Title: 4.3 Computer Security
Course: Information and Communication Technology: Module B > Section: Section 4 - Security Basics

4.3.1 Computer Security

There are two types of attacks to computer security:

- Physical - Theft, damage, or destruction to computer equipment.
- Data - Theft of, unauthorized deletion of, corruption of, denial of access to, or unauthorized access to data.

Threats are typically installed without the user’s knowledge. When a threat program is installed on a computer, it may take data from the computer and transmit it elsewhere, change the computer's configuration, or it can open a backdoor for future malicious attacks, to name only a few of the malicious actions possible.   Grayware, malware, adware, spyware, and ways we haven’t even thought of can infect and cause irreparable damage. There are two other ways to classify potential threats to computer security"

- Internal threats - Employees can intentionally cause a malicious threat or can allow an accidental threat
- External threats - Outside users can attack in an unstructured or structured way.

Computer equipment must be physically secured at all times.  Since computer form factors are growing smaller each year, the size barrier for theft is virtual gone.  Stealing the whole computer is the easiest way to steal data; therefore, physical computer equipment must be secured. Access to facilities or rooms can be controlled by locking them or posting security, using cable locks or screws to secure rooms or devices, using security cages or cabinets around equipment, and/or installing sensors on equipment. It is important to be proactive and make the criminals think twice about taking computers and data.  Users must also be aware of the fact that they must secure their portable devices such as laptops when they are traveling as laptop thefts in airports and from locked cars are also on the rise.

You must also think about methods of securing the data on the equipment. Consider using passwords on the computer BIOS, strong password protection, data encryption, port protection, data backups so that you have your data if the data is stolen, and file system security. Internal threats can be limited by using:

- Biometrics - Security features preventing access to a device through biological measurements. These include fingerprint scanners, voice recognition, and optical scanners.
- Smart Cards – Security features providing identification, authentication, data storage and application processing.

4.3.2 Computer Security

What can be done to protect from external threats? First of all, devices can be isolated from the public Internet through the use of Network Address Translation (NAT) or Port Address Translation (PAT). These methods create a private IP addressing scheme inside our networks and then translate our private IPs into a public address that can be routed over the Internet. This way a threat cannot see a device directly. Secondly, devices should be behind a hardware firewall. A hardware firewall is a physical device that blocks incoming and outgoing packets from passing through it thus stopping unwanted or unsolicited traffic. A software firewall, like the one built in to most operating systems, adds another layer of defense. A firewall should frequently be checked to ensure it is working at optimal efficiency. Many paid and free tools are available for this purpose (Shields Up, Nsauditor, SecurityMetrics, and many more).

Have a reliable anti-virus or anti-malware program, and keep it up-to-date. There are many free ones available (Microsoft Security Essentials, Malwarebytes).

Keep the operating system and applications patched, as well as keeping your device drivers up-to date are essential to protecting your computer. A computer’s automatic update feature should be on and periodically checking manually to see if everything is up-to-date. Users should be familiar with anti-virus/anti-malware software installed and how to keep it up-to-date as well as how to scan/disinfect devices.

Microsoft Windows operating system now includes a feature called Action Center that displays all system security features. It constantly monitors and displays the status of Windows Firewall, Automatic Updates, anti-virus software, anti-spyware software, Internet Explorer security settings, User Account Control, and monitors multiple vendors’ security solutions. The User Account Control (UAC) controls how users attempt to perform tasks that requires administrative access, then prompts for approval or administrator password, if the user is a standard user. It displays an authentication dialog box that a user must interact with before continuing.

Please complete assignments 4.3.1 and 4.3.2 in the lab manual