There is no easy way to secure yourself

The New York Times has an excellent series of reports on topics related to digital privacy. I don't think technical people will be surprised by the technical issues described but some of the motivations of hackers might not be something we think about. And both the layman's description of the technical aspects and of the hacker motivations are elements that can be shared with friends, family and co-workers.

The message for us is that surveillance is far more common than most people would suspect and that being truly safe is extraordinarily difficult. The article puts to rest the idea that “I’m not important enough to be targeted.” Anyone who might be a conduit to a “high value target” must also be considered a possible target. Modern hacking tends to be a multi-step process by which the attacker uses lower level people to collect the information that will then be used to compromise the primary target. This is one of the reasons organizations need to consider security on an institutional basis and not based on the perceived vulnerability of specific individuals. A chain is only as strong as its weakest link.  One last thing: don’t assume that the value of your site is the value it represents to hackers. Hackers may want to use your server to run a variety of criminal activities.

Website Security Best Practices

What it is

The appropriate set of “Best practices” depends on the type of website being protected. One set of practices does not fit all. The precautions for a website offering public information is clearly going to require less attention than does a site that contains sensitive user and financial information. Once confidential information has been taken, no amount of effort can bring it back. This section has two sections. The first section, Basic Steps, applies to all websites and the second section, Advanced Steps, includes some of the considerations relevant to sites whose breaching would result in irreversible damage.

Designing for Security

Website security is rarely a topic of conversation during a web design process, yet it should be. Security is difficult to retrofit after a site has been created. With public websites, hacking attacks can range from being merely embarrassing to being a source of malware infections for website visitors. The need for security is far higher when personal and/or financial information is involved. Once a person’s personal information has been taken, it’s never coming back. In many cases, if money is stolen, it too may never be restored. Being aware of what a website collects and stores should be a fundamental part of the website design process. Adding security to a website after it has been designed tends not to be effective.

Basic Steps

1. Keep your site simple. What a website doesn’t have cannot be exploited. Most informational sites can be turned into static pages. “Static” just means the page is always the same. Commercial sites require the services of a CMS (Content Management System) to dynamically build pages. Because the CMS is a primary avenue of attack, not having one represents a significant improvement in security.
2. Update software. Most breaches are based on vulnerabilities already patched. Hackers take advantage of systems that have not been updated for months, if not for years.
3. Have a backup. The most effective way to repair a hacked site is to restore a recent backup of the site. 
4. Use strong passwords. A common method for breaking into a website is to login as the administrator. Use a strong password and two factor verification, if available. Some systems will also block login attempts from foreign countries or from IP addresses not placed on the website’s access list.

Advanced Steps

1. Use encryption. Websites with any non-public information should always be protected by an encrypted connection (HTTPS). The trend is for all websites to have encryption and digital certificates, but while it is still optional for informational sites, it should not be considered optional for sites that have any form of private information.
2. Use a traffic filtering service. A typical firewall works by blocking access to unauthorized traffic, but a website must be reachable. Website firewall services filter traffic, rather than block it. This service entails the traffic going through a system that looks at all the packets of data. If it sees a pattern inside a packet or a pattern of packets representative of an attack, the service does not pass the traffic to the website. This is a very simplistic description of such services, and not all services are the same, but high value sites should have some sort of traffic filtering.
3. Separation of data and website interface. Storing sensitive data on a second and isolated server can help protect the data in the case of the website being compromised. An attacker is forced to defeat two systems, not one.
4. Anonymize and separate user data. Collect only the information the site needs. If you don’t need a person’s birthdate or government ID number, don’t ask for it. If you just want to know if the user is a child, youth or adult, ask that or for the year of birth. When a report does not need to use the person’s full information, anonymize and abstract. Keep the most sensitive information in a separate database protected with more stringent access controls.
5. Get advice. A site with private information is always more difficult to secure and the ramifications of a breach are far more serious than they are for informational websites. Get expert advice on structuring the website for security. And then ask another expert to test the security of the site.
6. Use external credit processors. When it comes to sensitive information processing, such as for credit card purchases, it’s best to use an established provider.

Cautions

It’s impossible have absolute security. Even if the technology was perfect – and it never is – people are not perfect. They make mistakes and can be tricked into granting access to attackers. Generally, however, an attacker is scanning large numbers of websites for possible attack. If the above steps are followed, it is probable that the attacker will focus on a less well protected site.

Digital Certificates

Getting a digital certificate is becoming more important as browsers start expecting to see everything that is encrypted as needed a digital certificate. And, many things are expecting to be encrypted -- which is a good thing in terms of security. The digital certificate is what proves to your browser that it is created an encrypted link with the right computer. This is important because encrypted connections often contain sensitive information and one does not want to providing user names and passwords to faked site.

The bad news is that setting up a digital certificate is not an easy process. Most people have created "self-signed" digital certificates -- in fact it's almost impossible not to have self-signed certificates. But browsers don't accept self-signed certificates because there is no external proof that you are who you say you are. That's where a public digital certificate is required.

Below is a diagram of what steps are required to obtain and use a public digital certificate. In upcoming posts, I'll describe my experiences and challenges with getting and using my public certificate.

Microsoft System Sweeper

System Sweeper is an important tool that Microsoft apparently uses to scan computers that are manifesting problems that are otherwise not identifiable. I gather that people calling Microsoft for help and still have weird problems will be directed to this free utility. It's a shame that more people don't know about this utility because it finds viruses, trojans, and even root kits.

One of the problems with antivirus software is that once a bad piece of software gets on a computer, it can hide from the av software. This is especially true of root kits -- which dig under the operating system. The only way to find such deeply buried malware is to scan the computer's hard drive before it has been booted. That means booting from another device. System Sweeper comes from Microsoft as a bootable system. The image file one downloads is burned to a CD-ROM. The CD-ROM boots into a specialized version of Windows that has as its own function the running of System Sweeper. So far, most of the people I have given this disk to have come back reporting at least minor problems that they previously did not know about.

I suspect the main reason Microsoft does not make this important tool well known is because most users don't understand the idea of downloading ISO images and how to boot the CD-ROM drive. Because problems on your users' systems will come to haunt your network, it makes sense to make disks for your users and help them run this utility on their home computers.

T

Securing Your Internet Browser

The US Computer Emergency Response Team has a slightly old but nonetheless valuable document on how to secure one's Internet browser. Given the high level of risk associated with browsing the Internet, this form of security might be the single most important step you can take to keep your computer safe.

Browsers are serious applications. They just don't show you a picture of some remove web page, they are interacting with the web site's server in a variety of ways and they have the power to interact with your computer in ways similar to that of your operating system. In fact, some computer magazines have called the browser the new operating system. Great power brings great danger. The more a program can do for you the more it do against you.

The question of which browser is the most secure is frequently debated. Google Chrome now makes that claim because it has a system for isolating the activity of the web pages from the operating system. This isolation, called "sand boxing" is a system used by a number of applications, such as Java. It helps but is no guarantee of security. IE, frequently described as the least secure, can be made secure if the recommendations of CERT are followed. The problem with these solutions is that the end result is a browser that may not be able to do many of the activities expected of it. The best solution, in my opinion, is to make the default settings in IE strong and add sites you know well to the "trusted" list. These sites can do more because the browser allows them to access features that an untrusted site would not be allowed to use. If you go to a wide variety of new web sites each day, you might want to use Chrome, but if you only go to a handful of the same sites each day, a locked-down version of IE might be the best solution.

Even if you dislike IE, you should still read the instructions for making it more secure. Love or hate IE, the reality is that there are number of sites that only function with it. There are times that you have no option but to use IE.

Of course, the best form of security is common sense. The brain is still the best form of security software.

T

Living with Secunia

My last posting was about Secunia's online scanner. I've downloaded and used their personal software inspector. I have to say that I like it. It does not grab too much of the CPU yet it monitors the system quite effectively. Many applications these days automatically update. Secunia picks up on that and lets you know. This is useful so that you don't run home to put in a critical update when it has already been done.

There are a few things that can be annoying. The main one I have is that it keeps reporting a problem with a fairly unusual application -- in my case, a video camera monitor -- and offers a link to a fix. The fix is the same version as the problem. The video camera people probably will never update their application and given that their system running on my computer does not connect to the Internet, I'm not too worried. The solution I had to use is to "ignore" the application. I would rather not do that in the case there is actually a newer version at a later point.

Yet, given that most vulnerabilities are in the applications and not so much the OS, this tool is a must have. While most programs are getting better at auto-updating themselves, there are many applications out there that don't.

In the school environment, this system is also useful to discovering applications you might not have installed. When you seen an update pending for an application you didn't install or forgot to remove, this provides you a chance to take action. I like the fact that this scanner will tell you exactly where the offending application resides. Most updates don't do that.

I'm going to keep using this product!

T

Secunia: Automating the Windows Software Updating Process

Secunia is one of a short list of firms that perform vulnerability testing. While it does not perform many of the tests that a Blink does, it is light and can be run from Secunia's web site. Most users are aware that Windows system updates are important -- or at least they don't interfere with the automated updating system -- but many of the new threats come from applications such as Flash and Acrobat. These programs are in direct contact with the Internet in a way that exposes them to all types of attacks. Few users would think to even check to make sure these applications are updated.

Secunia is also very useful to finding applications you may not have even remembered installing. On my system it found an ancient version of WinZip. It clearly was not something I was checking for updates, yet many attachments come as zip files and WinZip will automatically start up to uncompress the zipped file. If the attachment was dangerous, WinZip would have been compromised. So, a program like Secunia is important to keeping track of all the potential entry points to your Windows computer.

T

Pigs Fly!

InfoWorld has a very good post on Microsoft's recent security advances. Microsoft has spent billions on security and now it is beginning to show. It's not that security is extremely difficult on its own; rather, it is the combination of security and compatibility with old software and old hardware that is the trick. Apple has been able to switch operating systems and start all over again. DOS application, on the other hand, still run on Windows. Personally, I prefer Apple's model but I can understand why Microsoft felt it had to drag its history into the future.

The posting covers a number of the new techniques that closes the doors on the most common avenues for attacks. Whether we like Windows or not, I think we can all agree that reducing the number of zombie computers slinging spam by the billions is a highly desirable goal.

What does all this mean to you? Basically, the answer to whether Windows is security or not must now be considered seriously and not just addressed by a derisive laugh.

T

Viruses cannot do what you cannot do

I've long held that one of the best methods of stopping viruses and other attacks is to refrain from using accounts with administrative privileges. What most people miss about virus attacks is that while a virus does things that you don't want to have done, but it does these unwanted actions as you. The computer operating system, in other words, believes that the requests from the virus is coming from you. Just another example of how computers don't "think" like a person. The idea of "why would anyone want to do that?" does not come into play with a computer.

If you are using a computer that cannot delete/create/modify applications, it is very unlikely that a virus would be able to do so, as well. Both OS X and Windows Vista deal with this issue by running in a standard -- limited -- mode and asking for permission. Of course, if you're one of those people who automatically clicks on permission pop-up windows, this security system does little good.

Beyondtrust has just released a report that documents that removing administrative rights on a Windows computer can protect it from over 90% of common security vulnerabilities. This is higher than even I was thinking it would be but it does confirm the notion that restricting user rights is a great security strategy.

T

OpenDNS for Internet filtering

I've been using OpenDNS for quite some time and recently started using their filtering system.

First, DNS is the system by which URLs, such as abc.com, become the IP addresses (123.132.123.132) that the Internet actually uses to get from one place to another. While DNS is an open source application, OpenDNS is not so much open because of DNS being open but rather that it is not tied to any given ISP. Most users on the Internet use either their company's DNS server or one supplied by their Internet Service Provider. ISPs didn't always spend a lot of money making their DNS servers fast and reliable. In come OpenDNS with their DNS servers. They have great up-time and the look-up speed getting the URL turned into something meaningful has been great.

OpenDNS makes it money mostly by displaying advertisements on the error pages it presents when the user mistypes a URL. You're going to get an error page -- and your ISP is probably going to have ads too -- so that's not a big deal. They also route Google searches via their server. I assume this is the type of revenue system that FireFox uses to get money from Google for any Google search performed from the FireFox search window. FireFox makes millions a year off that search box. And, I'm glad that they do make money. It's not loss to me and I am able to support a service that benefits me.

OpenDNS is a nice addition to a school's ability to block bad sites. The way this works is being creating an account with OpenDNS and telling them that you want searches from your site to be filtered. You can select differing levels of protection from nothing to very tight. Any student trying to reach a bad site either intentionally or unintentionally will get an OpenDNS block page.

The system is not a perfect solution. If you want your staff to have open access from the same network as the students, the same restrictions would apply. I don't think this is a huge concern given that even the most restrictive filter setting does not appear to block anything truly useful.

Another problem with using only OpenDNS to block bad sites is that it obviously cannot help you if your student knows the IP address of a site they want to reach. OpenDNS would not be involved. It would not be a lot of fun for the student to get around the system in this way, but it is technically possible.

And, some schools may have issues with ads being displayed. I don't think there is a work-around for this issue. Given all the ads that are in school materials and on vending machines, I would think these ads are no worse, but don't assume you're okay until you have asked.

I would recommend using OpenDNS as one element -- a free one -- as part of an overall Internet safety system. You should also tell the students' parents to use it at home.

T

DBAN before you recycle

Recycling is a long overdue process for old computer hardware. Computers are full of heavy metals and poisonous elements -- they are also full of vital data. Data are difficult to get rid of. Modern computers often hide supposedly deleted information rather than remove it. The problem is that a hard drives always has something on the surface. When you "delete" information, the system only removes the information's location from the operating system's file index. This is much like ripping up a telephone book and thinking all the people are gone.

DBAN is a tool that writes over every part of the surface. It does not care what the operating system says is there or is not there. If you want to make sure your are not giving away your data and/or licensed software applications, then use DBAN or one of the other secure erasing applications.

If your drive is not working, that does not mean someone cannot extract personal information. In such cases, take the drive our of the computer case and smash it with a hammer.

T

How a proxy server can help you

If you work in a large school system, you probably know proxy servers as something the school district runs to block web sites. If you're a technical person, you probably have sworn more than a few times when the proxy server has prevented you from reaching a tech support site or from downloading A/V updates.

While proxy servers can be useful for protecting students from bad content, they can also prevent you from reaching useful sites. Proxify is a proxy server intended for the purpose of hiding one's use of the Internet. Sites one visit via Proxify will have no idea who the real user is. It can also prevent ISPs from spying on your Internet habits.

So how could another proxy server help you? Well, the trick is that it is possible that Proxify is not blocked by your school's proxy server. If that is the case, you can send traffic to Proxify and the blocked sites would be sent by Proxify and not by you. Your school proxy sees you linked to Proxify but not to anything that it would have blocked. So, the solution to an invasive proxy server is another proxy server.

Proxify is not without problems. If you don't pay for their service, the connection speed and use of advertisements can be bothersome. This is an emergency solution and not a routine service. If you require regular service, you may wan to consider their $80/yr price.

T

How strong is your password?

Passwords have always been important to get right but with more and more information being put online in publicly accessible locations, such as Google docs, are potential security problems. It's likely someone will know your Google email address if you use Gmail. They are left with just getting the password. That effort could be easy to virtually impossible based on the strength of the password being used.

Password Meter is a free tool that will analyze a password for how strong it is as a password. Finding such a service is not that difficult, but Password Meter goes further to explain what aspects of the password it liked and didn't like.

T

What in the world is my computer doing?

One of the most common questions I get is: why is my computer suddenly going so slow? There are often explainable reasons, such as a new version of a program having been installed or a download of a patch in the background. But sometimes there isn't a clear answer. I found this blog posting which provides an easy way to capture what is connecting to the Internet. If nothing else, you'll learn just how many of your programs are communicating with the Internet. Most of them will.

This system is very useful but it may not discover today's Trojan horses. The new Trojans and spyware try to appear to be a legitimate program so that a personal firewall will not block its communication.

Give it a try. It doesn't cost anything and you'll probably learn something useful.

T

Ophcrack: Your double-edged sword

Ophcrack is one of many password cracking tools. While I cannot attest to their claims that they can crack 99.9% of passwords within seconds, it does should like they can get most passwords quicker than you would like. One of their tricks is to have a very large number of passwords encrypted into their protected form. The software then compares the encrypted password it finds on your system with the ones it has made. Once it finds it, it then knows the password required for that pattern to be produced.

The good side of this program is that it can help you to unlock computers that you don't have the password for. This can happen when you either forget, someone as reset it to something you don't know, or the computer has been donated and the owner is not around.

But, the downside is more obvious. A student could put in the ophcrack CD, boot the computer off that CD and then get the password. While I'm not positive, I suspect that finger scanners would not be much help because the finger scanner is only to confirm you identity and then the system inserts a password. The password would be sitting on the system. Probably it's complicated enough that you don't have to worry, but you may want to find out. The only system I would have confidence in would be a smart card system where the password is always changing and checked against a server in a remote and hopefully well-protected location.

T

How Encryption Works

Here is a nice article on how encryption works. I find that many people don't understand the fundamentals of encryption. Given that encryption is in many products, it's important to understand.

T

Wireless Security Myths

George Ou at ZDnet has written a good article on some of the myths related to wireless security. Given that I hear these frequently mentioned. Read what he has to say.

T

New Version of TrueCrypt

TrueCrypt has just announced a new version of their encryption software. Everyone is going in their direction, but they are still ahead of most of the new solutions in terms of being cross-platform and feature-rich. The new version works on Vista and adds a number of useful features. It's free and easy to play with.

T

Automate the security of your Linux servers

A firm called ConfigServer Services is offering a free script that will run a security assessment on many Linux versions. The script goes through the myriad of configuration settings to make sure that the most secure options have been selected. An operating system is no more secure than its settings. A poor job of configuration can make any operating system open to attack.

There are a number of similar services, such as Bastille, that should also be considered. Bastille also works on OS X.

T

One Laptop Per Child Security

Thankfully someone has decided to add security before they put something out. The OLPC people have created an innovative collection of security features -- mostly available now in pieces -- so that children will have security has strong as a high security government agency. Wired Magazine has a good story on the new security system. If you want to see more of the details, look at OLPC's Wiki.

Let's hope that more operating systems will incorporate these features.

T