A. What is at risk?
Information security is concerned with three main areas:
B. Intentional misuse of your computer
> Trojan horse programs
>Back door and remote administration programs
>Denial of service
>Being an intermediary for another attack
>Unprotected Windows shares
>Mobile code (Java, JavaScript, and ActiveX)
>Cross-site scripting
>Email spoofing
>Email-borne viruses
>Hidden file extensions
>Chat clients
>Packet sniffing
C. Accidents and other risks
In addition to the risks associated with connecting your computer to the Internet, there are a number of risks that apply even if the computer has no network connections at all. Most of these risks are well-known, so we won’t go into much detail in this document, but it is important to note that the common practices associated with reducing these risks may also help reduce susceptibility to the network-based risks discussed above.
1. Disk failure
Recall that availability is one of the three key elements of information security. Although all stored data can become unavailable -- if the media it’s stored on is physically damaged, destroyed, or lost -- data stored on hard disks is at higher risk due to the mechanical nature of the device. Hard disk crashes are a common cause of data loss on personal computers. Regular system backups are the only effective remedy.
2. Power failure and surges
Power problems (surges, blackouts, and brown-outs) can cause physical damage to a computer, inducing a hard disk crash or otherwise harming the electronic components of the computer. Common mitigation methods include using surge suppressors and uninterruptible power supplies (UPS).
3. Physical Theft
Physical theft of a computer, of course, results in the loss of confidentiality and availability, and (assuming the computer is ever recovered) makes the integrity of the data stored on the disk suspect. Regular system backups (with the backups stored somewhere away from the computer) allow for recovery of the data, but backups alone cannot address confidentiality. Cryptographic tools are available that can encrypt data stored on a computer’s hard disk. The CERT/CC encourages the use of these tools if the computer contains sensitive data or is at high risk of theft (e.g. laptops or other portable computers).
Information security is concerned with three main areas:
>Confidentiality - information should be available only to those who rightfully have access to it
>Integrity -- information should be modified only by those who are authorized to do so
>Availability -- information should be accessible to those who need it when they need it
These concepts apply to home Internet users just as much as they would to any corporate or government network. You probably wouldn't let a stranger look through your important documents. In the same way, you may want to keep the tasks you perform on your computer confidential, whether it's tracking your investments or sending email messages to family and friends. Also, you should have some assurance that the information you enter into your computer remains intact and is available when you need it.
Some security risks arise from the possibility of intentional misuse of your computer by intruders via the Internet. Others are risks that you would face even if you weren't connected to the Internet (e.g. hard disk failures, theft, power outages). The bad news is that you probably cannot plan for every possible risk. The good news is that you can take some simple steps to reduce the chance that you'll be affected by the most common threats -- and some of those steps help with both the intentional and accidental risks you're likely to face.
Before we get to what you can do to protect your computer or home network, let’s take a closer look at some of these risks.
B. Intentional misuse of your computer
The most common methods used by intruders to gain control of home computers are briefly described below. More detailed information is available by reviewing the URLs listed in the References section below.
> Trojan horse programs
>Back door and remote administration programs
>Denial of service
>Being an intermediary for another attack
>Unprotected Windows shares
>Mobile code (Java, JavaScript, and ActiveX)
>Cross-site scripting
>Email spoofing
>Email-borne viruses
>Hidden file extensions
>Chat clients
>Packet sniffing
C. Accidents and other risks
In addition to the risks associated with connecting your computer to the Internet, there are a number of risks that apply even if the computer has no network connections at all. Most of these risks are well-known, so we won’t go into much detail in this document, but it is important to note that the common practices associated with reducing these risks may also help reduce susceptibility to the network-based risks discussed above.
1. Disk failure
Recall that availability is one of the three key elements of information security. Although all stored data can become unavailable -- if the media it’s stored on is physically damaged, destroyed, or lost -- data stored on hard disks is at higher risk due to the mechanical nature of the device. Hard disk crashes are a common cause of data loss on personal computers. Regular system backups are the only effective remedy.
2. Power failure and surges
Power problems (surges, blackouts, and brown-outs) can cause physical damage to a computer, inducing a hard disk crash or otherwise harming the electronic components of the computer. Common mitigation methods include using surge suppressors and uninterruptible power supplies (UPS).
3. Physical Theft
Physical theft of a computer, of course, results in the loss of confidentiality and availability, and (assuming the computer is ever recovered) makes the integrity of the data stored on the disk suspect. Regular system backups (with the backups stored somewhere away from the computer) allow for recovery of the data, but backups alone cannot address confidentiality. Cryptographic tools are available that can encrypt data stored on a computer’s hard disk. The CERT/CC encourages the use of these tools if the computer contains sensitive data or is at high risk of theft (e.g. laptops or other portable computers).
No comments:
Post a Comment