Computer security is one of the most
important issues in the computer world. Almost computer users are
thinking about their security of computer as computer is a source of their
important data and as well their personal data. Users who use internet
including any network are thinking about computer security more because any
kind of thread and attack can make dangerous harm of their computer and also
risk personal as well as economical matter. With the number of viruses and
other malicious software that prey on exploits in the Windows operating system
increasing, you need to take preventative measures to make sure that your
computer does not become infected. Every computer user should keep their
computer protected and increase security.
Today I want to share on how you can ensure a hard security
of personal computer.
1. Controlling access to your computer
Secure
your computer is to reinforce the main entry point, the logon. If you have no
password on your account and have a computer that is not protected by a
firewall and other devices, then you are at huge risk of being attacked. Managing
user accounts is very important with Windows XP because the accounts are the
keys into the system.
Assign
a password and rename the guest account: Windows XP includes a guest account
that is disabled by default. However, at some time, this account may be enabled
by an application. If you have Windows XP Professional, I recommend that you
disable this account using the old Windows 2000 Local User and Group
application. Just in case it becomes enabled again, I recommend that you rename
the guest account and also assign it a password. Follow these steps to disable
the guest account:
1) Click
the Start button and select Run.
2) Key
in lusrmgr.msc and click OK.
3) The
Local User and Group application will launch. Right-click the Guest account and select Set Password.
4) You
will be prompted with a warning screen. Just click Proceed.
5) Type
a complex password in both boxes and click OK.
6) The
password has now been set. Next, rename the account by right-clicking it and selecting
Rename.
7) Type
in a new name, such as Disabled, and click Enter to save the changes.
The vulnerable guest account is now less of a problem.
Clearing
the last user logged on: If you are using the classic logon screen,
every time a user logs into your computer, their username is stored, and that
name is displayed the next time the classic logon screen is displayed. Knowing a
user’s username is half the battle of breaking into a computer. If you have
sensitive information on your computer, I suggest that you follow these instructions
to hide the last user logged on-
1) Start
up the Registry Editor again by clicking the Start Menu and selecting Run.
Then type regedit in the box and click OK.
2) Navigate
through HKEY_LOCAL_MACHINE > SOFTWARE
> Microsoft > Windows
> CurrentVersion > policies > system. Locate the “dontdisplaylastusername”
entry.
3) Right-click
the entry and select Modify. Then
type in a 1 to activate the feature. Click OK, and you are finished. If you ever want to reverse this hack,
just repeat the instructions above and replace the 1 with a 0 for
the value of dontdisplaylastusername.
Disable
and rename the Administrator account: The Administrator account is the
most important account on the computer. Users should not be using the computer
under the Administrator account. I like to disable my Administrator account and
rename it, so that anyone trying to get in with that account and at that
privilege level will not be able to. To disable the account, perform the
following steps-
1) Click
the Start button and select Run.
2) Type lusrmgr.msc and click OK.
3) When
you have the Local User and Group application on your screen, just right-click
the Administrator entry and select Rename. Give your administrator account
a new name, such as admin123.
4) Next,
disable the account by right-clicking the entry and selecting Properties.
5) Check
the Account Is Disabled box.
6) Click OK
to save your changes.
Make
sure every account on your computer has a complex password: All
of the accounts on your computer should have a complex password associated with
them if your computer is ever exposed to the Internet. Passwords such as
easy-to-remember words and key combinations like “asdf” are not good. A complex password is a password that is at least
seven characters long and consists of uppercase and lowercase letters as well
as numbers or other symbols. Ftm3D8&
is an example of a complex password. Something like that is impossible to guess
and will take quite some time for a brute-force technique to crack. Using
complex passwords on all of your accounts might not be easy at first, but after
a while they will grow on you and you will have no problem remembering them.
2. Protecting from vulnerable your
system
Our
computers are a vault of important information. You could have sensitive data
on your computer that you do not want the whole world to see. Data such as
family photos, personal documents, and financial information can be found on
almost everyone’s computer. If a virus or an attacker connected to your
computer remotely and gained access, that intruder could wipe out years of work
and memories as well as steal sensitive personal information. Ports are the
gateways inside your computer. When a computer program wants to communicate
with a remote computer, it makes a connection to the remote computer with a
port, with which it can then talk to the computer. Each computer has thousands
of ports-65,535 to be exact. The different ports of a computer can be thought
of as a bunch of different mailboxes. When a program wants to send data to a
remote computer, it sends it to a specific port (mailbox) number. Then,
provided that a program is on the remote computer that is set up to receive
data at a particular port (mailbox), the remote computer can then work with the
data that it was sent.
To
give you an idea of how open your computer really is to the outside world, I
recommend that you use one of the various online security screening tests that
attempt to probe your computer to find weaknesses. The following is a list of
sites that I feel does a good job of letting you know how open your computer
really is-
_ Symantec Security Check:
http://security.symantec.com
_ Sygate Online Services: http://scan.sygate.com/
_ Gibson Research Shields Up:
www.grc.com
_ DSL Reports:
www.dslreports.com/scan
Visit
a few of these sites and follow their directions to scan your computer. You
will be presented with a report that shows you the open doors that they found.
3. Keep your system updated
Automatic updates: In
order to keep your machine secure and free of the latest exploits, you must
update your computer regularly. Visiting the Windows Update Web site (www.WindowsUpdate.com)
once every few months is not going to result in a secure, up-to-date computer.
Microsoft releases security updates monthly and emergency security updates
whenever they are needed. The only way to stay on top of these updates is to
check Windows Update daily, subscribe to the Microsoft Security Newsletter,
or enable Automatic Update-
1) Right-click the My Computer icon
on the desktop or in the Start Menu and select Properties.
2) Select Automatic Update tab.
3) Check in a box on how you want to update your
system.
4. Use firewall
A
firewall is a special application that acts like a brick wall that is
protecting all of the ports on your computer. When a remote computer attempts
to access a computer on which a firewall has been installed, which is blocking
the port on which the remote machine is trying to connect, it will not be able
to connect and the data that was sent will be ignored and discarded.
Enabling
the Windows firewall: Windows XP has included a firewall
specifically Internet Connection Firewall (IFC) software since the product was
first shipped. Although the firewall has not been turned on by default, it has
always been there. The original firewall was a basic one-way firewall that
would block incoming traffic from the Web. One feature allowed users to open up
ports so that they could still use remote applications. This way, a user could
protect all of the ports on the computer except one or two that they had set to
remain open so that they could use a program such as remote desktop to connect
to their computer from a different location. The new version of the firewall
included as part of Service Pack 2 has a bunch of new features that makes use
of a firewall even easier while the protection it provides your computer
remains the same.
If
you want to use the built-in firewall to protect your computer, just follow
these steps to enable it-
1) Click Start button and select Run. Type firewall.cpl and click OK.
2) When
the Windows Firewall settings window loads, just select “On” and click OK to save your changes.
3) Click OK
once more to save the settings for adapter, and the firewall will be
activated. Now that you have the firewall set up, try using all of your common
Internet applications. If you find that some of them do not work, then you can
configure the firewall to allow them to pass through the firewall so that they
can still be useful.
Configuring
the Windows firewall: Configuring the firewall to allow certain
programs to work through it is not always the best thing to do. Because it will
expose your computer more to the outside world and increase your risk of
getting infected with something. However, in the short term or for an
application that you must use, you can make it work through the firewall. In
the original version of the firewall, the only possibility was to specify a
port number to open. Now, it is much easier to make an application work though
the firewall. Instead of typing in a port number, users can just select the
program on their computer that they want to have accessed through the firewall.
Using the new feature to open up holes in the firewall is pretty cool. Follow
these steps to open up the firewall for a specific application-
1) Open
up Network Connections again by clicking the Start Menu and selecting Run.
Then, type firewall.cpl and click OK.
2) When
the Windows Firewall settings window loads, click the Exceptions tab.
3) You'll see a list of all of the different exceptions that are currently enabled,
as signified by the check in the box. By default, a few applications will be
enabled. I recommend that you uncheck all of the entries unless you use them.
If not, then you are just taking an unnecessary risk by leaving those doors
open.
4) If
you want to add an application to the exception list so that it will be able to
accept connections and data from the outside world, such as an Instant Message
program that wants to receive files from other users, just click the Add
Program button.
5) Select
the name of the program from the list or click the Browse button on the Add a
Program window to select the executable of the application that you want to
open to the world.
6) When
you are finished selecting the program that you want to be able to access
through the firewall, click OK and
it will appear on the list.
7) Now
that the program is on the list, just check the box next to the name to open up
the firewall for the application.
8) Click
OK to activate your new firewall
settings
5. Disabling
Unneeded Services
Disabling
Remote Desktop connection: The Remote Desktop feature of
Windows XP is a great way to be able to access your computer when you are away
from the office or home. However, if you have poor computer security, the
Remote Desktop also is a great way for anyone to be able to access and control your
whole computer. Remote Desktop is a very risky application to leave exposed to
the world. Its security relies solely on your account password, which for most
users is easy to guess. If you do not use Remote Desktop, then it would be a good
idea to disable the feature. Doing so is a snap. Just follow these steps to
turn it off-
1) Right-click
the My Computer icon on the desktop or in the Start Menu and select Properties.
2) Click
the Remote tab to expose the remote access settings.
3) Next, uncheck the box under Remote Assistance.
4) Uncheck
the box under Remote Desktop as
well.
5) Click
OK to save your changes.
When
Remote Desktop connections are disabled, you have one less thing to worry
about— namely, someone having the ability to break into your computer.
Disabling
Messenger Service: Microsoft has included a service in the
last few versions of Windows that allows system administrators to send pop-up
messages to all computers on a local network. This service can be an invaluable
resource for administrators who want to get the word out about some upcoming server
maintenance. Unfortunately, the Messenger Service has been abused. Just because
any user can send messages to
the entire workgroup doesn’t mean that she or he should. This capability is sometimes not a good thing. Users that
are part of large local area network, such as just about every Internet user,
can send out a mass message to all users in the same subnet. As you can
imagine, some users that know how to use the service have started to abuse it
by sending spam to all the users in their same subnet. Nowadays, you may get
spam not only in your inbox but also in a pop-up window that could appear at
any time. The Messenger Service, just like any other service or program that is
accessible to the outside world, increases your security risk. Although there
is currently not an exploit for the Messenger Service that allows remote users
to execute commands on your computer, who knows what the future will hold? To
be safe, it is best to just disable this service. You will also be cutting down
on a new type of spam. Disabling the Messenger Service can be done by using the
Service Manager. Follow these steps to get started-
1) Click
the Start button and select Run.
2) Type services.msc in the box and click Ok.
3) The
Services Manager will load. Scroll though the list and right-click Messenger and select Properties.
4) Change
the Startup Type to Disabled.
5) Click
the Stop button and then click OK to save your changes. Now the Messenger
Service is one less thing to worry about.
Disabling
Universal Plug and Play: Universal Plug and Play (UPnP) is kind of
like an expanded version of the old Plug and Play hardware support. Universal
Plug and Play can not only detect local devices such as hardware (the original
version), but it can also detect external hardware such as printers across the
network or other PCs’ shared drives. It gives you the ability to easily add and
control devices such as a printer across your local network, an MP3 player, a
television, lighting devices, and so on. Universal Plug and Play can be thought
of as a way to make all of the different electronic devices in your home, or
local network, work together. However, there are very few devices, other than remote
printers and file shares that take advantage of the new protocol. Universal
Plug and Play will play a big role in our computing lives in the future, but not
yet. Universal Plug and Play also presents a security risk for your computer.
It continuously scans your local network, which could be a network that is open
to the world, for new devices and negotiates new connections. Just as with the
Messenger service, with Universal Plug and Play the surface exposure of your
computer is increased, which increases the risk that your computer could become
attacked and infected. Unlike with the Messenger Service, with Universal Plug
and Play a flaw has been found in the service and has already been exploited.
Microsoft was forced to release a critical security patch to fix Universal Plug
and Play so that user’s computers would no longer be vulnerable. Because there
are almost no devices that use Universal Plug and Play currently available on
the market, and it also presents a security risk, it is a good idea to just
disable the new protocol for now because 99.9 percent of you have absolutely no
use for it. Disabling UPnP is not a hard task. Just follow these steps to
disable the service with a nifty utility, called UnPlug n’ Pray, by Gibson
Research:
1) Visit
www.grc.com/unpnp/unpnp.htm and
download a copy of UnPlug n’ Pray.
2) Start
up the utility and click Disable UPnP.
3) Click
the Exit button, and you are done.
Using the utility by Gibson Research is much
easier than going back to the Service Manager and disabling the service.
Moreover, if you ever find that you need to use Universal Plug and Play, you
can just run the utility again and click Enable UPnP and the service will be
restored.
Disable
DCOM support: The Distributed Component Object Model, or DCOM,
is yet another feature that was built into Windows that has caused a great deal
of problems. Sure, it provides an acceptable programming interface for
programmers who are trying to write network apps, but there are better ways to
do that than to use a DCOM. DCOM has presented quite a few problems in terms of
security. Exploits have been discovered for it that has allowed an Internet
worm to spread to hundreds of thousands of Windows machines worldwide.
Additionally, a very small number of applications actually use DCOM. In all of
my computing experience, I have only seen one application that used DCOM, and
that was an inventory and store management software suite. Home and professional
PC users probably will never even use an application that uses DCOM. So why is
it on your computer? DCOM was one of Microsoft’s attempts to please software developers.
However, this attempt has clearly failed, and yet they still include it. The
only thing that it has given to operating systems such as Windows XP is headlines
in the newspapers about how some worm exploited it and has now infected
thousands of PCs. Disabling the Distributed Component Object Model is a good
idea for most computing users. That is, it is for everybody except the rare few
who actually have an application that the developers wrote using DCOM. To shut
down DCOM and increase the security of your computer, follow these steps-
Disabling
Remote Registry Access: As already mentioned, the System Registry
is one of the most important parts of the operating system. It’s where all of
the system settings and configuration data is stored. If you do not know what
you are doing and you just start editing entries found in the System Registry,
you can render your computer useless. So, protecting your computer’s registry
is very important. Included with Windows XP Professional (not Windows XP Home)
is a service that allows users with administrative privileges to connect your
computer’s registry and edit it. Having this service enabled and running is
just way too big a security risk. The vast majority of computer users have
little or no use for this service. Why would you even want to give anyone a
chance at trying to break into one of the most critical parts of the operating
system? Disabling this service is a snap. Just follow these steps-
1) Click
the Start button and select Run.
2) Type
services.msc in the box and click OK
to launch the services manager.
3) Scroll
through the list and right-click and select Properties on the Remote Registry
entry.
4) Set
the Startup Type as Disable and
click the Stop button.
5) Click
OK to close and save your changes.
Now you have knocked off yet another unneeded
service from your computer.
nice post
ReplyDelete