Re: Need recommendations on security

"Frog Prince" <[email protected]> wrote in message
news:[email protected]...
> I've a neighbor lady that has been using zone alarm (free_ and AVG
> (free)
> without incident for some time but is wants her system set up so that
> updates etc are done automatically.   She does not mind paying for the
> software but I don;t know what to recommend.  (FWIW She tried Norton and
> McAfee and was not pleased)
>
> She's on Charter Cable broadband and has a high end HP computer and XP.
> She
> also has a 15" lap top accessing via a wireless AP.
>
> Suggestions please and I'm open to up grades and other options as may be
> appropriate.

1) Set her up behind a NAT router with SPI (Stateful Packet Inspection)
firewall. That's the best protection you can give her against unsolicited
WAN connections. A software firewall can't even begin to compare with a
hardware firewall. I've seen both the Sygate and ZoneAlarm firewalls
cracked from the WAN side. I recommend either Hawking or Linksys routers.

2) Tell her the only time she should use Internet Explorer is when she's
manually checking for Windows Updates. The rest of the time, she should
use Firefox, with the following extensions:
AdBlock
AdBlock Filterset.G Updater
NoScript
RefControl
Javascript Options
Google Safe Browsing
SiteAdvisor (get this from SiteAdvisor.com)

Set up NoScript so all the sites she regularly visits (and trusts) are
allowed to use scripting, if they require it, and instruct her that under
NO circumstances should she click the 'Allow Scripts Globally' option.

Set up RefControl to spoof the Referrer for all sites. This makes it
impossible for sites to track where she surfs, yet still allows sites that
do Referer checking to function.

Set up Javascript Options to lock down what Javascript is and is not
allowed to do.

Since running the whole machine as a Normal User, Untrusted User, or
Constrained User is nearly impossible in most cases (most software assumes
you'll be running in an Administrator context), let her run as
Administrator, and drop program privileges for all internet-facing
programs (browser, email, IM, etc.) using the following:
http://msdn.microsoft.com/security/securecode/columns/default.aspx?pull=/library/en-us/dncode/html/secure11152004.asp
It's called DropMyRights, made by Microsoft. You set up internet-facing
programs thusly:

For instance, for Firefox:
Create a duplicate Firefox icon on the desktop. Right-click, select
'Properties' and change the 'Target' line thusly:
"C:\Program Files\DropRights\DropMyRights.exe" "C:\Program Files\Mozilla
Firefox\firefox.exe"

So:
Administrator context:
"C:\Program Files\Mozilla Firefox\firefox.exe"

Normal User context:
"C:\Program Files\DropRights\DropMyRights.exe" "C:\Program Files\Mozilla
Firefox\firefox.exe"

Constrained User context:
"C:\Program Files\DropRights\DropMyRights.exe" "C:\Program Files\Mozilla
Firefox\firefox.exe" C

I installed DropMyRights to a different directory than the default. I
suggest you follow my example when installing DropMyRights, it makes it
easier to find DropMyRights and makes for a shorter 'Target' line. The
biggest change in program privileges occurs with the change from
Administrator to Normal User, and most programs run just fine as Normal
User (whereas they may have problems as Constrained User), and that'll
prevent drive-by downloads of viruses and spyware.

Instruct her that she'll see a black window pop up and disappear just
prior to the internet-facing program starting. She shouldn't be alarmed by
this... this is the DropMyRights program, stripping privileges from the
internet-facing program to protect her machine. If she sees that black
window pop up, she knows she's safer than connecting to the 'net as an
Administrator.

3) Download the following anti-adware/anti-spyware tools:
Windows Defender (from Microsoft)
A-Squared (from EmsiSoft)
SpyBot Search & Destroy
Ad-Aware

Windows Defender will scan and update automatically each day. You can set
up Spybot Search & Destroy to scan automatically each day and to update
automatically, as well. For the other two, set up the Task Scheduler to
start them once a week. She'll have to click a few buttons to run them,
but she won't have to remember to run them. Conversely, you can skip
scheduling them, and run them manually when you visit her.

4) For antivirus, you can't beat AVG. For home users, it's even free. It's
got the best virus-detection ratio, it's unobtrusive, light on system
resources, easy to use, and just works.

5) Set up her wireless AP with WPA encryption (if her laptop can handle
it... 128-bit WEP if it can't handle WPA). This will keep war drivers and
bandwidth thieves out of her network, and prevent anyone from hijacking
her computers via the wireless connection. I've seen computer hard drives
filled with child porn, and set up with web servers... all installed via
unsecured wireless connections by spamming scumbags, so it's critical that
you secure her wireless connection.

6) Change the WorkGroup name from the default. Set up each computer with
the same WorkGroup name, so she can share files between her computers on
her network. Set up each computer with log-in passwords and disable the
Guest account if it's enabled. If she's averse to having to log in each
time she boots, you can set it up to auto-login.

7) Set up a Task Scheduler schedule to Process Idle Tasks (Google for it)
once a week... that'll start up the defrag, so her drives stay defragged.
Also schedule a disk cleanup like so:
Start >> Run >> cleanmgr /sageset:1
Click all the options available in the dialog box that comes up. Click OK.
Set up a Task Scheduler schedule to run cleanmgr /sagerun:1

That'll clean up junk files on her drive automatically.

8) For the software firewall... you've got a few options. For people who
always seem to acquire spyware, I install either Sygate or ZoneAlarm
(Sygate if they're computer-clueful, ZoneAlarm otherwise). For those who
never seem to acquire spyware, I utilize the built-in WinXP firewall.

Since she's behind a hardware firewall, and using a more secure browser,
it'll be more difficult for her to acquire malware. If you instruct her on
safe computing practices, and she takes your instruction to heart, she'll
never see spyware / adware / viruses again.

That's about it... that makes her machine more secure, and it pretty much
takes care of itself.