Front Lines is a guest viewpoint section offering perspectives on current issues and events from people working on the front lines of Canada's technology industry. Ross Chevalier is Novell Canada's chief technology officer and chief information officer. He can be reached at askross@onenetnews.ca. For more information on Novell, visit http://www.novell.ca.
Protecting yourself on-line is one of the biggest issues computer users have ever had to face.
The deluge we face everyday comes in a variety of forms: spyware (tracks what you do and where you go, and sends that info somewhere); malware (breaks stuff or formats your hard disk); scumware (plants questionable or illegal material on your hard disk); adware (tries to sell you stuff you neither want or need), and phishware (works to steal your identity). So what do you do?
Fortunately, there are some software organizations who build tools to stop the threats.
Step One: Download a better browser
Mozilla Firefox leaps to mind. Go to www.mozilla.org to download the most current version, add the necessary extensions to block ads, and configure the popup blocker to block everything, at least initially.
One of the best features is the ability to add trusted extensions. Despite how you feel at a given moment, you probably aren't interested in mortgages from Nigerian banks you've never heard of, or incredibly low priced prescriptions. You've seen them all and wondered "how could anybody be so stupid?" Apparently, it's quite easy, given the large number of honest people being fooled.
Now that you are browser-better-off, set your home page to either BLANK or a trusted site. You might also want to accept cookies only from the site you are actually on, to block images from all but the site you are at, and prevent re-direction windows. It's not good if you're starting a business demonstration, open a browser, and a hidden re-director pops you to a porn site...
In your e-mail, watch out for http links as they may not be malware, but phishware. Recently, banks from the U.S., Canada and UK have all had customers spoofed by phishing sites, as has eBay. Most of the real sites have instructions on how you can help the organization deal with the phishers. The phishing sites look real, so be careful.
Step Two: Install and USE a virus scanner
In truth, this should have been step 0.000001, but I've made the assumption you already have one running. Buy the anti-virus subscription, and set it to update at least once per week.
If your company deploys server-based AV, you STILL need one on your desktop, and you STILL need to update the patterns at least weekly. If your company doesn't have server-based AV, ask them why they don't. Senior executives are rightly motivated by shareholder value, and losing your e-mail system for a week because of the latest infection isn't good for that.
If you are an Outlook user, make sure your scanner integrates directly and don't open mail from senders you don't recognize.
Lastly, if this seems like a ton of work to you, consider switching to a Linux desktop or a Macintosh, since both platforms have substantially fewer viruses to deal with, and have security built right into the kernel.
Step Three: Purchase personal anti-spam software
Do this even if your company provides server-based anti-spam software at the messaging system perimeter. If they don't, they should. This isn't a discussion item. We all open the odd POP or IMAP client to check our personal mail. Look for anti-spam with flexible rules and some type of learning capability and look for integration with your messaging client. There are lots of good ones out there. Opinions vary, so do your research.
Step Four: Get yourself anti-spyware and anti-adware tools
If you are extra frugal, use the free versions of Spybot Search and Destroy (http://www.safer-networking.org/en/download) and Lavasoft Ad-Aware (http://www.lavasoftusa.com). If you want to see how your favourite stacks up, check out http://spywarewarrior.com/asw-features.htm. And by the way, that "free" detector you saw on your local website may actually be spyware, so here's a list of anti-spyware that is really spyware http://www.spywarewarrior.com/rogue_anti-spyware.htm.
Avoid the peer-to-peer sharing sites like Kazaa. They install more trackers, spyware, seeders, grafters and portholes than you can imagine. When you blasted through the End User License Agreement (EULA), you agreed to install all of it and share it with people you know. The EULA is binding once accepted, and many of the spoofier EULAs are now very long and make a whole lot of commitments that you accept when you click OK. Read the EULA, or be prepared to pay the price.
Now, sign up at http://www.spywarewarrior.com and download 'HiJackThis', at no cost. Run it, check the log produced for personal data you don't want to post, like usernames and passwords and post the log to the forum. An anti-spyware professional will be back to you with a detailed prescription to clean your machine, usually within 24 hours. Follow the prescription exactly, and then repeat the scan and upload again if more junk is found (there usually is).
Step Five: Purchase and install a decent personal firewall, and use it
Do your research and pick something very solid. Your goal here is not just to prevent the incoming, but also to deal with the secret outgoing. You'd be surprised to learn how many applications want to "phone home" or some other place very regularly. If you use a Mac, buy a licence for Little Snitch.
Step Six: Avoid the IM junk heap
If you must do instant messaging, use a secure client that doesn't send everything in clear text. If it doesn't SSL, that's a bad thing. Secure clients are available that work with Windows, Linux and Macintosh.
If you must use an open IM, look into securing it with GPG (Gnu Privacy Guard - http://www.gnupg.org), and if you can't do that, never put corporate or private information on the wire. It's readable, reconstructable and deadly. Why? Because you don't know what gets cached where, the location of the servers, or who is reading/storing it in the flow.
If you want parental controls, you'll likely need a separate piece of software since most of the bundles don't allow for time throttling, an important aspect of Internet access management. CyberPatrol (www.cyberpatrol.com) is quite good for Windows machines.
You won't go bankrupt putting tools on your machine(s), and the data you protect may be your own, including your own identity.