Backups

Securing your information starts here. You'll need some or all of the security tools listed below, but even then you can't guarantee 100% that you won't have a problem. I've never lost any data due to viruses or hackers, but I have lost it due to hardware failures (yeah, I know...I should have taken my own advice and backed up our stuff more regularly. But you can learn from my mistakes).

Virus Protection

An absolute must-have. Alright, you already knew that, but I can't stress too strongly the importance of having good, up-to-date antivirus software. With new threats and Viruses arriving every day it's important to maintain update subscriptions and download virus definition updates as soon as they become available. This generally means updating every day, but with the right software and subscription this will happen automatically whenever you connect to the Internet.

There's a lot of good antivirus software available, both free and for low cost. I'd recommend going for paid software...you just never know when you're going to need to call a helpdesk and that's generally the difference between the free stuff and the stuff you pay a small amount for

And I do mean a small amount too, we're not talking hundreds here. Norton, McAfee, AVG and others all sell antivirus software that should be affordable for most people (a lot more affordable than a virus!). At UKITbits we use Grisoft's AVG software. It's ICSA Labs certified and it's less than £30 (about $40) for their antivirus software...and that's for a 2 year licence! You buy it now and get 2 years of updates before you have to pay again.

Firewall

Personally I would always recommend a firewall to help protect against unauthorized access to your PC. For a small number of PCs a software firewall is usually best and is the easiest to work with if you're not an IT expert. However, don't discount hardware firewalls, especially if you have a network with a lot of devices on it.

Whatever you do, don't rely on the Network Address Translation or Stateful packet filter built in to your ADSL router. It almost certainly won't be enough.

Most software firewalls will do a pretty good job of configuring themselves automatically for any applications already installed on your machine and will usually alert you to any other access attempts being made from your PC and then ask you whether you want to allow the access or block it. This section isn't meant to be a comprehensive guide to configuring firewalls so I won't go into it any further here. Any good package will have easy to follow instructions backed up with good support if you have any questions.

If you're buying a particular company's antivirus software it's worth considering buying their integrated antivirus and firewall package if they have one. It may well save you money and be easier to configure and maintain. On machines where I run software firewalls it's almost always the version that's combined with the same company's antivirus software.

A hardware firewall is generally suited to networks of more than a few PCs (say more than 5). In this case it may be cheaper to use a single device at the point where you connect to the Internet and it could save you admin time by defining a single set of rules that work for all your machines.

Hardware firewalls are getting cheaper and easier to install all the time, ranging in price from less than £200 pounds up to several thousand pounds. You can get a really strong level of security for a small to medium sized office, even at the lower end of the price scale. For a few hundred dollars or pounds you can get a Cisco PIX firewall, which is a leading brand. Better still for the same money or even slightly less you can buy a small SG series appliance from Secure Computing. These score over the Cisco equivalent by having an unlimited user licence, but without compromising on the level of security.

Adware/Spyware Protection

If you spend a lot of time browsing the Web (and let's face it, who doesn't?), then adware or spyware is going to find its way onto your machine. A lot of it isn't particularly nasty, but the really bad stuff can send important information like passwords, bank details or credit card numbers to people you really don't want to have access to that stuff. At the very least it can slow down your PC and since you didn't ask for it in the first place then you should get rid of it.

A few tell-tail signs are:

• You're getting pop-up ads all the time
• Your default homepage or other settings in your browser suddenly change (especially if you can't change them back)
• Your computer is slow (there could be other reasons for this, but it's worth checking for spyware)

There's some good software available from Lavasoft, Webroot and many others. A particular favourite of our is AdWare Alert. Adware Alert scans for Adware & Spyware and blocks pop-up ads too. For a Free Scan click here.

Passwords

More and more people are accessing secure sites for shopping, banking, etc. Provided you take sensible precautions it's a great way to shop.

If you've been doing any online shopping you'll be used to dealing with secure sites. Whatever methods these sites use to secure their servers or encrypt your traffic, if they're accessed by passwords then you share some of the responsibility for the security on your transactions. Here are a few tips on how to keep unauthorised users from accessing your accounts:

• Be inventive with your passwords. Don't use easy to guess stuff that a lot of people know about you or can find out. Use a mixture of uppercase and lowercase characters, numbers and special characters (again be inventive. Just using a 1 instead of the letter i is no use if it still spells out an easy to guess word)
• Use different passwords for different accounts. If you always use the same one and it's compromised then someone will have access to everything
• Don't write passwords down on paper or post-it notes. That's a hacker's favourite way to find passwords if they have physical access to your office
• Don't get Web browsers to remember your passwords on shared machines or in office areas. If you log into a machine that other users have access to then never use Windows or Web browser mechanisms that remember your account details
• Passwords in e-mails - Try to minimise the times when you ask for passwords to be re-sent by sites. They are invariably sent in plain text e-mails that can be read by anyone with access to the servers it passes through on the way to you.

Having different passwords to lots of different accounts does make it more difficult to remember them and it's important that this doesn't lead you into other bad habits. So what do you do?

If you access a lot of different accounts it's definitely time to start thinking about getting some password management software. Check out Password Manager XP from CPLab.

Phishing

Phishing is the term used for methods used to trick you into giving out sensitive information such as usernames & passwords, credit card details, account numbers, etc.

E-mail is a favourite tool of the scammers who use e-mails that appear to be from banks or other online companies. These e-mails work by persuading the unsuspecting user to click on a link in the e-mail and "login to verify" or some similar language. The link takes you to another site, not the bank or whatever that you think you're going to. At the landing page will be something that looks just like the normal login page, but it's really just designed to get you to enter details which are then captured and can be used by unauthorised people.

An example email is supposedly a warning from Paypal about an attempt to access an account. This one's been doing the rounds for at least two years and still has the same spelling mistakes! To launch a picture of the fake Paypal e-mail in a separate window click here.

Here are some things to look out for in this type of e-mail:

• Lack of personalisation - The e-mail doesn't mention you by name in the text, nor does it mention an account name
• Spelling mistakes - Always a giveaway. What bank or reputable company is going to send out an e-mail to customers with misspelled words?
• Bad grammar or other language errors - Actually this is where some of the e-mails can get quite funny. Have a laugh at it and then throw it away!
• Invitations to click a link and login to your account - This is the biggy. The link looks pretty innocent, it may even look like the URL of the real company, but the actual URL and what's displayed on screen are not the same thing at all. A look at the source code in the fake Paypal e-mail reveals that it goes somewhere other than Paypal. Online payment companies and banks don't put these kinds of links in their e-mails

To guard against being caught out it's worth keeping the above points in mind. Also it's worth sticking to another basic rule with e-mails. The rule is so important I'm going to break the usual taboo and put this in capitals...DON'T CLICK ON LINKS IN E-MAILS! Really, if you think the e-mail might be genuine, then why not just go to the company's site by typing their address into your browser? After all, if you have an account there, you already know how to get to it. This will get you safely to their site where you can contact them and ask about the e-mail you've just received.

©  Russell Card - The UKITbits editorial team 2006

If you found this information useful please Digg it!