you need to run an obsolete application, do not use it to connect to the internet, and retire it as soon as possible.
–Update and patch your applications. Applications frequently get patches and updates. For some applications like Microsoft Office, application patches may be handled automatically for you. For other applications, you need to periodically go to the application vendor’s website to check for updates and patches. Some applications have a built-in “check for updates” function. When an application update is available, make sure you install it and restart your computer afterward, if you are prompted to restart. Your work computer may be set up already to download patches. However, if you are getting messages telling you to update, check with your systems administrator to make sure your patches are working and if there is some action required of you.
–Remove old or unused applications. Every application installed on your computer is a potential vulnerability. The more applications you have installed, the greater the chance one of them is malicious or vulnerable and jeopardizes the security of the rest of your computer. Periodically check your computer for applications you do not use any more—remember that tool you installed last year and only used once—go ahead and remove it. If you have a work computer, make sure you check with your systems administrator before removing software that came with your computer.
–Keep track of your license keys. While a lot of the software we may install from the internet is free, many of our most important software tools, as well as our favorite games, are purchased and licensed to us. Those licenses are usually secured with license keys that may come in the software box or get e-mailed to us if we purchase the software online. Create a file—either physical or virtual—to store your license keys and keep track of them. You do not want to have to repurchase your software just because the original license key got lost.
Using Antimalware Protection and Personal Firewall
Many modern operating systems include “defender” features that help protect our computers from compromise or malicious software. These features may also be referred to as antivirus, antispyware, or antimalware tools. They may also be obtained from third-party security companies like McAfee, Symantec, ESET, and others and are generally available through an annual or monthly subscription payment. These programs usually deliver the following features:
–Secure your computer configuration.
–Recognize known virus, spyware, and malware programs.
–Detect software behavior that may be malicious.
–Increase security for web browsing and e-mail.
–Firewall to filter inbound and outbound connections.
–Protect your passwords, privacy, and payment information.
–Protect your family members using the internet.
–Protect your computer and data against ransomware attack.
–Help backup and restore your computer.
Not all antimalware packages have all of the above features, and some of the more advanced packages may have additional features, but the above features are some typical capabilities to expect. Operating system built-in antimalware protection is usually less capable than third-party products, but it has the advantage of being free, built-in, and usually automatically enabled. While it is usually possible to run multiple protection products simultaneously on a single computer, multiple protection packages may also interfere with each other, if they are all enabled for the same protection capabilities.
When using antimalware protection and a personal firewall, you should consider the following:
–Install current antimalware protection. Like with applications, you want to make sure you are running current antimalware software. The five-year-old antimalware software that came with your computer is not going to protect you, if it has not been maintained and updated.
–Ensure antimalware protection is turned on. It is easy to have antimalware protection installed, and then to accidentally disable it. Many malicious software programs disable antimalware protection as well. Periodically check your antimalware protection to ensure it is active and operating.
–Ensure antimalware protection auto-update is enabled. For antimalware software to be effective, it needs to be updated with current malware software signatures (i.e., identifiers) and the latest attack patterns. Oftentimes, antimalware software updates come out daily, due to the rapid emergence of new threats. If your computer has been turned off for a while, let the antimalware software update before you read e-mail or surf the web to unfamiliar websites.
–Enable inbound and outbound firewall, if available. Most personal security products include a firewall as well as antimalware protection. A firewall controls the network traffic in and out of your computer, and limits what programs can communicate with the network. For example, your web browser communicates with the internet, while a word processing program usually does not need such communication to work on locally stored documents. A host firewall also limits the internet’s ability to connect to your computer, which may protect your computer even if its operating system has vulnerabilities.
–Watch out for free “security” products. Many malicious software packages masquerade as free products to “enhance” your security or otherwise protect your system. If it were free, how would they develop good security? This software is usually malicious, or at least not as effective as it purports to be.
Limiting Administrative Privileges
Another feature of modern operating systems is the ability to limit systems administration privileges. What is systems administration? Systems administration is the ability to configure your computer’s operating systems and programs. Most of the time when we use our computer, we are just using it, not reconfiguring it. Opening an e-mail or viewing a website should not require re-configuring your computer or installing new software! Limiting systems administration privileges means that most of the time you use the computer in a nonprivileged role that is not allowed to change the computer configuration. If you want to change your configuration, you must go through an additional step to escalate your privileges before you can make the configuration change or install software. This systems administration protection guards against programs trying to install themselves without your knowledge. An attempt to change your system configuration triggers the protection and prompts you to check if you really want to allow the configuration change.
To limit administrative privileges, you should do the following:
–Configure non-administrator accounts. Modern operating systems can support multiple users of a computer. Most of those users—particularly children—do not need administrator privileges and should not be allowed to install software or reconfigure the computer on their own.
–Use systems administrator protection. Even if you are the owner of the computer, you do not need to be a system administrator all of the time. On Windows, this is called User Account Control (UAC); on MacOS and Linux it is the “root” user. Administrator accounts should not be used for normal day-to-day use of your computer.
–Watch out for administrative prompts. When systems administration protection is enabled, you should be prompted when software tries to install itself or otherwise configure your system. You will see this prompt when you choose to install a program, or make certain configuration changes to your operating system. If you see this prompt when you do not expect it, pay attention! Click “no” or “cancel” and look at whatever you were doing. If you were at a website or opening an e-mail or document, most likely that website, e-mail, or attachment is malicious. Stop and do not proceed!
Controlling Your PC Camera
Modern computers and mobile devices have cameras, just like smartphones. These cameras are usually used to enable video conferencing and are located above the screen on laptop computers. On desktop computers, they may be built in to your monitor, or a separate peripheral attached to the top of the monitor. The challenge is that if your computer is compromised by malware, the malware can turn on the camera and use it to spy on you without your knowledge. While this unauthorized monitoring may or may not be a big deal in your office, it could be embarrassing for a personal machine located in your home or bedroom.
To control your PC camera, you should do the following:
–Assess the risk of being recorded. Your computer or device camera can be on and recording at any time. While many cameras have lights to indicate when they are recording, those lights are controlled by software and can be disabled by malicious software to deceive you. Turn on your camera and look at what it can see. What room is it in? What is in the background? What is visible in the camera if you are not sitting in front of it? Are you okay if all of this information gets recorded and broadcast to the world?
–Beware of what you record. If you post video to the internet, consider carefully what you are recording. Is there a family picture on the wall behind you that shows your spouse and kids? Is there a diploma on the wall that shows what school you went to? Do not hold up a bill or a prescription bottle in front of the camera, as they may contain your name, address, and phone number. With high definition, all the above items may be visible on your recording using freeze frame capabilities, video enhancement, etc. Internet “trolls” look for just this type of information online and use it to harass people, even if the victims have not done anything wrong.
–Cover up your camera. While we can never be sure if our camera is truly “off,” covering up the lens means that even if it is on it can not see anything. When you are not using it, cover your camera lens with an opaque cover to be completely sure it is not being used without your knowledge.
Backing Up Your Operating System
Despite all of our security protection efforts, things still go wrong with our computer’s operating system, applications, and data. Be prepared! Even if you have all of your software, disks, and files, rebuilding a corrupted computer can take hours of time. A “full system backup” to an external hard drive enables you to rapidly recover your computer, programs, and files, if something goes disastrously wrong. Backup storage is cheap compared to the cost of the time required to recover and rebuild a corrupted computer.
To back up your operating system, you should do the following:
–Keep track of your software keys. Sometimes doing a system restore may cause software to need to be re-enabled, especially if your hardware has changed. Keep track of your software keys, so you can reactivate your software if necessary.
–Buy an external hard drive. While there are advantages to online backups that make copies of your files every day and are immediately available for restoration, these services do not protect you from ransomware or malware corruption that destroy all of your connected data. Buy one or two inexpensive external drives to keep your backups away from your machine. Better—keep one of them in a safe deposit box.
–Back up your entire computer. Make a backup of your entire computer including the operating system, programs, and files. Sometimes this is called a “bare metal” or “system restore” backup.
–Make a second backup of just your files. In addition to a bare metal system restore backup, periodically make a backup copy of just your files, so they are available to you separately. This file backup can be easier to work with if you just need to recover a single file or folder that was lost off your primary system. This file backup is also helpful for archive files like old photographs.
–Protect your backups. Password protect your backups so if they are stolen or fall into someone else’s hands they will not be usable. Make sure you know the password well and can remember it years later, should you need it.
–Use online backups. In addition to isolated offline storage that is protected from corruption or malicious attack, you can also use cloud-based subscription services like Google Drive, Dropbox, or Microsoft OneDrive. These services store your data “in the cloud” and can protect you from natural disasters such as a house fire or flood.
–Have multiple copies. Remember, if your data is precious, there should be more than one copy. If it is important, have at least two copies. If it is really important have at least three copies. If it is sensitive, encrypt all the copies. Do not let a mishap or mistake destroy your digital life.
–Be aware of system restore. Modern operating systems like Windows or MacOS include the ability to “system restore” or restore the operating system back to a known good state. Some of these features can reset the operating system while preserving your files, while others may delete your files or, more likely, your programs. Be aware of these features and understand how they can help you if there is a problem with your system.
Watching for Signs of Compromise
There is a joke on the internet where they show two identical pictures of computers, and ask the reader to identify which of them has been hacked. The fact is that there is no outward appearance change when your computer has been compromised or is under the control of an attacker. However, there are subtle signs that you can watch for to detect if something has gone wrong with your computer. If you see these signs, you should be prepared to completely restore your computer from a known good backup, or to do a “system restore” and reinstall your programs and data manually.
To watch for signs of compromise, you should consider the following:
–Unexpected pop-up messages. A normal operating system should almost never pop up a window telling you to do something. For the most part, legitimate operating system notification windows are designed to stay in the background and only bother you if there is an emergency. Pop-up messages for ransomware, antivirus software, or telling you to purchase something are all signs that your computer has been infected, or has opened a malicious website or page. If a phone number pops up on your screen, do not call the number.
–Changes to your web browser. Malware frequently changes your web browser. Changes might include changing your default web browser, installing plug-ins or toolbars to your web browser, or changing your search settings. If your browser has been changed or re-configured, you may have malware.
–Programs you did not install. Malware packages frequently include additional software packages above and beyond the original program. For example, you install a piece of freeware and then it installs a half-dozen other programs at the same time. Sometimes these programs are legitimate support code, but frequently they are malicious.
–E-mails you did not send. Malware packages may attempt to send e-mails to your friends and contacts purporting to be you. Worse, these e-mails frequently contain advertising links, links to malicious websites, or malware attachments. If your friends bring to your attention that you have been sending them unsolicited e-mails, your computer or e-mail account may have been hacked.
–Your online passwords are changed. If you find that you can not get into online accounts even though you are sure you have the passwords right, it is a sign that your computer or accounts may have been hacked. Attackers who have access to your e-mail accounts may use password reset features to take control of your online accounts. They may also cover their tracks by going into your e-mail account and deleting messages intended to notify you of the changes.
–Online protections are disabled. Malware packages frequently disable online protections like antimalware software. If you find that your antimalware software has been inexplicably turned off or is turned back off after you have turned it on, that is a sign your computer has been infected.
–System programs stop working. Similarly, malware packages frequently disable software tools like the Task Manager or Registry Editor (in Windows), or similar tools in MacOS or Linux. Disabling these software tools makes it harder for you to troubleshoot your system, or to disable the malware and manually remove it.
–Unexpected startup programs. When you first start your computer, there will be a flurry of activity as everything turns on, and then your computer should be relatively idle, waiting for you to do something. Open the Task Manager (Windows), Activity Monitor (MacOS), or System Monitor (Linux) to see what applications are currently active or running. There are related tools that tell you what programs are configured to automatically start every time you reboot your computer. Look over the list to see if there are unusual programs running, or programs using lots of system resources. If there are, research them to make sure they are legitimate.
–High central processing unit (CPU) or disk usage. Similarly, if your computer is working hard when you are not actively doing anything, such activity is a sign that unwanted software may be running. For example, malicious “cryptoware” uses your computer resources (e.g., storage and computing capabilities) without your permission to perform cryptomining calculations. Such unauthorized activity may be obvious due to its high resource usage, which slows down your computer.
–Fraudulent posts or transactions. If you find fraudulent posts on your social media accounts, or fraudulent transactions in your banking or e-commerce accounts, such activities are signs your computer or accounts may have been hacked.
Using Mac and Linux Operating Systems
“No, your Mac isn’t immune to malware.”
̶̶ Washington Post
Much of the discussion surrounding malicious software focuses on malware targeting the Microsoft Windows operating system. Just as the American bank robber Willie Sutton famously commented he robbed banks because “that’s where the money is,” most malware targets Windows because that’s what most people use. MacOS and Linux operating systems are also large, complex software packages just like Windows, and have their own flaws and vulnerabilities that can be exploited by malicious software. Therefore, major malware and ransomware campaigns include versions of their software for MacOS and Linux operating systems, as well as Windows.
With the above comments in mind, if you use MacOS or Linux operating systems, you should do the following to protect your computer system:
–Enjoy the fact that you are “less” vulnerable. While you are hardly invulnerable, you are at least somewhat less vulnerable as the majority of malware is written to specifically target Windows. Only the more advanced malware packages typically target your less-common computer platforms.
–Be cautious and vigilant. Make sure you are running a modern, supported operating system and programs, and patch them promptly. You still need to be cautious surfing the web, opening attachments, and installing programs. Websites you visit, e-mails you open, and programs you install can all potentially be malicious.
–Bad things can still happen. All the cyber protection in the world does not protect you from coffee spilled on a laptop computer, or a failed hard drive on a desktop computer. Backup your system and be prepared in case a disaster occurs.