R o o t s e c u r e . n e t
The Security News Site For Systems Administrators & Hackers Monday, 1st September 2014 @ 08:28:09 GMT 
Reports | Security Q & A for the home user
{3rd Mar 2003}
If your computer is connected to the internet you are and never will be 100% secure.  (A bug was recently discovered in Sendmail, a widely used email program which lay unnoticed for 15 years - ZDNet, CERT).  In most cases security is about mitigating risk to the lowest possible level, while considering the consequences / costs of a security breach.  This article addresses what risks the home computer user should be concerned about, why they are relevant, and how to take an active role in preventing them.

Does the average user on a DSL connection need to be concerned about security?
 
Yes, your computer is sitting connected to the Internet for long periods of time for anyone anywhere to attempt to break into it. One of the easiest and most effective measures is to ensure you install and correctly configured a firewall (which has support for limiting both inbound and outbound connections). However there is still risk from other sorts of attacks such as malicious programs or virus sent via email or present on e.g. floppy disks.
 
Why would anyone want to specifically break into my computer?
 
Chances are they would not, increasingly most break-ins are random with attackers going after easy targets, or those running vulnerable / easily exploitable software.
 
Why do I need to protect my computer?
 
Any personal information stored on your computer can be read / changed by anyone, and it could be used as a point to launch attacks on other computers / networks making it appear you are responsible.
 
Is it secure to shop online?
 
Yes and no, but the end consumer is never in a position to know this. Firstly to mitigate risk you should have an up-to-date virus scanner to ensure you do not have any ‘Trojan Horse' programmes which allow people full remote control of a computer giving them access to do anything you can. Secondly you should shop only with reasonably sized businesses that are more likely to care for your data once it is at their system, and flowing across their network. Problems can occur if the business you are doing a transaction with has poor passwords, doesn't not keep their software up-to-date, or has poor data handling / backup procedures.
 
Does the padlock symbol shown on most respectable eCommerce sites while entering credit card information mean I am secure?
 
No, the padlock symbol is an indication that the site is using SSL. This is a technology which allows the user to confirm the servers identity, and for the server to confirm the users identity, along with encrypting all communications between the user and server. To be effective the user must view the certificate by double clicking the padlock symbol and confirming it is from a trusted certifying authority, the date is valid, and the name on the certificate is valid matching the name of the site. It is important to do this, because it is possible for an attacker to perform a ‘man-in-the-middle' attack, sitting between you, and the server that you are connecting to forging packets to create the illusion everything is normal when in fact all data is being logged. This works because you establish a secure connection between the attacker and your computer, which then forges another one to the server you wanted to connect to, however simply checking the certificate can prevent this, and the attack is highly unlikely as there are much easier ways to get credit card information.
 
Should I ever give out my credit card details to a site not using SSL?
 
It depends, other technologies exist, which provide reasonable levels of security through Java / Java Script, and other proprietary products. However without SSL or some other secure encryption technology anyone between your computer, and the computer you are connecting to can ‘sniff' the network traffic and read in plain text all the information sent / received but again this is unlikely.
 
I have a wireless access point, and check my email / browse the internet from computers with wireless cards, am I at risk?
 
This depends on a number of factors. Your geographic location, for instance if you are in the middle of nowhere, then its highly unlikely, but if you are in a high technology area your more likely to run across neighbours with wireless networks or ‘wardrivers' (people that go around looking for networks) both of which would likely be able to see all your network traffic from a mile or so away.
 
Am I secure if I have an access point with WEP (Wired Equivalent Privacy - an algorithm used to protect wireless communication from eavesdropping)?
 
No, WEP sessions can be decrypted due to a flaw in the implementation of the protocol, but it is still worth using as it will put of all but the determined attacker.
 
How do I secure a wireless connection properly?
 
Consider tunnelling connections through SSH.
 
Am I secure using a wireless keyboard?
 
No, not completely but it is highly unlikely anyone would be able to intercept the radio signals sent out by the keyboard due to the very low power output. For more information see http://www.wartyping.com.
 
What can I do to keep informed about new security vulnerabilities?
 
You can signup to any of many security related mailing lists, such as "Microsoft Security Update for Home Users and Small Businesses" and Bugtraq, from Security Focus however this is not primarily aimed at home users.  Also there are numerous websites offering security news such as Security News Portal, and Hack In The Box.
 
I have another question which you have not addressed, can you help me?
 
Feel free to submit questions to: http://www.rootsecure.net/?p=contact