INTERNET AND SECURITY

The proliferation of Internet Technology into our lives can not be overstated. May it be for purchasing various goods, keeping in touch with near and dear ones living in some far-away places, gathering important information in fractions of a second, downloading music, softwares, files etc at almost no-cost, we are using it in one form or the other. Keeping pleasant aspects of the Internet at one -side, we have to be cautious of the threats and risks we are exposed to while our computer is hooked on to the Internet. Basically, Internet is nothing but a vast network of computers. So as to say, we are connected to numerous other machines in the network when our computer is accessing the Internet. In this scenario, it is possible for a user in a computer to gain access to the information in another computer in the Internet or for malicious codes to spread to other machines provided some security mechanisms are not incorporated. As technology advances by leaps and bounds, so do the sophistication and types of the malwares like Viruses, Trojans, Worms , Key-loggers etc that are lurking somewhere in the network and interconnected machines, waiting to create havoc to the machines which are not secured. Thus, it is important to safeguard any computer which accesses the Internet thereby safeguarding valuable data, saving resources, time etc that otherwise may be wasted once a machine gets infected by the malwares. The approaches by which we can make our Internet journeys safer, pleasant and reliable will be discussed subsequently. The following four steps constitute ‘the four pillars of security’ in Computer technology:

1) Software Updates (Patch Management): Sophisticated softwares like Operating Systems, Anti-virus/Anti spyware packages can not be developed perfectly at a first go. Though they are subjected to rounds of rigorous testing before shipping, they may contain vulnerabilities/flaws (technically called ‘bugs’). Most of the malicious codes and even mischievous users (crackers/hackers) exploit such ‘bugs’ in the software to launch attacks. Hence it is mandatory on our parts to regularly update them. Majority of the softwares can be configured to automatically update themselves when the computer is connected to the Internet. Software vendors often provide remedies to the ‘bugs’ in the form of ‘patches’, hot fixes(critical updates) or service packs ( when patches are in large numbers). E.g Microsoft provided Service Pack 2 for Windows XP; Users can get updates from http://windowsupdate.microsoft.com/ for their licensed Windows OS.

2) Anti Virus, Anti Spyware softwares: To keep Viruses, Worms etc at bay, it is necessary to use reliable anti-virus softwares like Norton’s Anti Virus, McAfee, Trend Micro’s PC-cillin, Sophos etc. As these products may require licensing, we can use Grisoft’s AVG (www.grisoft.com) or AntiVir which are freely available for personal use. These softwares require to be updated regularly to keep the Virus Signature files up-to-date otherwise they may not be effective in detecting latest viruses. It is worthwhile to mention that using anti-virus softwares that are not updated timely is equivalent to not using the software at all. Newer generation of these softwares use ‘heuristic’ approach to detect any suspicious (or Virus like) activities in the computer. So it is better to turn on that option. It is advisable to scan our machine (especially removable storage devices like floppies, CDs, Pen drives etc) for Viruses. Moreover, the computer may be infected with spywares like Key-loggers which can record the keys pressed when a user provides sensitive information like Credit card details and report them to the third party who then misuses it. There may be textual files (or adwares) left as traces by the web-sites a user visited. Such adwares are used for targeted advertising and keeping track of the user’s preferences. To root out such e-pests, we can use anti-spyware packages like Spybot Search and Destroy, Lavasoft Ad-aware. If the Internet Connection is readily available, real-time scanning can be performed through:
For Viruses: http://www.pandasoftware.com/activescan
For Spywares: http://www.webroot.com, http://www.pestpatrol.com



3) Firewalls: A firewall serves as a guard to the computer by monitoring all the traffic that goes in and out of the computer (or the internal network). It checks all the packets (consisting of bits of information) for their source of origin, destination and allows the movement of authorized ones. For that, the firewall needs to know which programs in the computer are allowed to access the Internet and vice versa. A firewall in this mode is known as in ‘learning’ mode.
Moreover, it hides the IP Address of the computer to the outer world thus enabling the computer to work in ‘stealth’ mode and preventing the targeted attack to the computer. As it is the security check-point for the computer or the intranet to the outside world, it can be used to immediately cease the network activity in case some wrong-goings are suspected. A firewall is available in the form of Hardware or Software. The former variety is more reliable but costlier than the latter. But for the home users, use of freely available software firewalls like Zone Labs ZoneAlarm (www.zone-labs.com), Sygate, Kerio, Tiny may be a good option. Windows XP users can turn on its in-built firewall called Internet
Connection Firewall (ICF) but it may not be much effective compared to third-party firewalls. The firewall keeps a log of important information like Source/Destination IP Address of the traffic, timestamp, severity rating of attacks, direction, action taken etc.
One can check whether a firewall has been properly configured on one’s machine by connecting to Shields UP Test (www.grc.com).

4) Intrusion Detection System (IDS): An IDS is a software/hardware that alerts the users when the security of the machine is compromised by an external unauthorized agent and records all the activities such agent does after breaking into the computer system. It may not be of much relevance to the stand-alone users of the Internet but is of tremendous importance to the corporate users to whom each piece of data and information is precious. An IDS helps cyber-sleuths, cyber-law enforcement agencies to trace out the steps of attacks and then to zero-in onto the attacker.

Each of the above steps is equally important but at least steps 2 and 3 must be implemented by any user who connects to the Internet.
Besides, following points should be noted to make surfing safe and enjoyable:
• Use of secure Internet browsers: Widely used MS Internet Explorer is often criticized for its security loop-holes. It is necessary to strengthen it by installing Hot-fixes, Service Packs. E.g. MSIE 6 SP1. Alternatively, one may consider other browsers like Opera, Mozilla, Firefox(www.getfirefox.com), Safari (for Mac users) that are safe and contain a host of new features that are not available in MSIE. One should spend some time in configuration settings of the browsers such as Password Managers, Privacy settings, Cookies, Enable/Disable Scripts, disabling pop-ups and pop- unders etc. Sudden pop-ups with attractive contents are often the source of troubles, one should be cautious with them.

• Safekeeping of important files: Files and Folders with valuable data should be encrypted and password-protected in the computer with softwares like Cypherix Cryptainer (www.cypherix.com), Folder Guards etc which maintains a separate encrypted vault in the storage devices (Hard/Removable Drives) for storing such files. Even if the intruders are able to obtain such files, they will not be able to make anything out of it. Also, users of Windows NT family of Operating Systems like Windows 2000, Win XP, Win NT can use NTFS file system in their hard drive partitions so as to enable encryption of files and folders.


• Suspicious E-mail attachments: Attachments with file-extensions like .EXE, .COM, .BAT and other weird ones should not be opened. Cyber-criminals may masquerade as somebody known to you to send such e-pests.

• Information like Bank Account /Credit card Numbers etc should not be released to the Internet unless the user is convinced that the Communication channel is secure (e.g. uses https (SSL over HTTP) protocol and the likes) the third party involved for verification purposes are trustworthy (e.g. Verisign, Paypal etc) and that the sensitive information will be stored safely or destroyed after use.