Table of Contents

Next Page

PC Magazine Windows Vista Security Solutions
PC Magazine Windows Vista Security Solutions
byDan DiNicolo
John Wiley & Sons 2007 (360 pages)
ISBN:9780470046562

Providing a valuable roadmap to the Golden Rules of Windows security, this guide explains the steps to take in order to remain safe in the super-charged breeding ground for security and privacy threats that is the Internet.

Table of Contents
 | PC Magazine Windows Vista Security Solutions
 | Introduction
 | Part I - Getting Down to the Business of Securing Windows Vista
 | Chapter 1 | - | A Short Introduction to Securing Windows Vista
 | Chapter 2 | - | Implementing User Accounts and Logon Security
 | Chapter 3 | - | Implementing Password Security
 | Chapter 4 | - | Using Built-in Tools and Settings to Improve Windows Vista Security
 | Part II - Making Surfing Safer
 | Chapter 5 | - | Securing Your Web Browser
 | Chapter 6 | - | Implementing Parental Controls
 | Part III - Protecting Windows Vista Against Internet Threats
 | Chapter 7 | - | Protecting Windows Vista with a Firewall
 | Chapter 8 | - | Keeping Windows Vista Patched and Protected
 | Chapter 9 | - | Protecting Against Viruses
 | Chapter 10 | - | Fighting Malware-Protecting Against Spyware, Adware, and Browser Hijackers
 | Part IV - Messaging Your Way to E-mail Security
 | Chapter 11 | - | The Dark Side of Spam
 | Chapter 12 | - | Securing E-mail Messages Using Encryption and Digital Signatures
 | Part V - Protecting Your Files
 | Chapter 13 | - | Controlling Access to Your Personal Files
 | Chapter 14 | - | Improving File Security Using Encryption
 | Chapter 15 | - | Erasing Files and Hard Drives Securely
 | Part VI - Securing Your Home Network
 | Chapter 16 | - | Securing Shared Folders and Printers
 | Chapter 17 | - | Securing Windows Vista on Wireless Networks
 | Part VII - Appendixes
 | Appendix A | - | Reinstalling Windows Vista
 | Appendix B | - | Helpful Windows Vista Security Web Sites
 | Index
 | List of Figures
 | List of Sidebars

Next Page


Back Cover

Previous Page
Next Page

Back Cover

When you want to defend Windows Vista, it's good to know a PC Magazine expert.

Unless a time machine just dropped you in the 21st century, you already know that protecting your computer is essential. Now, here's Vista-new enough that no one is sure exactly what security threats might arise to hijack your system. That's why the road map that Dan DiNicolo provides in this book is so valuable. Follow these steps, abide by the Golden Rules of Windows security, and you'll sleep better. We promise.

See at a glance what's critical for security

  • Follow easy steps to implementing logon security, strong passwords, and firewall configuration
  • Ensure that security holes are patched regularly
  • Find out how to protect your Vista system against viruses-for free
  • Recognize the difference between malware and viruses and install the right anti-spyware protection
  • Implement parental controls to protect your kids online
  • Explore additional layers of security, such as e-mail encryption and secure file deletion

Five Golden Rules of Windows security

  1. Implement user accounts properly and protect them all with strong passwords.
  2. Install a firewall.
  3. Update your system regularly to be sure you have all security patches and Service Packs installed.
  4. Use up-to-date anti-virus software and scan regularly for viruses.
  5. Use up-to-date anti-spyware protection and scan regularly for spyware and related threats.

About the Author

Dan DiNicolo is a freelance author, trainer, and consultant based in the snowy backwoods of Canada. He is the author of PC Magazine Windows XP Security Solutions and has written scores of magazine articles about securing Windows systems. In his spare time Dan enjoys dreaming of a world where computers are as easy to use as toaster ovens.

Previous Page


PC Magazine Windows Vista Security Solutions

Dan DiNicolo

Wiley Publishing, Inc.

Published by
Wiley Publishing, Inc.
10475 Crosspoint Boulevard
Indianapolis, IN 46256
http://www.wiley.com

© 2007 Wiley Publishing, Inc.

Indianapolis, Indiana

Published simultaneously in Canada

978

0-470-04656-2

10 9 8 7 6 5 4 3 2 1

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Website may provide or recommendations it may make. Further, readers should be aware that Internet Websites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (800) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Library of Congress Cataloging-in-Publication Data: Available from Publisher.

Trademarks: Wiley, the Wiley logo, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. PC Magazine and the PC Magazine logo are registered trademarks of Ziff Davis Publishing Holdings, Inc. Used by license. All rights reserved. Microsoft and Windows Vista are trademarks or registered trademarks of Microsoft Corporation in the United States and or other countries. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

For everyone who has ever helped a friend, family member, or neighbor out of a computer-related jam.

About the Author

Dan DiNicolo is a freelance author, trainer, and consultant based in the snowy backwoods of Canada. He is the author of PC Magazine Windows XP Security Solutions and has written scores of magazine articles about securing Windows systems. In his spare time Dan enjoys dreaming of a world where computers are as easy to use as toaster ovens.

Credits

Acquisitions Editor Katie Mohr

Development Editor Maryann Steinhart

Technical Editor Todd Meister

Production Editor Angela Smith

Copy Editor Travis Henderson

Editorial Manager Mary Beth Wakefield

Production Manager Tim Tate

Vice President and Executive Group Publisher Richard Swadley

Vice President and Executive Publisher Joseph B. Wikert

Proofreading Word One

Composition Maureen Forys, Happenstance Type-O-Rama

Indexing Ted Laux

Anniversary Logo Design Richard Pacifico

Acknowledgments

Thanks to Katie Mohr and Maryann Steinhart at Wiley for all of their help in getting this book from idea to print. Thanks also to Todd Meister for his eagle eye and ideas throughout the tech editing process.

I'm not sure whom to thank for putting snakes on the cover of this book, but I love it.

As always, thanks to the family and friends who put up with me (and my craziness) when I take on big writing projects

Last, but certainly not least, thank you, Jessica. The excellent adventure continues!


Introduction

I've been writing about computers and the need to keep them properly secured for a long time. Back in the good old days, protecting your computer involved little more than installing anti-virus software, keeping it updated, and scanning for threats regularly. Unfortunately, the good old days are long gone.

Today, computers and the Internet form a super-charged breeding ground for a myriad of security and privacy threats. There are people and programs trying to obtain personal information in a bid to steal identities. Unscrupulous marketers use adware and spyware to track online wanderings and target advertising to your personal preferences. People attempt to install keylogging programs on PCs to capture banking-related usernames and passwords. Neighbors steal high-speed Internet access from neighbors. Scammers attempt to sell everything under the sun via the scourge known as spam. Predators are seeking out children online. As useful a resource as the Internet may be, safe it is not.

Thankfully, all is not lost. If you take the time to understand the threats that exist, then you can do something to protect against them. My goal with this book is to not only explain the risks that you'll encounter when connecting to the Internet or using Windows Vista, but also to show you the steps to take to ensure that you, your PC, and your family remain safe.

Securing a computer running Windows Vista isn't difficult, but it does take some dedication on your part. Ultimately, the actions you take will be the difference between owning a secure PC and remaining safe online, or leaving you and your system exposed on the Internet.

I sincerely hope that you make the right choice.

May the force be with you!


Part I: Getting Down to the Business of Securing Windows Vista

Chapter List

Chapter 1: A Short Introduction to Securing Windows Vista
Chapter 2: Implementing User Accounts and Logon Security
Chapter 3: Implementing Password Security
Chapter 4: Using Built-in Tools and Settings to Improve Windows Vista Security


Chapter 1: A Short Introduction to Securing Windows Vista

Overview

Ioriginally planned to start this book with a long diatribe on the importance of taking the steps necessary to ensure that your Windows Vista system remains safe and secure. Thankfully, at the last minute I changed my mind. The reason is simple enough: I assume that if you're reading this, then you already have at least a basic understanding of the fact that computer security is important. So, I'm not going to lecture you. Instead, I'm going to provide you with a map.

Yes, a map, and a fairly basic map at that. Securing any computer running Windows Vista - or just about any Windows operating system for that matter - is as easy as following simple instructions. Some tasks are absolutely essential, and without them your system has little chance of remaining secure. Others are only relevant to users with a home or small office network. Some topics are just plain good to know, meaning they'll help to improve the security of your system but aren't going to be the deciding factor as to whether your system remains safe. Last but not least, there are topics geared toward those of you who truly want to take things up a notch by ensuring that not only your computer remains secure, but also that your personal files and communications remain private.

The moral of the story is that you could read this book in the traditional cover-to-cover manner, but it isn't essential. I've tried to organize topics in the most linear manner as possible, but there are topics that some of you can safely skip. Pretty much every chapter in this book can stand on its own, so if you're in the mood to tackle issues around the security of your wireless network you can simply flip to that chapter to learn how it's done. Will reading the entire book front-to-back hurt you? Of course not! However, I do recognize that different people have different levels of tolerance for this computer security stuff, and I certainly don't want you to feel overwhelmed. What I do want, however, is for you to take at least the key steps necessary to ensure that your computer remains as secure as possible. If you choose to go beyond those steps, that's excellent. When all is said and done, there are six chapters I insist you read and take action on - seven if you're a parent. I'll get to all the dirty details on what's important in a moment.

Before I go there, however, you need to understand two things:

  • Security is an ongoing process. As time goes on, new security threats will emerge that will require you to take action. I can't predict the future, but I can spot trends. If the last few years have shown anything, it's that the "bad guys" are always looking for new ways to compromise your computer. In other words, just because your computer is secure today, it doesn't mean that it will be completely safe tomorrow. To some degree, you'll need to keep an eye (or ear) on the news to ensure you're informed as new risks arise. You'll also need to be somewhat diligent about ensuring that the techniques you use to secure your computer remain intact, and updated as required.

  • Windows Vista is a new operating system. It hasn't stood any true test of time just yet, so it's almost impossible to guess what security and privacy issues will arise, or when. Right now, the steps you need to take to ensure that your computer remains properly secured are very similar to those associated with securing any computer running Windows, be it Windows XP or even Windows 2000. Certainly Windows Vista offers some key security improvements over previous versions, and some of the steps you'll need to follow to get things done have changed. However, there's simply no telling what the future may hold. Although the security and privacy improvements in Windows Vista look very promising, I'd be very rich and living on a private island if I could accurately guess what the next big security risk is.

Fortunately, all is not lost. If you look at the key steps outlined in this book as being essential (and take the necessary actions, of course!), your Windows Vista system will be as secure as it can possibly be right now. In fact, if you take the time to get things done properly right from the get-go, you're unlikely to experience any real security breakdowns at all. However, I can only explain what you need to do to set things up correctly, and then how to maintain your setup. If you decide that security is important today and then don't ever give it another thought, your Windows Vista system may well end up being at serious risk.

Oh yeah, the map! The journey begins by ensuring you understand the five golden rules of Windows security, and then getting the directions you need. The next few sections will help you on your way.


The Five Golden Rules of Windows Security

The five golden rules of securing any Windows system are quite basic and easy to understand:

  1. You must implement user accounts properly, and protect all user accounts with a strong password.

  2. Your Windows Vista system must be protected by a firewall.

  3. Your Windows Vista system must be updated regularly to ensure that you have all necessary security patches and Service Packs installed.

  4. Your Windows Vista system must be protected by up-to-date antivirus software, and you must scan for viruses regularly.

  5. Your Windows Vista system must be protected by up-to-date antispyware software, and you must scan for spyware and related threats regularly.

That's the extent of the golden rules of Windows security, honestly. Yes, there are other important concepts to consider, but these five are crucial. If you neglect to follow any of these rules, your Windows system will always be at risk.


The Security Map

There's always more than one way to get from point A to point B, and I'm not going to assume that you'll follow the exact directions that I provide. The truth is that I'm not 100 percent sure of your exact situation. For example, you may already be well aware of the importance of having a firewall in place, but it's equally possible that you don't have a clue as to what a firewall does. So, just to be on the safe side, I'm going to assume that you need a little guidance. The following sections explain the relevant importance of topics covered in this book according to a highly scientific ranking scale that I've developed:

  • No excuses! The topics outlined in this section are important. Really important. Everyone, excluding perhaps the family pet, needs to know this stuff. Please read these chapters!

  • Got a network? As the name suggests, these chapters are relevant to anyone who has a home or small office network. A network can be as simple as one laptop computer with a wireless network card connecting to a wireless router, or be a setup that includes multiple computers wired through a switch, hub, or router. It doesn't matter. If you have a network, you'll want to be secure, and you should read these chapters.

  • Nice to know. None of the topics covered in these chapters are absolutely imperative from a basic system security perspective, but each is still important in its own way. Can you improve the security of your Windows Vista system by reading these chapters? Absolutely, but I'm not going to recommend that you stay up all night trying to implement every single recommendation that I offer in these chapters. Getting a good night's sleep is always important.

  • For those who want to take things up a notch. If you're serious (or really keen) about locking down your system, then you should read these chapters. Actually, if you're really serious, you should probably read every chapter because you'll learn lots of cool stuff, but I digress. These chapters are really aimed at those of you who want to know how to do some of the more advanced security stuff, like encrypting files or e-mail messages. Not for everyone to be sure, but there are some cool techniques and concepts outlined in these chapters for those who want to take things to a higher plane of security consciousness. That's pretty deep, man.

No Excuses!

All of the chapters listed in this section directly relate to the five golden rules of Windows security. Understanding the concepts and following the techniques covered in these chapters is absolutely essential if there is to be any hope of keeping your Windows Vista secured. Chapters that fall into the No Excuses category include:

  • Chapter 2: Implementing User Accounts and Logon Security. User accounts form the foundation upon which all other Windows Vista security features are built. If you don't implement them correctly, you'll never be the proud owner of a secure Windows Vista system.

  • Chapter 3: Implementing Password Security. You've no doubt heard that passwords are important. The truth is that they're really important. Really, really, really important. As with user accounts, neglecting the importance of using strong passwords is a really, really, really bad idea. Really.

  • Chapter 7: Protecting Windows Vista with a Firewall. A firewall is the component that keeps Internet users from being able to connect to your PC without your permission. If you don't have a good firewall in place (or neglect to configure it correctly), you're effectively leaving your system open to every security threat imaginable.

  • Chapter 8: Keeping Windows Vista Patched and Protected. Windows Vista is built with millions of lines of programming code, and from time to time, problems with bits of code are discovered. These security holes can leave your system exposed to a variety of security threats, so patch them immediately as fixes become available. In this chapter, you learn how easy it is to ensure that Windows Vista remains properly patched and protected, automatically.

  • Chapter 9: Protecting Against Viruses. Viruses have been around for a long, long time, and continue to present a threat to your computer's security. To protect against threats like viruses, worms, and Trojan horses you need to have antivirus software installed, keep it updated, and then scan for viruses regularly. This chapter explains how to get the protection you need without spending a penny in the process.

  • Chapter 10: Fighting Malware: Protecting Against Spyware, Adware, and Browser Hijackers. Most users consider any pest-related infection to be a virus, but technically spyware, adware, and browser hijackers are different beasts requiring their own dedicated preventative measures. As their names suggest, these pests are typically designed to infect your system and then spy on you and your online activities. You don't want them on your system, and the right antispyware setup helps to ensure your Windows Vista system remains properly protected. This chapter shows you how it's done.

That's it - a total of six chapters covering the five golden rules. I did mention another important chapter for parents, and that's Chapter 6, "Implementing Parental Controls." If you have kids and want to keep them safe online, you really need to read that chapter as well. Because it doesn't apply to everyone, I've outlined it in a little more detail in the "Nice to Know" section.

Got a Network?

It wasn't all that long ago that having a computer network in your home was the exception rather than the rule. With the advent of high-speed Internet connections, however, many people realized that they could easily share the connection among different computers simultaneously. Although this ended the process of queuing up to use the Internet, it brought with it a whole new set of issues with respect to network security. There are a number of references to networks and security throughout this book, but you can find the majority in the last two chapters:

  • Chapter 16: Securing Shared Folders and Printers. Most people install a home network to share Internet access between two or more computers simultaneously, but you can also use a network to share resources like files, folders, printers, and more within that network. In this chapter you learn how you can use Windows Vista's built-in network security features to control who has access to shared folders and printers on your network.

  • Chapter 17: Securing Windows Vista on Wireless Networks. Wireless technologies make it easier to implement a home network than ever before, but if you don't take the time to secure your wireless network connection you can end up granting access to your computers (and the Internet) to neighbors or anyone within range. If you want your wireless network to remain secure and private, then you must take the time to secure it correctly. The good news is that it's not tough to do. This chapter explains everything you need to ensure that outsiders can't freely roam your network or piggyback on your expensive high-speed Internet connection without your permission.

If you don't have a home or small-office network, you can safely skip these chapters. If you have a laptop with a built-in wireless connection (or even connect to a wired network at work), then you'll still find helpful information in both chapters.

Nice to Know

There are plenty of security threats out there, but some (like viruses and spyware) are more dangerous than others. Personally I'd consider the information supplied in the following chapters to be very useful towards keeping your computer's security (and your personal privacy) intact, but they are by no means absolutely essential. With different users and needs in mind, I'll designate the information in the following chapters as being nice to know:

  • Chapter 4: Using Built-in Tools and Settings to Improve Windows Vista Security. Windows Vista includes a number of built-in security tools and advanced features that you can use to better protect your PC and keep you in the loop. From reviewing the Windows Vista security log to using the Control Panel Security Center to determine the current status of security tools and settings, this chapter gives you a better idea of what's built into (and possible with) Windows Vista.

  • Chapter 5: Securing Your Web Browser. Internet Explorer 7 is the new web browser included with Windows Vista, and its default security settings do a great job toward keeping your browsing experience safer. In past iterations, Internet Explorer has been the source of some major security concerns, but this new release shouldn't subject you to major ills like spyware and browser hijacks. Even so, this chapter explores some of the primary security settings in Internet Explorer 7, and how you can tweak them, if necessary. It also outlines alternatives to using IE as your browser such as Firefox, Netscape, and Opera.

  • Chapter 6: Implementing Parental Controls. If you have children, this chapter should be considered essential reading. The Internet is a dangerous place, and without the right controls in place, your children can literally venture anywhere online and be exposed to all manner of content. The new Parental Controls feature in Windows Vista now makes it possible for parents to control exactly what types of content kids can access, the programs they can use, the types of games they can play, and even the times at which they can use your Windows Vista system. This chapter shows how to implement controls on a user-by-user basis.

  • Chapter 11: The Dark Side of Spam. Junk e-mail stinks, and nobody I know likes receiving it. Beyond being an annoyance, however, spam can also be a security risk. Junk messages sometimes carry viruses, try to steal your personal information (via phishing attempts), or lead to even more spam. If you want to learn more about lowering your spam intake and making your e-mail inbox a safer place, this chapter is for you.

  • Chapter 13: Controlling Access to Your Personal Files. Windows Vista does a good job of keeping different users' personal files separated and relatively secure if you set things up correctly. In this chapter, you learn how to keep your personal files private using security permissions, and how to share files (including to what extent) using new sharing features built into this latest version of Windows.

Honestly, you'll learn something useful in every one of these nice-to-know chapters. Although none of them provide a clear answer as to the meaning of life, they still have some wonderful nuggets of information that may help you on your journey.

For Those Who Want to Take Things Up a Notch

My experience has shown that most people want to keep their computers secure to avoid the hassles associated with pests like viruses and spyware. However, I also understand that many people are increasingly interested in protecting their personal privacy. Although the techniques outlined in the No Excuses! chapters help keep your computer safe, they won't necessarily protect your personal files and Internet communications to the level you would like. To properly secure these elements and to make them private, using encryption techniques is your only option.

Unfortunately, using encryption (and using it correctly) can be a challenge. I'd love to tell you that using encryption to keep files and e-mail messages secure is as easy as clicking a button, but if I did that, I'd be lying. Encryption is a more advanced concept than many others in the computer security world, and one for which you need to take a little time to learn the process. Do it right, and you'll benefit from some industrial-strength privacy; get it wrong, and you may find yourself permanently locked out of your own stuff.

The following chapters are suitable for those of you who want to take things up a notch on the security and privacy front:

  • Chapter 12: Securing E-mail Messages Using Encryption and Digital Signatures. Ever wondered why e-mail programs include buttons marked Encrypt and Digitally Sign? You can make your e-mail communications with other users completely secure and private, but there's a little work involved. If you don't want to run the risk that others can potentially read (or change) the e-mail messages you send, then this chapter is for you.

  • Chapter 14: Improving File Security Using Encryption. Certain editions of Windows Vista include a built-in feature that enables you to secure your personal files using strong encryption. Even if you don't have the right edition, however, you can find other programs that can help you to ensure that your files remain for your eyes only. This chapter explains how to use the Windows Vista native file encryption facilities and third-party tools to encrypt files securely to levels at (or beyond) government standards.

  • Chapter 15: Erasing Files and Hard Drives Securely. This topic technically isn't about encryption, but the manner in which it works is similar. Normally when you delete a file, it remains potentially recoverable using various tools designed to undelete or restore files. When you erase files the right way, however, you cannot recover them. Whether you need a way to ensure that files you delete are gone for good, or want to wipe your hard drive clean prior to donating or selling an old PC, this chapter explains how to do the job properly and permanently.

It's true - I did consider naming this section "security stuff for the completely paranoid." However, I quickly realized that I would then be calling myself paranoid. My neighbors, friends, and relatives already use the term to describe me, so I changed the title. I don't like to think of myself as paranoid; I'd rather say that I like to take things up a notch.


Summary

Securing your Windows Vista system is essential. Some of the things you need to do are very important, others not quite as important, relatively speaking. The Golden Rules have been outlined, and you have a map that outlines the relative importance of topics covered in this book. The ball is now in your court. Read on to secure Windows Vista systems!


Chapter 2: Implementing User Accounts and Logon Security

Securing your computer is in many ways like securing your home - you shouldn't rely on any one method to keep the outside world from getting in. Instead, you take a number of different measures that may include locking doors, installing an alarm system, and hopefully not alerting would-be attackers that there's lots of cool stuff inside.

When it comes to securing Windows Vista, you're given the choice of leaving the front door open, or putting a lock in place. This door lock is known as a user account, specifically a user account that includes a password. If ever there was a first line of defense in the quest to secure Windows Vista and ensure user privacy, user accounts are very much where the story begins.

This isn't to say that user accounts are strictly a security-related feature of Windows Vista; they certainly have other reasons for being. However, user accounts are a key component in changing your computer from being an open book to a secure fortress.

This chapter focuses on what user accounts are, the different types that exist, and how to create and configure them to ensure a better level of system security. Along the way, you'll learn about a new feature - User Access Control - that can help improve the security of your Windows Vista system.

Exploring User Accounts

When it comes to Windows Vista, user accounts represent the foundation upon which all other security concepts and techniques rely. Quite simply, you can install any piece of security software - from firewalls and antivirus programs to antispyware tools and encryption utilities - and it's effectively all for naught if user accounts are not implemented correctly or properly protected. It could easily be argued that most Windows Vista users consider the user account logon process an annoyance rather than a security feature. Unfortunately, neglecting or ignoring this essential security feature is the very reason why the majority of user desktop systems are insecure and vulnerable to an Internet's worth of security and personal privacy threats.

At the most basic level, a user account is nothing more than an object on a Windows Vista system that represents a particular user. Made up of a username, and hopefully a password, user accounts represent the credentials that users need to supply to gain access to a Windows Vista system. Beyond simply identifying a user, a user's account dictates what tasks he can perform on a computer, what files he has access to, and more. In a nutshell, user accounts are not an optional part of securing a Windows Vista system - quite to the contrary, they're absolutely essential.

In a departure from previous versions of Windows aimed at home and small office users, Windows Vista offers true user account security facilities in a way that cannot be easily ignored or dismissed. Although pressing the Esc key might have gotten a user past the logon dialog box on a Windows 98 system, Windows Vista offers much more robust and comprehensive logon security. As a matter of fact, the logon security capabilities of Windows Vista are fundamentally similar to those used to secure servers running Windows 2000 Server or Windows Server 2003. In other words, Windows Vista user account security offers a high level of protection for your system. If you're serious about your system's security and privacy, you'll want to take advantage of it.

The good news is that Windows Vista makes it easy to create and manage user accounts via tools like the User Accounts applet in Control Panel (see Figure 2-1). Before you jump into creating any accounts, however, it's essential that you to understand the benefits user accounts provide, and important details about the different types of accounts that exist.

Image from book
Figure 2-1: Click the User Accounts item in Control Panel to create and manage user accounts.

Benefits of User Accounts

Some user accounts are configured for general day-to-day use, including tasks such as surfing the Web, working with e-mail, and playing games. Others are designed with system administration and configuration tasks in mind, including installing software and making changes to firewall settings.

Ultimately, each person who uses a Windows Vista system should be assigned his or her own personal user account, which provides the following benefits:

  • A dedicated and customizable desktop environment.

  • A dedicated user profile where personal files, e-mail messages, and settings are stored.

  • The capability to control access to the desktop environment by adding a user account password.

  • The capability to secure personal files and folders, making them inaccessible by other users.

Creating a dedicated user account for every person who uses a Windows Vista system is not unlike setting up a number of Windows Vista systems, where each user has her own personal desktop environment. This model eliminates the hassles associated with older systems like Windows 3.1, where users shared a common desktop and all related settings. In the world of Windows Vista, having your own user account means being able to log on, set your desktop wallpaper image to something crazy or fun, and not having to deal with friends or family members who want to change it. Your desktop can be neatly organized (recommended), or a complete mess (recommended only if you thrive in chaotic environments). Most importantly, having your own user account enables you to control which users can access your files, and to what extent.

User Account Types

Although the idea of each user having her own dedicated account is a great one, all user accounts are not created equal. There's a definite hierarchy in this part of the computing world, and Windows Vista offers no exception. Some user accounts allow unrestricted access to every last bit of a Windows Vista system, including files belonging to other users. Others limit what users can do while logged on, stopping them from carrying out common tasks such as installing software. When it comes to the security of your Windows Vista system, creating user accounts is important. However, assigning users an appropriate user account type is even more critical.

Windows Vista includes three main types of user accounts:

  • Administrator

  • Standard

  • Guest

Each of these user account types is examined in more detail in the following sections.

Note

In the world of Windows Vista, a user is the person actually using the computer - your spouse, Mom, Dad, son, daughter, or a friend. A user account is the object assigned to a user for the purpose of logging on. Some users will have only one user account, while others may have more than one user account - one for day-today use and another for system administration tasks.

ADMINISTRATOR ACCOUNTS

In the parallel universe that is Windows Vista, one type of user account stands head and shoulders above the rest: the all-seeing, all-knowing Administrator account. User accounts of this type have complete control over every element of a Windows Vista system; users with this privilege level can literally do anything, up to and including actions that could irreparably damage a Windows Vista installation.

A user configured as Administrator can:

  • Install and uninstall programs, hardware, and drivers.

  • Make system-wide configuration changes.

  • Create, delete, and manage all user and group accounts.

  • Read or open any file, including those belonging to other users.

  • Grant rights to or implementing restrictions on other users.

One limitation is that the Administrator cannot delete his account or change its type to Standard if it is the last Administrator account on the Windows Vista system.

Windows Vista creates one Administrator account by default (named Administrator) during its installation process. You may not even be aware that this account exists because it isn't displayed on the Welcome logon screen by default. This account is always present, however, and cannot be deleted.

The Administrator user account type is supposed to work for the forces of good, not evil. However, this account type was never designed with normal, everyday, use in mind. As the list of its broad capabilities shows, Administrators yield complete control over not only the Windows Vista system itself, but also other users' accounts.

For that reason, regular users should never be granted Administrator privileges. In fact, for security purposes alone, even the Administrator should never log on to Windows Vista with an Administrator account unless he needs to perform configuration tasks that require this level of power. Unfortunately, Windows Vista systems can run into security-related problems (such as infections by viruses and spyware programs) due to unnecessary or careless everyday use of the massive firepower the Administrator account.

Caution

Deciding which users should be granted Administrator rights is ultimately up to you, but always keep system security in mind. Generally, any user with access to the Administrator account should have an appropriate level of Windows Vista knowledge. More importantly, she should be someone who can be trusted not to abuse or misuse the account's power. On some systems, every user may be responsible enough to be granted access to an Administrator account to perform tasks like installing programs. On others, the situation might dictate that only the owner of the PC has access to an Administrator account. The bottom line is that on your computer, you get to choose who has access to Administrator accounts, so choose wisely.

STANDARD USER ACCOUNTS

Unlike Administrator accounts, Standard user accounts are designed for everyday personal use. Many people argue that these accounts are excessively restrictive in that they stop users from carrying out common tasks such as installing hardware and software, changing security settings, and making system configuration changes. That's true, but they're also very much to the point - Standard user accounts are designed to keep users from making potentially harmful and dangerous changes to a system and, by extension, help to ensure a better-performing and more secure Windows Vista system overall.

A user with a Standard account can:

  • Add, change, or remove his user account password.

  • Create a password reset disk for use in cases where his password is lost or forgotten.

  • Make changes to his user desktop environment.

  • Make his personal files private (except from the Administrator account).

  • Use software programs installed for all users.

But the user cannot:

  • Make changes to system configuration settings or delete key files.

  • Install hardware or software programs.

Although Standard user accounts typically cannot install hardware and software, there are exceptions. On the hardware front, Windows Vista systems do allow Standard users to plug in and use a variety of USB devices, including pen drives, MP3 players, and the like. Most other hardware changes are restricted. As for software, Standard users can often install single-user programs that do not make any changes to system configuration settings, as is the case with many older programs designed for previous Windows versions. However, Standard users cannot install multiuser programs, or those that install new system services. Words like often, typically, many, and most are the name of the game here. The best way to see whether a program will install for a Standard user is to attempt the installation. In some cases it may work, and in others it will fail. Although the conveniences associated with having an Administrator account have appeal, everyday user accounts should always be of the Standard type if you're serious about securing your system. Unfortunately, going that route can lead to frustration (and even conflict) in cases where one user wants to do something on a computer, but is unable to because of restrictions imposed as a result of her Standard status.

That's why the Administrator account type exists, and there's nothing wrong with granting a responsible and trusted user the capability to use an Administrator account if and when necessary. Later in this chapter you'll learn how you can allow trusted Standard users to perform administrative tasks, without leaving the safe confines of their everyday user account.

As a best practice, try to follow what is known as the principle of least privilege when configuring security settings for any PC. This principle dictates that you give users only the minimum level of privilege that they require, and nothing more. Although the level of control that a particular user needs is open to debate (especially in his eyes), sticking to the least privilege maxim helps to ensure a more secure computer. In the case of user accounts, this means assigning all users Standard accounts for normal everyday use. Many viruses and spyware programs rely on the current user having Administrator-level access to thoroughly infect systems and do their damage; sticking with Standard accounts helps mitigate potential risks. Suffice it to say that when it comes to Windows Vista, user accounts, and security, less can actually be more.

GUEST USER ACCOUNT

Along with an Administrator account, Windows Vista also automatically creates a user account named Guest. As its name suggests, this account is meant for users without their own dedicated user accounts. Disabled by default (see Figure 2-2), the Guest account does not have a password assigned, and has little in the way of powers beyond running installed programs.

Image from book
Figure 2-2: The Windows Vista built-in Guest account is disabled by default.

The fact that the Guest account is disabled by default (and cannot be assigned a password) is a good indication that it represents a potential security risk. As a best practice, always leave the Guest account disabled and create Standard accounts for users who require occasional access to your Windows Vista system. As you'll see later in this chapter, you can create a user account in less than a minute - well worth the effort from a security perspective.


Creating User Accounts

Now that you're familiar with user accounts and the different types that exist, it's time to get down to the business of actually creating them, which really couldn't be easier.

The primary tool used to create user accounts on a Windows Vista system is the User Accounts applet in Control Panel.

Creating User Accounts in Control Panel

Administrators can use the User Accounts applet in Control Panel to create new accounts, as well as manage existing ones. Standard users can use the tool to manage settings related to their own account only.

Follow these steps to create new user accounts in Control Panel:

  1. Select Start → Control Panel. Click the Classic View link in the upper left of the screen and then double-click the User Accounts icon.

  2. At the Make Changes To Your User Account screen, click Manage Another Account.

  3. When the User Account Control window appears, click Continue.

  4. Click Create A New Account.

  5. Enter a username for the new account, leave the account type as a Standard user (as shown in Figure 2-3), and click the Create Account button.

  6. Close the Manage Accounts window.

Image from book
Figure 2-3: Select the new user account's type.


Managing User Accounts

Creating user accounts is only part of the job of an Administrator. After accounts have been created, they will occasionally need to be managed. Examples of security-related tasks associated with managing user accounts include:

  • Changing account types

  • Renaming accounts

  • Adding, changing, and resetting passwords

  • Deleting accounts

Each of these tasks is explained in more detail in the following sections.

Changing User Account Types

As you're now aware, using an Administrator account as your everyday user account is not recommended. Thankfully, the User Accounts tool in Windows Vista makes it easy to change an account from one type to another, such as switching an Administrator account to a Standard user, or vice versa.

Follow these steps to change a user account's type:

  1. Select Start → Control Panel → User Accounts.

  2. At the Make Changes To Your User Account screen, click Manage Another Account.

  3. When the User Account Control dialog box appears, click Continue.

  4. Select the name of the user account whose type you want to change.

  5. Click Change The Account Type.

  6. Select the type to which the account should be changed, as shown in Figure 2-4.

  7. Click Change Account Type and close the Change An Account window.

Note

Only an Administrator can change a user account's type. If the user whose account type is being changed is also logged onto the Windows Vista system when the change is made, the new account type takes effect the next time the user logs on.
Image from book
Figure 2-4: Changing an existing user account's type.

Renaming User Accounts

Changing the name associated with an existing user account is significantly different than creating a new account. When you rename an account, only the name is changed - the actual user account fundamentally remains the same. Accounts are often renamed in corporate environments to make the transition between a departing user and his replacement easier. If the account is renamed, the new user has the same rights and permissions as the old user, along with access to the old user's files and desktop environment. This is often preferable to creating an entirely new account and then configuring required rights and permissions manually. On a home PC, user accounts are typically renamed only when a user wants to change her on-screen display name.

Follow these steps to rename an existing user's account name in Control Panel:

  1. Select Start → Control Panel → User Accounts.

  2. At the Make Changes To Your User Account screen, click Manage Another Account. When the User Account Control dialog box appears, click Continue.

  3. Select the name of the user account whose name you want to change.

  4. Click Change The Account Name.

  5. Type a new name for the account as shown in Figure 2-5 and then click the Change Name button. The account will take on the new name, but all of the old user's files and settings remain intact in the account.

  6. Close the Change An Account window.

Image from book
Figure 2-5: Changing a user account's name.
Tip

The built-in Administrator user account may be hidden from the Windows Vista logon screen by default, but rest assured that hackers and others attempting to gain access to your computer know that it exists. Although you cannot delete this account, you can (and should) rename it to something less obvious. Choose a username for it that you'll remember, and then assign it a sufficiently complex password. This isn't to say that changing the name of the account will keep a determined hacker out of your system, but it will foil less experienced users and make life a little more difficult for those in the know. To change the password associated with this account, press F8 when your PC starts, select the option to boot into Safe Mode, log on, and use User Accounts in Control Panel to change the password associated with the Administrator account.

Managing User Account Passwords

Creating individual user accounts for every person that uses your Windows Vista system is a great start, but it's only part of the story as far as security is concerned. For user accounts to do anything more than act as a facility for separating user desktops and working environments, they must be assigned passwords. Every user should assign a password to his or her user account, and as a security/ privacy precaution, be the only person who knows the password.

Follow these steps to add a password to an existing user account in Control Panel:

  1. Select Start → Control Panel → User Accounts.

  2. At the Make Changes To Your User Account screen, click Manage Another Account.

  3. When the User Account Control dialog box appears, click Continue.

  4. Select the name of the user account whose name you want to change.

  5. Click Create A Password.

  6. At the Create A Password For Username's Account screen (see Figure 2-6), enter the new password, confirm it, and then type a password hint that will be seen by the user (to help him remember it) if he forgets his password or enters it incorrectly.

  7. Click Create Password, and then close the Change An Account window.

Image from book
Figure 2-6: Adding a password to another user's account.
Caution

Password hints exist to help you remember your password, but are visible to all users from the Windows Vista logon screen. If your hint is too obvious, other users may be able to guess your password. As a best practice, choose a password hint that makes sense to you, but won't give your password away to others.

Adding a password to your user account is an important step forward, but if you're serious about security, make a point of changing your password at least once every month or so. The User Accounts applet in Control Panel makes it easy to change (or even remove) the password associated with your user account.

Follow these steps to change the password associated with a user account in Control Panel:

  1. Select Start → Control Panel → User Accounts.

  2. At the Make Changes To Your User Account screen, click Manage Another Account.

  3. Select the name of the user account whose name you want to change.

  4. Click Change The Password, enter (and confirm) your new password, enter a password hint, and then click the Change Password button.

  5. Close the Change An Account window.

Tip

Assigning a password to all user accounts is important, even if you're the only person using a computer. Any accounts left unprotected make it easier for hackers, viruses, and spyware, and that's a risk not worth taking. Additionally, if your computer is ever lost or stolen, not having a password assigned gives others easy access to any personal data or files stored on your system.

Occasionally you may run into an issue where someone has forgotten the password associated with his or her user account, and cannot log on. Should this happen, an Administrator can reset the password by changing it using the User Accounts tool.

Follow these steps to reset a forgotten password using User Accounts:

  1. Select Start → Control Panel → User Accounts.

  2. At the Make Changes To Your User Account Screen, click Manage Another Account.

  3. When the User Account Control dialog box appears, click Continue.

  4. Select the name of the user account whose name you want to change.

  5. Click Change The Password. Enter (and confirm) the user's new password, enter a password hint, and then click the Change Password button.

  6. Close the Change An Account window.

Caution

As a general rule, do not add, change, or reset passwords for other user accounts except during the original account creation process. If you add, change, or reset a password on their behalf (even with the best intentions), those users will lose access to their encrypted files, stored Internet certificates, and stored web site passwords. Instead, have the users log on and add a password to their accounts using the User Accounts applet in Control Panel.

Understanding that users may forget their password, Windows Vista allows all users to create a password reset floppy disk. This disk enables a user to log on and change his password without the need to worry about losing access to encrypted files and other stored settings. You'll learn more about creating a password reset disk in Chapter 3.

Deleting User Accounts

Creating individual user accounts is essential, but it's also important to delete user accounts that are no longer needed. If you believe that an account will be used again at some point in the future, disable it. If there's no chance that it will be again, deleting it is the more secure option.

Follow these steps to delete an existing user account in Control Panel:

  1. Select Start → Control Panel → User Accounts.

  2. At the Make Changes To Your User Account screen, click Manage Another Account.

  3. When the User Account Control dialog box appears, click Continue.

  4. Select the name of the user account whose name you want to change.

  5. Click Delete The Account.

  6. At the screen asking whether you want to keep the user's files (see Figure 2-7), click Keep Files to save the contents of the user's Documents folder to your desktop, or click Delete Files to remove them.

  7. When asked to confirm that the account should be deleted, click Delete Account and then close the Manage Accounts window.

Image from book
Figure 2-7: Options associated with deleting a user account.
Image from book
What's in a Name?

After deleting a user account, would a new user account of the same name not smell as sweet? When it comes to how Windows Vista deals with user account names, the answer is no.

Imagine that your system includes a user account named Mike. When this user is created on a Windows Vista system, it is assigned an identifier value known as a Security ID (SID). An SID is a series of numbers that uniquely identifies a given security principal (user or group) on your system. Windows Vista identifies different users and groups using their SIDs, whereas names like Mike, Administrator, and Guest exist simply to help the mere humans keep things straight.

The reason this is important is that Mike isn't always necessarily Mike. For example, if you create a user account named Mike, delete it, and then create another user account named Mike, the two accounts are not the same. They may have the same name, and even belong to the same person. As far as Windows Vista is concerned, however, you've created one unique account (with a unique SID), deleted it, and then created another unique account (with its own unique SID). In other words, if the old Mike account had been granted any rights or permissions, the new Mike account is not automatically granted the same levels of privilege. Similarly, the new Mike may not be able to access the old Mike's files.

What it comes down to is this: deleting an account and then creating another with the same name does not the same user make.

Image from book


User Account Control and the Run As Command

One of the key new security features of Windows Vista is known as User Account Control. Enabled by default, User Account Control is designed to ensure that users are prompted any time that administrative privileges are required to complete a task. If you're logged on with an Administrator account, the User Account Control dialog box appears when you try to perform an action limited to Administrators; however, you only need to click Continue to perform the requested action, as shown in Figure 2-8.

Image from book
Figure 2-8: The User Account Control dialog box as it appears when you're already logged on as an Administrator.

If you're logged on as a Standard user and attempt to perform an administrative action - such as installing software or changing the system time, for example - the User Account Control dialog box prompts you to supply the credentials associated with an Administrator account, as shown in Figure 2-9.

Image from book
Figure 2-9: The User Account Control dialog box as it appears when you're logged on as a Standard user.

The basic idea behind User Account Control is that you'll be alerted every time an action requires the powers associated with an Administrator account. User Account Control makes it easy for everyone to work within the confines of a Standard user account, allowing them to complete tasks as an Administrator (if or when necessary) without the need to log off and back on with an Administrator account. Of course, if a user doesn't have the password associated with an Administrator account, the action that they are trying to take will be denied.

Beyond simply helping to control which actions Standard users can take on a Windows Vista system, User Account Control also helps protect your system against threats like worms, viruses, and spyware infections. Most of these pests require Administrator-level privileges to lodge themselves onto your system, so User Account Control helps by alerting you when such actions are attempted. If you notice that the User Account Control dialog box appears at strange times, it could indicate the presence of a pest or an attempt by an outside entity to compromise the security of your system.

As mentioned earlier in this chapter, there is a way for a Standard user to perform tasks requiring the powers of an Administrator without the need to log off and back on. That's the product of a Windows Vista User Account Control–related feature known as Run As.

Run As is a feature that enables you to open a program or install software by supplying alternate user account credentials for that particular task only. For example, imagine that you're logged on with your Standard user account and want to run a program that requires administrative privileges. Rather than log off and then log on with an Administrator account to complete the task, you can use the Run As Administrator command to open the program. As part of doing this, you're prompted by the User Account Control dialog box to supply the password associated with an account allowed to carry out such a task, in this case an Administrator.

Assuming that you've supplied a valid password, the program (and that particular program only) will proceed as it normally would for an Administrator. When it's done (the installation is complete, or the program that you opened is closed), the privileges associated with the account used with the Run As Administrator command effectively disappear until you use it again.

Follow these steps to open or install a program using the credentials of another user account through the Run As Administrator feature:

  1. Select Start → Computer.

  2. Browse to the program file or shortcut that you want to open using another user's credentials.

  3. Right-click the file, and select Run As Administrator as shown in Figure 2-10.

    Image from book
    Figure 2-10: The Run As Administrator command is available from the Windows Vista shortcut menu.

  4. When the User Account Control dialog box appears, enter the password associated with an Administrator account and click Continue. The program will open and function according to the rights and privileges associated with the user account information supplied.

  5. Complete the required task(s), and then close the program. Your privilege levels are again those associated with the account you originally used to log on to Windows Vista.

An alternate version of Run As is available to those who prefer working from the Windows Vista command prompt, in the form of the runas.exe command. The basic syntax of the command is:

 runas /user:username program

Username is the user account name that will be used to launch the program or shortcut file specified. After this command is entered, you're prompted to supply the user's password, as shown in Figure 2-11. For a complete breakdown of switches and settings associated with the runas command, enter runas /? at the command prompt.

Image from book
Figure 2-11: Using runas.exe from the command prompt.


Summary

The security of any Windows Vista system is only as good as the security associated with its user accounts and logon settings. Keep the following points in mind when it comes to maximizing the security of your system:

  • Each user should have a personal user account.

  • Every user account should have a password configured.

  • A user's everyday user account should always be of the Standard type.

  • Only trusted users should be granted access to an Administrator account. Even with this access, this account should not be used for everyday tasks.

  • User accounts that are no longer needed should be deleted.

  • Use the Run As Administrator feature of the User Account Control to perform administrative tasks when required.


Chapter 3: Implementing Password Security

Although user accounts are the foundation upon which secure Windows Vista systems are built, the security they provide is only as good as the passwords that protect them. In fact, one could make a compelling argument that implementing user accounts with weak passwords is the same as not having any security at all. Part of the issue revolves around the fact that most users opt for simple passwords that are easy to remember, but people and their bad password habits are not the only culprits. A variety of hacking tools and password recovery programs also exist, capable of cracking and resetting even the most secure and complex passwords under the right conditions.

User accounts represent one of the first lines of defense on a Windows Vista system, but the need for good password practices hardly ends there. If you use the Internet, chances are that you have a myriad of different usernames and passwords configured to access different web sites. Although some of these may not represent a security risk - such as the one used to access the members area of your favorite gardening web site - others may be associated with services where rock-hard security is essential, as with online banking. Unfortunately, most users not only use weak passwords, but also compound the issue dramatically by using the same weak password for different user accounts.

If you're serious about security, you'll want to be absolutely sure that the passwords you use are actually capable of protecting your accounts. This chapter explains how to select good passwords, how to test password strength, and the importance of changing passwords regularly as serious threats like spyware proliferate. Along the way you'll also learn how to configure Windows Vista to enforce password and account lockout policy settings on users, how to get some help when it comes to remembering passwords, and how logon security can be completely compromised with the right tools and techniques.

Password Security

Passwords have always presented one of life's great quandaries. On the one hand you can select different complex passwords for each and every one of your user accounts, but what good is a strong password if you can't remember it? On the other hand, using similar (or even the same) weak passwords for every account virtually assures that you'll never forget it, but offers the equivalent of no real protection at all. The bottom line is that each user account password must be unique and complex to offer a high degree of protection. However, it's equally important for you to be able to remember your passwords. The good news is that striking this balance is not as difficult as most people make it out to be, although it does require a little effort and dedication on your part.

Selecting good passwords for user accounts involves three primary steps:

  1. Choosing strong passwords

  2. Avoiding common password "mistakes"

  3. Changing your passwords frequently

Each of these steps is looked at in more detail in the following sections.

Choosing Good Passwords

It's a question for the ages - what makes a password good and strong? The answer isn't all that difficult, but there is definitely a formula of sorts involved. A strong password should always:

  • Be comprised of at least 8 characters at an absolute minimum. The longer the password, the better, and Windows Vista supports user account passwords up to 127 characters in length.

  • Include both uppercase and lowercase letters.

  • Include numbers.

  • Include at least one (but preferably a few) special characters such as the following:

     ` ~ ! @ # $ % ^ & * ( ) _ + - = { } | [ ] \ : " ; ' < > ? . / ,

    as well as spaces and so on. Alt+ characters (those that require you to press down the Alt key and use number keys to access special non-ASCII characters) are also valid and a great option to increase password security.

If you follow these suggestions your password will be difficult for others to guess. However, going above and beyond the suggested minimums makes for an even stronger password, and one that will be exceptionally difficult for even the most advanced hacking tools to compromise. In other words, an 18-character password that includes both upper-and lower-case letters, a couple of numbers, and a few different symbols should keep your account well protected from malicious users commandeering even the latest and greatest hacking tools.

Although the complex 18-character password sounds great in theory, it's not hard to imagine how difficult it can be to remember, especially if chosen randomly. The password Y6 we)+Av*f6jJcvsI45 is certainly strong, but will do you little good if you can't remember it.

One of the easiest ways to create a strong password is to make it a derivative of something you'll remember. For example, if you often find yourself daydreaming about bass fishing, consider a password like NxtGR8*Trp4~Bas5. Loosely, this would translate to something you could remember, like "next great (fishing) trip for bass". Every element of an industrial-strength password is there: upper-and lower-case letters, a few numbers (replacing similar-looking or - sounding letters), and a couple of symbols thrown in for good measure. Remembering a password like this is surprisingly easy after typing it a few times, especially if it's related to something you're interested in or looking forward to.

Common Password Mistakes

If you follow the advice about creating good passwords, you're already on the right track. However, there are still a few common password pitfalls that you'll want to avoid.

A strong password should never:

  • Include any part of your username or full name, or the names of friends, family members, places, and pets that would be easy for others to guess.

  • Include personal information such as your birthday, phone number, address, tax identification number, or other potentially sensitive personal/family/business information.

  • Be the same as (or similar to) any other password you use.

  • Be comprised of regular English-language words, phrases, or acronyms.

Caution

Hackers know that most people use weak passwords, and usually ones based on personal information. The sad reality is that far too many users rely on easily guessed details (child and pet names, favorite sports team, and so on) to protect even their most confidential user accounts. If you've fallen into this common trap, don't panic. Instead, make a point of changing all your passwords to strong, secure alternatives today.

Additionally, to keep your passwords strong, never:

  • Share your passwords with anyone, including friends and family.

  • Use the same or similar password for different user accounts.

  • Write your passwords down in a way that it will be accessible to other users.

  • Use the same password for any extended period of time.

Caution

Never provide a password when asked for it by others, or share it with friends. Passwords are like the PIN numbers associated with bank or credit cards, and should be treated in the same way. If you ever feel like any of your passwords has been compromised, change it immediately.

You may feel as though you've come up with a suitable and brilliantly strong password, but it never hurts to take it for a test drive. Although there are many different programs designed to test password strength, you can also gauge the strength of your passwords on the http://www.SecurityStats.com web site. This site includes a tool that enables you to input your proposed password, and then scores it against a number of password best practices.

To test a proposed password with this tool, follow these steps:

  1. Click Start → Internet Explorer (or open your preferred web browser).

  2. In the Address bar, type http://www.securitystats.com/tools/password.php and press Enter.

  3. Enter a variation of your proposed password in the text box on this page. Don't use the exact password that you intend to use, but rather one that is similar. For example, if the password whose strength you want to test is NxtGR8*Trp4~Bas5, enter something like MjtFG4*Rto3#Das9.

  4. Click Submit. The password will be analyzed and then rated as shown in Figure 3-1. If necessary, use the suggestions provided on this page to help you create a stronger alternative password.

Image from book
Figure 3-1: The Password Strength Meter is a free testing tool at http://www.SecurityStats.com.
Image from book
Are You Being Watched?

Perhaps the most common reason why many users don't take password security as seriously as they should is that they don't believe that anyone would be interested in their personal information or communications. In other words, their computer (or their online user accounts) contains nothing of intrinsic value to others.

Unfortunately, these users are amongst the primary targets for hackers, spyware programs, and viruses. Every PC contains useful information about its users, from details such as credit card numbers to private e-mail messages. Ultimately, this information can be used for purposes as malicious as identity theft, blackmail, and spying, to more innocent activities like displaying targeted on-screen advertising messages.

These issues have become especially prevalent of late with the wildfire-like spread of spyware programs and dangerous viruses. Many of these pests are designed to steal personal information from your PC and then forward it to servers on the Internet without your knowledge. Others are even more dangerous in that they install programs that allow others to access and control your PC remotely, or capture each and every one of your keystrokes, making everything you type potentially accessible to hackers or other malicious third parties.

It's been estimated that up to 90 percent of all home and small office computers are infected by spyware and other similar exploits. If even a very small percentage of these systems have dangerous remote control programs or keystroke loggers installed, that's very bad news indeed. If you suspect (or know) that one or more of these pests has infected your computer, it's important to completely remove them, and then immediately change the passwords associated with all of your sensitive user accounts. If you don't, you're running the risk that someone out there on the Internet may already have complete access to some or all of your user accounts.

Image from book
Cross Reference

You'll learn more about protecting against virus threats in Chapter 9, and fighting spyware and related issues in Chapter 10.

Changing Passwords Regularly

Creating strong passwords for your user accounts is critical; not letting them get stale as a result of prolonged use is equally important. As a rule, make a point of changing all important user account passwords regularly, say once every 30 to 90 days. Changing your passwords more frequently helps to improve overall user account security, whereas using the same passwords for extended periods increases your risk exposure. Later in this chapter you'll learn how to configure Windows Vista (Business, Enterprise, or Ultimate edition) systems with password policy settings to enforce more secure user account password practices.

Note

When they feel comfortable with a password, most users will go to great lengths to avoid changing it. Perhaps human nature is to blame, but think of the process as being similar to eating your vegetables or taking your vitamins. Even though some may not taste all that appealing to begin with, they're good for you. The same can be said for passwords - although changing frequently may seem like a terrible pain, you'll be better off (security-wise) in the long run. At the end of the day, the pain associated with a serious breach of your personal privacy is much worse than the brief pinch experienced when the time to change passwords arrives.


Windows Vista Passwords

Here a password, there a password, everywhere a password! There's simply no shortage of user accounts that you'll need to work with as the owner of a Windows Vista system - and each is protected with a different password. In some cases, you'll be responsible for choosing and assigning passwords for these accounts; in others, third parties like your ISP will assign them to you. Regardless of the manner in which they're obtained, all passwords are important, and it's largely up to you to both remember them and ensure they're properly secured.

The primary types of account passwords that you need to deal with on a Windows Vista system include:

  • User account passwords

  • Web site passwords

  • E-mail and Internet service passwords

  • File security passwords

User Account Passwords

As you learned in Chapter 1, Windows Vista includes the capability to separate and secure the working environments of different users with user accounts. When protected by a strong password, your user account represents the first line of defense toward securing your files and improving your personal privacy.

On a Windows Vista system, user account passwords are stored in a protected part of the Registry known as the Security Accounts Manager (SAM) database. Instead of storing actual passwords in this database, Windows Vista first creates a one-way mathematical hash value of individual passwords, and then stores these hashed values in the SAM database. This database is protected by a system startup key stored on the hard drive, and then decrypted and encrypted as a part of the system startup and shutdown process.

The one-way hash function used to store user passwords is technically not reversible, but that doesn't mean that it offers perfect security. There are a number of tools and utilities that make it possible for a hacker with access to the SAM database to compromise its security, and then access another user's account. There's more about these types of software later in this chapter.

Although the password storage facilities in Windows Vista are far from perfect, that isn't an excuse not to protect user accounts with strong passwords. Many of the tools designed to crack or detect user account passwords rely on brute-force cracking methods, where thousands of different words (including the entire contents of English-language dictionaries) are used in an attempt to guess their way into a system. When you configure strong passwords for your Windows Vista user accounts, this cracking process becomes exceptionally difficult, to the point where the work associated with the undertaking is usually not worthwhile. Unless a hacker's motives are personal, most will not invest the time and effort required to hack a well-secured system. Quite simply, there's just no shortage of other low-hanging fruit (improperly secured systems) out there for them to take advantage of.

As the owner of a Windows Vista system, it's a safe assumption that you'll also be its primary administrator. From a security standpoint, it's up to you to educate other users on the importance of configuring a strong user account password, as well as changing it regularly. If you're running Windows Vista Professional, there is some help to be had on this front. By implementing policy settings (discussed later in this chapter), you can actually enforce strong user password requirements, ensuring that all users have no choice but to get with the program.

Web Site Passwords

Although most people only have to worry about remembering the details of a single Windows Vista user account, web sites' user accounts present another issue entirely. Needed for everything from entering the members' area of some sites to accessing web-based e-mail, it doesn't take long for these accounts to add up at an alarming rate.

In many cases your e-mail address serves as your username on these sites, but it's usually up to you to select a password. Although some sites do enforce password policies (such as requiring a minimum password length of six characters), most don't make the requirements very tough - they're too afraid to enforce strict password requirements, lest they scare away or frustrate a potential member.

Even in cases where a site enables you to select a weak password, it's important to take the high road and choose a good, strong password. This is obviously more critical for some sites - there's no denying that an online banking user account is more important than the one used to access the member's area of a gardening web site - but treating all user accounts as being important is a good idea, even if only as part as developing better password habits.

Later in this chapter you'll see how password management software can make the process of implementing good user account password security much easier.

Caution

Never use the same password for different web site user accounts. Many people sign up for a new web site user account, provide their e-mail address (typically required), and then configure the same password for the new site that they use to protect their e-mail account. Effectively, this is the same as sending the new site your e-mail username and password, which in turn provides all the information someone at that site would need to log on to your e-mail account. If you have done this in the past when creating web site user accounts, change the password associated with your e-mail account immediately as a precaution.

E-mail and Internet Service Passwords

Some passwords are easier to forget than others, especially when Windows Vista helps by remembering them for you. Such is typically the case with user accounts assigned to you by your Internet Service Provider (ISP). For example, if you use a dial-up or DSL-based Internet connection, your ISP likely supplied you with a username and password that must be used to connect to their service. After initially configuring these settings in Windows Vista, however, you can save the information so that you don't have to type the password manually each time you log on.

The same is usually true of the e-mail account details assigned by your ISP. This user account (which gives you access to your e-mail inbox) is usually configured once in an e-mail program like Microsoft Outlook or Windows Mail, with the password again remembered for future reference. Having the program remember the username and password associated with your account saves you the trouble of having to re-type your password each and every time you want to check for new messages.

In some cases an ISP allows you to choose passwords for these accounts, but many simply assign them to you. Although the username and password combination that you use for dial-up or DSL access typically cannot be changed, the password associated with your user account usually can. Many service providers give you access to a dedicated support web site from which you can change your e-mail account's password, as well as other account details. Check your ISP's web site to see whether you can change details like your password online. If you can, configure strong passwords for your e-mail accounts, and change them regularly.

File Security Passwords

Many programs include the capability to secure files, folders, and even entire disks with a password. A great example is the password protection that can be incorporated into a ZIP file, where the correct password must be supplied to open the file and get at its contents. Similarly, many encryption programs use individual passwords as the key to encrypt and decrypt files.

The major difference between user account passwords and those used to secure files is that file passwords are sometimes shared with other users. For example, you might password protect a file that you send to another user, and that user will need to supply that same password to open the file. If sharing a file in this way is your goal, come to an agreement with the other user about a suitable password in advance; never use one of your own personal passwords, which would ultimately need to be shared with the other user.

Cross Reference

Public key encryption is a better option for securely exchanging files with other users. You'll find more about encryption and other methods of securing files, folders, and disks in Chapter 14.


Implementing Password and Account Lockout Policies

Convincing users to apply passwords to their user accounts is sometimes tough, but getting them to configure good strong passwords is even more challenging. Even after you've explained their importance and outlined the potential dangers of choosing a weak password, most users still opt for a basic or familiar password that they have no trouble remembering. Even worse, some users configure a password in short term, and then remove it once they get tired of typing it in.

Understanding that old habits die hard, Windows Vista (Business, Enterprise, and Ultimate edition only) includes the capability to configure policy settings that enforce password requirements on all system users. For example, you can configure settings that control how often passwords must be changed, how long they must be, and even force users into selecting a reasonably strong password. As you've already learned (by the fact that users can log on without a password), no such policy settings are enabled or enforced by default. If you want to get your system's security situation under control, however, the configuration of Password Policy settings is an absolute necessity.

The Windows Vista primary Password Policy settings include:

  • Enforce Password History - Dictates the number of new and unique passwords a user must use before he can go back to using an older password. The higher this number, the better.

  • Maximum Password Age - Controls how many days a user can use her current password before being forced to change it. Forty-two days is the default value, but shorter time periods are obviously more secure.

  • Minimum Password Age - Controls how many days a user must use his current password before he's allowed to change it. Effectively, this setting stops users from getting around settings like Enforce Password History by immediately changing their password a number of times until they can get back to using their previous (and perhaps preferred) password. By default, users are allowed to change their password immediately. Consider setting this value to a few days or more.

  • Minimum Password Length - Dictates the minimum number of valid characters in a user's password. Eight is a good start, but 15 or more is definitely more secure.

  • Password Must Meet Complexity Requirements - Controls the characteristics that make a user's password valid, including character requirements.

Note

If you enable the Password Must Meet Complexity Requirements policy setting, user passwords must be at least six characters long, cannot contain the users' real names or usernames, and must include at least three of the following four elements: uppercase letters, lowercase letters, numbers, and symbols. The password Mydoghasfleas would not meet these complexity requirements, but the password My&do6hasFlea5 would.

Password Policy settings are an excellent first step toward enforcing some basic rules and requirements in the user password arena. However, it's equally important to ensure that your Windows Vista system can guard against hacking attempts. For example, under the Windows Vista default configuration, any person can try to log on with another user's account an unlimited number of times by attempting to guess the password. Implementing password complexity requirements will certainly make the challenge more difficult, but it's still better to be safe than sorry.

Windows Vista Professional systems address the issue with Account Lockout Policy settings. In a nutshell, these policy settings enable you to dictate how many incorrect logon attempts can occur before an account is locked. When locked out, an account cannot be used to log on to your Windows Vista system until an Administrator unlocks it, or a pre-configured period of time has passed.

The Windows Vista Account Lockout Policy settings include:

  • Account Lockout Duration - Dictates the number of minutes that an account remains locked out until it is unlocked automatically. If set to a value like 5, a user could attempt to log on again 5 minutes after being locked out (enough time to take a break, and perhaps remember the password). If set to 0, accounts are locked out until unlocked by an Administrator.

  • Account Lockout Threshold - Controls the number of failed logon attempts before a user's account is locked out. When set to 0, user accounts will never be locked out.

  • Reset Account Lockout Counter After - Dictates the number of minutes that must pass before the account lockout threshold value is reset to 0.

The Reset Account Lockout Counter After setting can be a little confusing. The purpose of resetting the account lockout counter is to ensure that incorrect logon attempts don't add up over time. For example, if you set the account lockout threshold to 3, then 3 incorrect logon attempts will lock out the account - regardless of whether they all happened over the last minute, or cumulatively over the course of the last six months. Configure Reset Account Lockout Counter to a value like 30 minutes to ensure that incorrect logon attempts don't accumulate toward a lockout days or weeks from now. Every user occasionally forgets or mistypes his password!

Caution

When Account Lockout settings are configured to lock out accounts on a Windows Vista Professional system, these settings are enforced for all users, including those with Administrator accounts. The only exception is the built-in Administrator account, which cannot be locked out. Don't forget the password (and potentially the new username) that you've applied to this account. If all other user accounts get locked out, you need to be able to log on with this account to unlock them.

Configuring Password Policy Settings

Security-related policy settings are configured using the Local Security Policy MMC on a Windows Vista Professional system. Only users with Administrator accounts can use and make configuration changes with this tool.

Follow these steps to configure password policy settings on a Windows Vista Professional system:

  1. Click Start → Control Panel.

  2. In the left-hand Control Panel menu, click Switch To Classic View (if necessary).

  3. Double-click Administrative Tools.

  4. Double-click the Local Security Policy shortcut.

  5. When the User Account Control dialog box appears, click Continue.

  6. In the Local Security Settings window, expand Account Policies.

  7. Click the Password Policy folder (Figure 3-2) to view the default policy settings.

    Image from book
    Figure 3-2: Password Policy settings.

  8. Double-click Enforce Password History to open its properties window (see Figure 3-3). Select the number of user passwords to be remembered, and then click OK.

    Image from book
    Figure 3-3: Enforce password history

  9. Double-click Maximum Password Age, select an appropriate value in days, and click OK.

  10. Double-click Minimum Password Age, select the minimum number of days that a user must use a given password before changing it, and click OK.

  11. Double-click Minimum Password Length, select a minimum length for user password (such as 8), and click OK.

  12. Double-click Password Must Meet Complexity Requirements, click Enabled, and then click OK.

  13. Close the Local Security Settings window.

Follow these steps to test your new password policy settings on a Windows Vista Professional system:

  1. Click Start → Control Panel.

  2. Double-click the User Accounts applet.

  3. At the Make Changes To Your User Account screen, click Change Your Password.

  4. At the Change Your Password screen, enter your current password and then enter (and confirm) a new password such as testpass that does not meet the new password policy requirements. Click Change Password. The dialog box shown in Figure 3-4 appears, stating that the new password does not meet the configured password policy requirements. Click OK.

    Image from book
    Figure 3-4: Message displayed when a password doesn't meet policy requirements.

  5. Enter a new password that does meet your new password policy requirements and click Change Password.

Configuring Account Lockout Policy Settings

Like Password Policy, Account Lockout Policy settings are configured using the Local Security Policy tool, which is only accessible by Administrators.

Follow these steps to configure account lockout settings on a Windows Vista Professional system:

  1. Click Start → Control Panel.

  2. In the left-hand Control Panel menu, click Switch To Classic View (if necessary).

  3. Double-click Administrative Tools.

  4. Double-click the Local Security Policy shortcut.

  5. When the User Account Control dialog box appears, click Continue.

  6. Click the Account Lockout Policy folder to view the default policy settings (see Figure 3-5).

    Image from book
    Figure 3-5: Account Lockout Policy settings.

  7. Double-click Account Lockout Threshold and then configure the number of invalid logon attempts (for example, 3) that can be attempted before an account is locked out. Click OK.

  8. When the Account Lockout Threshold is configured, the Suggested Value Changes window will open to suggest settings for the remaining Account Lockout Policy settings. Click OK.

  9. Double-click Account Lockout Duration, and type 0 in the Account Is Locked Out For box. When set to 0, accounts are locked out indefinitely. Click OK.

  10. Close the Local Security Policy window and log off.

Follow these steps to test your new account lockout policy settings and unlock a locked user account:

  1. Attempt to log on to another user's account using an incorrect password until you reach the configured Account Lockout Threshold.

  2. After configured number of failed attempts has been reached, you get a message stating that the account has been locked. Click OK.

  3. Log on with your Administrator account.

  4. Click Start, right-click on Computer, and select Manage to open the Computer Management MMC. User accounts cannot be unlocked via User Accounts in Control Panel.

  5. When the User Account Control dialog box appears, click Continue.

  6. Expand Local Users and Groups, and then click the Users folder.

  7. Double-click the locked-out user account.

  8. On the General tab, uncheck the Account Is Locked Out check box, and click OK.

  9. Close the Computer Management MMC.

Image from book
Tracking Logon Attempts

Implementing Account Lockout Policy settings is one easy way to track whether someone has been trying to log on to your Windows Vista system as another user. Assuming that the user in question hasn't simply forgotten his username and password combination (you'll have to ask him), chances are good that another person has been playing a password guessing game with the account.

A suspiciously locked-out account provides a good clue that something may be amiss, but there is another way to gather more information on logon attempts. The tool you need for this purpose is the Security Log in Event Viewer, which automatically logs details of all successful and failed user logon attempts on both Windows Vista Home and Professional systems.

To check the contents of your system's security log, follow these steps:

  1. Click Start, right-click Computer, and select Manage. The Computer Management MMC opens.

  2. When the User Account Control dialog box appears, click Continue.

  3. Expand Event Viewer → Windows Logs and click Security. Successful events are listed with a key icon; failed events are designated with a lock.

  4. In the Task Category field look for events of the Logon/Logoff type. Click a Failure Audit event of this type to view details about the event.

In the case of a failed logon attempt, the Description section lists details including the user account associated with the logon attempt, the reason the logon failed, and the time at which the event occurred.

As a general rule, take some time to browse through your system's security log at least every couple of weeks, even if nothing appears to be amiss. You may not find anything suspicious, but it's better to keep an eye open for potential issues than to assume that everything is perfectly fine.

Image from book


Storing Passwords Securely

Remembering one strong password can be tough, but trying to remember 10 or more good passwords can be next to impossible. Between user account, web site, Internet service, and file encryption passwords, it's not uncommon for the average user to have anywhere between 15 and 20 username-and-password combinations to remember.

Certainly forgetting a required password can be a frustrating experience - it represents one of the main reasons why most users opt for the easy way out (using very simple and similar passwords) if given the chance. However, as you're now aware, this is an extremely bad idea from a security perspective, and increases risks to your personal privacy dramatically.

Thankfully, help is close at hand. On the logon user account front, Windows Vista includes a helpful feature that virtually ensures you'll never be locked out if you happen to forget your password. For all other user accounts (those for web sites, e-mail accounts, and so forth), a reasonable solution can be found in the form of secure password management software, programs that remember your passwords for you. Both of these helpful tools are examined at in more detail in the following sections.

Password Reset Disk

Understanding that users may occasionally forget their passwords, Windows Vista enables users to create a special floppy disk that can be used to reset user account passwords should they be lost or forgotten. Known as a password reset floppy disk, each user on your Windows Vista system should create one as a precaution, just in case the password is forgotten.

After a password reset disk has been created, any user who has forgotten his password can use his personal disk to reset his password. One key benefit is that users who reset their password by using the floppy disk do not lose access to their encrypted files, stored Internet passwords, and certificates, as they would if an Administrator reset their password in Control Panel or using the Computer Management tool.

Follow these steps to create a password-reset disk for your Windows Vista user account:

  1. Click Start → Control Panel → User Accounts.

  2. In the upper-left corner of the screen, click Prepare For A Forgotten Password (see Figure 3-6).

  3. Follow the steps in the Forgotten Password Wizard to create a password-reset floppy disk for your user account.

Image from book
Figure 3-6: Create a password reset disk from User Accounts in Control Panel.
Caution

After you create a password reset disk for your user account, label it appropriately (but not too obviously) and store it in a safe place. Anyone with physical access to your Windows Vista system and this floppy disk can log on using your username and change your password to whatever value he pleases.

Follow these steps to reset your user account password using your password-reset disk:

  1. At the logon screen, click your username and press Enter. Click the Reset Password link on the logon screen.

  2. Insert your password-reset floppy disk, and follow the steps in the Password Reset Wizard to create a new password.

Password Management Software

Instead of dealing with the frustration of trying to remember username and complex password combinations for different web sites, you may want to consider employing the help of a password management program. These programs are designed to help you create a username and password database for different web sites and services, remembering logon details for you.

A good password management program will enable you to store all sorts of username and password combinations, and protect the contents of its database with strong encryption. In most cases, these programs allow you to configure a master password, which must be entered before you can use, add, or change the user account settings it stores.

One great example of such a program is RoboForm from Siber Systems. This program (both free and paid versions are available) offers comprehensive password management capabilities, complete with strong encryption protection. It can be downloaded from http://www.roboform.com.

After you've installed it, begin by configuring a strong master password for the RoboForm database. When that's done, RoboForm will be integrated into your web browser as a toolbar, and will offer to save username and password combinations as they're submitted (see Figure 3-7).

Image from book
Figure 3-7: RoboForm offers to save your username and password combination for a web site.

When you revisit a site for which a passcard already exists, RoboForm is capable of entering and submitting your login information (via the RoboForm browser toolbar) as shown in Figure 3-8.

Image from book
Figure 3-8: RoboForm offering to submit stored username and password information for you.

RoboForm certainly isn't the only password management program available for Windows Vista, but it is amongst the most popular and easy to use. If you have trouble remembering your user account details, or have a tendency to use the same password for different accounts, then using a tool like RoboForm is highly recommended.

Caution

If you lose or forget the master password associated with your RoboForm database, you will not be able to decrypt or gain access to your saved user accounts and passwords.
Image from book
Strong Passwords To Go

Although storing and protecting your passwords on one computer with a free program like Access Manager may do the trick, perhaps you're a little more mobile. If you regularly log on to different computers at different locations, then you may want to consider a portable solution to the complex password issue.

In this case, portable comes in the form of a password management program that offers support for USB keychain or pen drives. These portable memory devices work with some password management programs, acting as an encrypted storage location for your usernames and passwords. With everything you need to access your logon details stored on a pocket-sized device, you can access them from any PC with an accessible USB port.

The Professional version of Access Manager 2 offers support for USB storage devices, giving you instant access to your password database from any computer with Microsoft's .NET Framework installed. The free version of Access Manager can be upgraded to Professional for a small fee.

Another program that will get the job done is RoboForm Pass2Go, available from http://www.roboform.com/removeable.html. This inexpensive program not only securely stores your usernames and passwords on a USB device, but also includes the ability to store your web site bookmarks and personal details used to automatically fill out web-based forms. That's secure, mobile, and handy.

Image from book


Implementing Additional Password Security Options

Protecting your user accounts with strong passwords is critical. As you've now learned, however, any person with physical access to your computer can potentially bypass even the most complex logon passwords using any one of a number of password cracking or recovery utilities.

To use these various tools, a person not only needs physical access to your computer, but also the capability to start your system with a bootable CD or floppy disk. Unfortunately (from a security perspective), the default BIOS settings on most computers are configured so that your system will first attempt to boot from a floppy disk, then a bootable CD, and finally your hard drive. What this means is that any user with the right tools who inserts a bootable disk can potentially get past any of the Windows Vista security settings you've implemented.

Thankfully, all is not lost. Although the current BIOS settings on your computer may allow the system to be booted from a floppy disk or CD, you can change these settings. Furthermore, you can protect your computer with different BIOS passwords to restrict BIOS configuration changes. The following section explores the different passwords that can be implemented to control what users can do when they have physical access to your Windows Vista system.

BIOS Passwords

When you first start your computer, an on-screen message appears giving the key (or key combination) that must be pressed to access your system's BIOS configuration settings. Usually something like F1, F2, or the Delete key, it differs depending on the make and model of your computer, as well as the type of BIOS that is installed. You may be prompted with a message that tells you to "press this key to enter the BIOS, System Setup," System Configuration Settings, or similar.

Tip

If you're having trouble accessing or configuring your computer's BIOS settings, Wim's BIOS Page (http://www.wimsbios.com) is an excellent reference site.

Your computer's BIOS won't be secured in any way by default, and that's potentially dangerous if you're worried about someone making configuration changes to your PC. In fact, if left unprotected, a user could seriously damage your system or render it virtually unusable by changing BIOS settings alone. Worse yet, he could implement BIOS passwords before you do, locking you out of your own system.

Although their names may differ slightly depending on the manufacturer, almost every BIOS can be protected by two different passwords:

  • A supervisor password, which must be entered to change BIOS configuration settings.

  • A user password, which must always be entered before the computer launches into any main boot process.

Figure 3-9 shows the BIOS Password configuration screen for a computer with a common Phoenix BIOS.

Image from book
Figure 3-9: BIOS Security configuration screen.

The exact steps to configure user and administrator passwords for a BIOS differ by manufacturer, but are generally similar to the following:

  1. Reboot your computer. Watch for the on-screen message that lists the key you need to press to enter the BIOS. Press that key when the message appears - if it passes you by and the Windows Vista boot process begins, reboot and try again.

  2. When the BIOS configuration screen appears, look for a section marked Passwords or Security. Once found, enter a password for Supervisor access.

  3. Next, enter a User password if that's your preference. If you do enter a User password, keep in mind that any user attempting to start your computer will need to know and supply this password to boot into Windows Vista.

  4. Even with a User password in place, the default BIOS configuration will allow any user who knows the password to boot from a floppy disk or CD. If you're concerned about this, look for a section in your BIOS marked Boot or Main. You should find settings that enable you to configure the order in which your computer will attempt to boot, usually something along the lines of A:, D:, C: - meaning your floppy drive first, CD drive second, hard disk third). You can usually change the order of this list to make your hard drive the first boot device in the list, or even remove the other options completely.

  5. Press the appropriate key sequence to save your new BIOS settings (usually Esc, then Y for yes).

Caution

If you do opt to configure BIOS passwords, it's imperative that you remember them or your PC could be rendered unable to boot. If necessary, write these passwords down and store them in a safe place.
Image from book
Evading BIOS Passwords

If you lose or misplace BIOS configuration passwords and cannot boot your system or change BIOS settings, there may still be hope. Many BIOS manufacturers configure backdoor passwords that can be used to access and change configuration settings should the need arise. Some PC vendors (such as Dell) can also help you reset the BIOS password for your computer if you call their technical support line and can provide the necessary details about your system. Utilities that claim to be able to crack BIOS passwords can also be found on the Internet.

Although it depends on the specific BIOS used, BIOS passwords can also sometimes be circumvented or erased by removing and then replacing a computer's CMOS battery, or by shorting the jumper pins on the motherboard that control CMOS memory. Of course, you should not rely on either of these methods as an alterative to remembering your password. Furthermore, attempting such changes might result in physical damage to your PC.

Image from book

Hard Disk Passwords

In addition to BIOS passwords, many laptops include a feature that allows you to configure a hard drive password. Although fundamentally similar to a BIOS User password, it's actually more complex. When a hard drive password is configured, a user cannot boot from or access the drive without that password. Even if the hard drive is physically removed from the laptop and installed in another computer, the password is still required for access - erasing CMOS memory or other BIOS-like techniques cannot circumvent it.

Although a hard drive password certainly appears to be a secure way to protect your computer, proceed with caution. If you forget this password your only real option is to replace the drive, or employ the services of a dedicated (and potentially expensive) hard disk recovery service in an attempt to crack or reset the password.

However, if your laptop's hard drive includes extremely sensitive information that you cannot risk another user gaining access to, you may want to consider configuring this option. If your system includes the capability to configure a hard drive password, the setting is usually configured from the same BIOS screen as User and Supervisor passwords.

Syskey Password

As you learned earlier in this chapter, the Windows Vista SAM database stores hashed copies of user account passwords, and encrypts the database for extra protection. By default, the system key (also known as the startup key) used to encrypt the database is also stored on the computer. As an added security feature, you can export this key to a floppy disk that must be inserted each and every time you attempt to boot Windows Vista. Alternatively, you can leave the startup key on the hard disk, and assign it a password that must be supplied toward the end of the Windows Vista boot process.

Obviously either of these methods can be used to add yet another layer of security to the Windows Vista startup process. However, if this floppy disk is created and lost (or if you assign a password and forget it), it's unlikely that you can access your system. Although some of the tools designed to recover passwords claim to be able to bypass or reset this password, they should not be relied upon as a backup method.

The tool used to change how the startup key is stored or protected on a Windows Vista system is called Syskey, and can run by any Administrator user account.

Follow these steps to run the Syskey utility on a Windows Vista system:

  1. Click Start. In the Search text box, type Syskey.exe and press Enter.

  2. When the User Account Control dialog box appears, click Continue.

  3. Type syskey.exe in the Open text box and click OK.

  4. At the Securing The Windows Account Database window, click Update.

  5. To protect the system key with a password, choose Password Startup (see Figure 3-10), enter and confirm your password, and click OK. Alternatively, to store the system key on a floppy disk, choose Store Startup Key On Floppy Disk, click OK, and insert a blank disk when prompted.

  6. When the Success dialog box appears, click OK.

Image from book
Figure 3-10: Configuring a startup password with Syskey.

Follow these steps to boot a Windows Vista system protected by a startup password:

  1. Restart your Windows Vista system.

  2. Toward the end of the boot process, the Windows Vista Startup Password dialog box will appear. Enter the startup password that you configured with the Syskey tool, and click OK.

  3. When the startup password is accepted, log on to Windows Vista normally.

Caution

If you choose to store the Windows Vista Startup key on a floppy disk, be sure to make a copy of this disk and store it in a safe place in case the original is ever lost or stolen. Without a disk, you will not be able to log on to your Windows Vista system.
Image from book
Let's Get Physical!

Even if you use the strongest user account passwords and implement multiple layers of password security, no computer is ever 100 percent secure (in a true computer security sense) if other people can gain physical access to it. The best you can do when attempting to secure your Windows Vista system is implement the strongest security settings available, and then ensure that physical access to the computer is restricted to users (to the greatest extent possible) who you know and trust. If this side of things has you worried, however, you'll want to explore some of the options that can be used to better secure the physical aspects of your computer.

If your Windows Vista system is a desktop computer, you may want to look into locking cases that require an actual key to gain access to internal components such as hard drives, CMOS batteries, and so forth. Of course, that won't stop a thief from picking up the computer and walking away with it.

This is especially true with laptop computers, where theft tends to be far too common. A variety of vendors supply cable locks that can be used to fasten both laptop and desktop PCs to an immovable fixture, but you shouldn't rely on these as more than a temporary barrier to theft. Although they may keep a laptop safe in a public location, they're no match for a set of good bolt cutters. To address this issue, some cable locks include piercing alarms that are triggered when cut or moved, and other manufacturers provide complete system replacement insurance if your computer is stolen while locked down. That may provide some comfort on the financial front, but it doesn't address the fact that someone else may now have access to your personal files and e-mail messages.

Of course, don't forget the old tried-and-true battle horse of physical security - the locked door. Sometimes the most simple security techniques are also the most effective.

Image from book


Summary

The security of any Windows Vista system is only as good as the passwords used to protect it. Keep the following points in mind when it comes to managing user account and other system passwords:

  • Create strong passwords that are at least eight characters long and include upper-and lowercase letters, numbers, and symbols.

  • Never include your username, real name, or other personal details in passwords.

  • Assign every user account a unique password.

  • Change passwords regularly.

  • Immediately change any password that may have been compromised.

  • Personal user account passwords should never be shared with friends, family, or other users.

  • Educate other users on the importance of implementing strong passwords and changing them regularly.

  • Use Password Policy and Account Lockout Policy settings to improve user account security on Windows Vista Enterprise, Business, and Ultimate systems.

  • Review the contents of the Event Viewer Security Log periodically.

  • Have every Windows Vista user create a password-reset disk.

  • Consider using password management software to securely store details for different user accounts.

  • At a minimum, add a BIOS supervisor password to your system.


Chapter 4: Using Built-in Tools and Settings to Improve Windows Vista Security

Question anyone with even a basic awareness of computer security and privacy issues about the most important tasks to secure a Windows Vista system, and you'll almost always get a lecture on how critical it is to install both firewall and antivirus software. Although there's no denying that the protection these programs offer is absolutely necessary, properly securing a Windows Vista system goes far beyond these essential basics. To secure any Windows Vista system to a high level, you must take advantage of both third-party security programs and the Windows Vista built-in tools and settings.

Window Vista users have no shortage of useful and powerful tools and settings at their disposal - even tools and options not specifically designed with security-related functions in mind are powerful allies in keeping your Windows Vista system locked down and protected. As a Windows Vista user, understanding the arsenal of defensive tools at your disposal is simply essential - although you may not use every available utility or setting on a regular basis, it's important to know what Windows Vista can and can't do before you start looking elsewhere for security solutions.

In this chapter you'll learn more about the native tools and settings that help in your quest to create the most secure Windows Vista system possible. From keeping track of key security settings to using the power of policy to implement user and computer restrictions, Windows Vista really can help to get the job done. The biggest issue, however, is finding and then knowing how to take advantage of many of the not-immediately-obvious security features in Windows Vista.

Exploring Running Processes with Task Manager

Every program and service that runs on a Windows Vista system does so in the context of what is known as a process. If you open Microsoft Word, for example, the WINWORD.EXE process runs until you close the program. Similarly, every time you open a new Internet Explorer browser window, another instance of the IEXPLORE.EXE process starts up. Sometimes a program runs many processes simultaneously, and it's not unusual for Windows Vista to use a single process to carry out many different tasks.

From a user's perspective, a running program is generally considered to be one that can be seen onscreen. For example, when you click the shortcut to open Internet Explorer, a new browser window opens, and the program is obviously running. Not every process that runs on a Windows Vista system does so in a visual manner, however. Many programs and processes run silently in the background, doing their thing without any user interaction whatsoever.

Unfortunately, most users don't recognize that there are a number of processes running in the background on their Windows Vista system. Some of these processes are absolutely required in order for Windows Vista to function. Others may be related to programs you've installed, which start automatically along with Windows Vista. Still others may be silently tracking your online activities, capturing personal details from your computer, or even using your Windows Vista system as a gateway for sending spam e-mail messages. These more malicious processes are usually referred to as mal-ware or spyware, but can also be the result of infections by viruses, worms, and Trojan horse viruses.

Outside of relying on the capabilities of antivirus and antispyware programs to detect rogue programs, you can also use the Windows Vista Task Manager tool to review all processes running on your system. By reviewing the list of running processes in Task Manager you can determine exactly what's running on your computer and the amount of resources that are consumed on a process-by-process basis. The names of different running processes are especially valuable from a security perspective - if you think that malware or another pest might be infecting your Windows Vista system, an unrecognizable or unusual running process name may provide the clue that something is amiss. Ultimately, a web search for the process name helps you to determine whether it's legitimate and necessary, or a security risk that you need to address.

Follow these steps to review running processes with Task Manager on a Windows Vista system:

  1. Right-click the Windows Vista taskbar and click Task Manager from the shortcut menu.

  2. When the Task Manager window opens, click the Processes tab and then click Show Processes From All Users, as shown in Figure 4-1.

    Image from book
    Figure 4-1: The Task Manager Processes tab displays information on all running processes, including those running quietly in the background.

  3. Click Continue when the User Account Control dialog box appears. The Processes tab now displays all processes on your Windows Vista system that are currently running, and includes details about their memory and CPU usage.

  4. To close a process that you believe to be a security risk (see the Tip below for details on determining whether a process is dangerous or not), click the process name, and then click End Process. When the Windows Task Manager window appears, click End Process to end the process.

Tip

When reviewing running processes in Task Manager, you'll notice that their image names are often fairly cryptic, for example svchost.exe. This can make it very difficult to determine whether a running process is a legitimate process, or something that represents a security risk like malware or a Trojan horse. When in doubt about the purpose of a process, fire up your web browser and go to http://www.processlibrary.com. The http://www.ProcessLibrary.com web site enables you to search for Windows processes by name in a quest to determine the real deal behind unfriendly process image names.


Reviewing the Security Event Log

To help keep administrators abreast of potential issues, Windows Vista tracks a number of security-related events in its Security log. This log file, accessible via the Event Viewer MMC snap-in, audits a variety of different success and failure events that serve to record security-related issues that have occurred on a Windows Vista system. Any user with an Administrator account can view and manage the contents of the Security log file.

The Security log in Event Viewer is a great resource for a number of reasons. First, it provides detailed information about potential security violations, such as failed user logon attempts. For example, if one user tries to log on with another's account by attempting to guess their password repeatedly, the Security log lists each failed logon attempt, including username, date, and time details - invaluable information in determining who made the logon attempt. Similarly, an entry is added to the Security log every time a user logs on successfully, allowing you to determine which users have been using your Windows Vista system, and when.

Beyond simply tracking logon events, the Security log also records details about system events (the time on the computer's clock being changed), changes to system policy settings (such as File and Printer sharing being enabled), and the use of administrative privileges. Not every event recorded in the Security log requires action on your part, but having access to detailed information about security-related events is certainly useful. In its default configuration, the Windows Vista Security log stores up to 20MB of event information, and then overwrites older entries when this file size is reached.

The Security log in Event Viewer contains two primary types of events:

  • Success Audits. Identified by a key icon, success audits display information about a security-related event that was successful, such as a user logging on to Windows Vista successfully.

  • Failure Audits. Identified by a lock icon, failure audits display information about a security-related failure, such as a user being unable to log in because he or she specified an incorrect username or password.

On Windows Vista Home systems, you cannot change the security event categories that are logged. On Windows Vista Business, Enterprise, and Ultimate edition systems, however, you can configure logging for security event categories (both success and failure events) via Local Security Policy. You'll learn more about Local Security Policy later in this chapter.

Follow these steps to review entries in the Event Viewer Security log:

  1. Click Start → Control Panel → Administrative Tools → Event Viewer.

  2. When the User Account Control dialog box appears, click Continue.

  3. When the Event Viewer MMC opens, expand Windows Logs and click Security to view events in the Security log, as shown in Figure 4-2.

    Image from book
    Figure 4-2: The Security log in Event Viewer.

  4. Double-click a Security log entry to view its details. The example shown in Figure 4-3 is a Failure Audit event in the Logon/Logoff category that was logged as a result of a user trying to log on with an incorrect password.

Image from book
Figure 4-3: Reviewing the details of a failed logon attempt in the Security log.
Tip

Although the Properties window for a specific event includes many useful pieces of information, problems can often be difficult to decipher due to the technical nature of the provided information. If you find yourself unable to determine what a logged security event actually means, try performing a search on the Microsoft Help and Support web site (http://www.support.microsoft.com) for the item's Event ID number (for example, Event ID 529). Alternatively, you can try searching for details on the EventID.net web site, available at http://www.eventid.net.

Follow these steps to configure Security log settings:

  1. Click Start → Control Panel → Administrative Tools → Event Viewer.

  2. Expand Windows Logs, right-click Security, and click Properties. This opens the Log Properties–Security window to the General tab, as shown in Figure 4-4. Configure new Security log settings as per your preferences.

  3. To save the contents of your Security log, right-click Security in Event Viewer and then select Save Events As. Browse to an appropriate folder, give the file a descriptive name, and then click Save.

  4. When you save the Security log file, you can safely empty the active log by right-clicking Security and selecting Clear Log (and then Yes when prompted to confirm the action).

Image from book
Figure 4-4: Configuring settings for the Security log.
Note

The Windows Vista Event Viewer also includes a number of log files, including the System and Application logs. The System log is where operating system-related errors, warnings, and information events are logged, while the Application log is used to store events related to programs installed on your system - both are valuable sources of troubleshooting information. As a best practice, you should also consult the Event Viewer System and Application logs for potential issues every time you review the contents of your Security log.


Using Windows Security Center

Windows Vista includes an applet in the Control Panel named Security Center. Windows Security Center is a Windows Vista tool that informs you about the status of different security-related programs and settings, and alerts you about misconfigured, out-of-date, or disabled components. Specifically, Windows Security Center informs you as to the status of firewall software, the Windows Vista Automatic Updates feature, antivirus and antispyware programs, and the security settings associated with Internet Explorer and the User Account Control feature.

When you open the Security Center tool in Control Panel, details on the status of all items is provided in a color-coded format. From a security perspective, the status of every item should always be On or OK. In cases where an item is set to anything other than On, details about the potential dangers of your current setting and recommendations are given.

Even if you never open the Security Center applet in Control Panel, this tool still keeps you informed about potential security threats by displaying warning icons and balloon messages on your taskbar. An example of such a message is shown in Figure 4-5.

Image from book
Figure 4-5: The Security Center taskbar message displays when Automatic Updates are turned off.

Follow these steps to open and review Windows Security Center settings:

  1. Click Start → Control Panel → Security Center. The Windows Security Center window opens as shown in Figure 4-6.

  2. Review the status information of all items in the Security Center window. If any of these items are not set to On or OK, click the provided buttons or links to view additional information about remedying the issue.

Image from book
Figure 4-6: The Windows Security Center tool.


Configuring Local Security and Policy Settings

One of the most powerful ways to control the configuration of a Windows Vista system is via the configuration of what are known as policy settings. In general terms, the Windows Vista policy settings enable you to delve beyond the standard configuration options in areas like Control Panel for the purpose of implementing more advanced or restrictive settings. Some of these configurable settings enable you to control the ways in which Windows Vista communicates, whereas others impose limitations on the actions that all users can perform. Ultimately, the Windows Vista policy settings offer more power to administrators looking for greater flexibility and control over who uses their system, and how.

The capability to configure policy settings through a graphical interface is available on Windows Vista Business, Enterprise, and Ultimate systems only, accomplished by using the Local Security Policy and Local Computer Policy MMC snap-ins. In the following sections you learn more about configuring both Local Security Policy and Local Computer Policy settings.

Local Security Policy

Windows Vista enables you to configure a variety of security-related settings via the Local Security Policy MMC. This tool is designed to give you more control over advanced options and settings that aren't typically accessible through the Windows Vista standard graphical tools. Although the majority of users generally don't need to delve into these settings in order to ensure a secure system, they do offer Windows Vista administrators who want a higher level of control over their system a way to exercise it. The Local Security Policy MMC interface is shown in Figure 4-7.

Image from book
Figure 4-7: The Local Security Policy MMC.

The broad categories of settings that you can configure using the Local Security Policy tool include:

  • Account Policies. As you learned in Chapter 3, Account Policies enable you to control and configure settings related to user password requirements and account lockout settings. Settings in the Account Policies section are among the more commonly configured on a Windows Vista system.

  • Local Policies. Configurable Local Policies on a Windows Vista system include settings related to auditing, user rights assignments, and security options. Auditing settings give administrators greater control over the types of events that are recorded in the Windows Vista Security log. User rights assignments allow an administrator to assign advanced capabilities to users and groups, such as the right to back up files and folders. Security options enable you to control things like the status of the Guest account, how users can interact with removable media, and the ways in which a Windows Vista system allows network communications to occur.

  • Windows Firewall with Advanced Security. This section of the Local Security Policy MMC provides access to advanced Windows Firewall settings, including configurable logging options and inbound/outbound traffic restrictions.

  • Public Key Policies. The Public Key Policies section of the Local Security Policy MMC enables you to configure settings related to the Windows Vista Professional native file encryption feature, the Encrypting File System (EFS). You'll learn more about configuring EFS-related settings in Chapter 14.

  • Software Restriction Policies. The Software Restriction Policies section of the Local Security Policy MMC is designed to enable administrators to define more (or less) restrictive settings that relate to who can use installed software programs on the Windows Vista, and to what extent.

  • IPSec Policies. IPSec is an encrypted communication protocol that protects communications on a TCP/IP network. The IPSec Policies section enables an administrator to define secure communications rules and parameters that should be used when Windows Vista tries to exchange data with other IPSec-aware operating systems.

Follow these steps to review local security policy settings:

  1. Click Start → Control Panel → Administrative Tools → Local Security Policy.

  2. When the User Account Control dialog box appears, click Continue.

  3. In the Local Security Policy MMC window, expand the local policy categories to view their contents.

  4. To view the configurable options for a policy setting, double-click a policy setting to open its Properties window, as shown in Figure 4-8.

Caution

Many of the configurable settings available in the Local Security Policy MMC are advanced and should never be altered unless you're absolutely clear about what the setting does, and the repercussions of making changes to it. As a general rule, very few of the Windows Vista policy settings need to be changed as part of ensuring a secure home or small office computer.
Image from book
Figure 4-8: Reviewing the Properties of a Local Security Policy setting.

Local Computer Policy

If you've ever used a Windows computer in a larger corporate environment, then you may already be familiar with the idea behind computer policies. From a user's perspective, computer policies are usually a set of restrictions that stop them from changing the configuration of their PC. For example, in some companies, users cannot change their wallpaper picture or settings, whereas in others they cannot save files or folders to their desktop. In effect, bigger companies use computer policy restrictions to maintain a consistent Windows desktop environment. Although sometimes frustrating for users, implementing computer policy settings typically leads to a more stable desktop environment, which in turn leads to lower user training and support costs.

As you might imagine, implementing computer policy settings on a network with a thousand (or many more) Windows Vista systems running is a daunting task if you had to configure each PC individually. For this reason, networks that you configure into what is known as a Windows domain can use capabilities included with Windows 2000 Server or Windows Server 2003 to centrally configure policy settings once, and then have them apply to all client systems in the domain, including systems running Windows Vista. When you configure in this way, you deploy computer policy settings using what is known as Group Policy.

In effect, the settings that you can configure via the Local Computer Policy MMC on a Windows Vista system are the same ones that you can deploy via Group Policy on a larger Windows network. The only real difference is that deploying settings to Windows Vista clients via Group Policy requires a network running at least one Windows Server 2003 (or Windows 2000 Server) computer running the Microsoft Active Directory service. For cases where a network doesn't include such a server, the Local Computer Policy tool allows you to configure these same policy settings on a Windows Vista Business, Enterprise, or Ultimate edition system, albeit one computer at a time.

Although there's no denying that Local Computer Policy is a powerful Windows Vista feature, you should always be selective about the settings you choose to enable, especially on a home computer. Implement settings that are too restrictive, and users may not be able to perform the basic actions that they need or want to, which often leads to frustration or even a sense that your Windows Vista system doesn't function correctly. If you do opt to enable any Local Computer Policy settings, try to do so in a way that attempts to strike a balance between usability and reasonable restrictions - your goal should always be to ensure a consistent and well-functioning Windows Vista system, not one that is so restrictive that it is almost unusable.

Examples of common User and Computer settings that you can configure using the Local Computer Policy MMC snap-in include user desktop settings (hiding or displaying certain elements); Control Panel settings (allow access to Control Panel or blocking it completely); System settings (allowing users to make certain types of configuration changes); Windows Component settings; and more. If you can think of a useful computer-or user-related configuration setting, chances are that there's a Local Computer Policy setting that can make it happen.

There are literally hundreds of different Local Computer Policy settings that you can configure to control how users interact with a Windows Vista system - far too many to cover here. The best way to gather more information about Local Computer Policy settings is to browse through the Local Computer Policy MMC interface and review configurable options. If you want to know more about what a particular setting does, right-click it and click Properties. The Explain tab in the properties of an object provides a detailed overview of the setting and the impact that implementing it has on users of your Windows Vista system, as shown in Figure 4-9.

Image from book
Figure 4-9: Reviewing the Explain tab in the Properties of a Local Computer Policy setting.

Almost all of the Windows Vista configurable Local Computer Policy settings support three different configuration options. These include:

  • Not Configured. This is the default option for most Local Computer Policy settings - when set to this value the policy setting is ignored.

  • Enabled. When set to Enabled, the function outlined in a Local Computer Policy setting is enforced. If you're ever in doubt about what enabling a given setting actually does, always consult the Explain tab for details.

  • Disabled. Results vary when a Local Computer Policy setting is configured to the Disabled setting. Always consult the Explain tab in the properties of a Local Computer Policy setting prior to disabling it - it's always important to determine exactly what the repercussions of making this change are.

In addition to the three basic setting outlined in the previous list, many Local Computer Policy settings allow you to configure additional advanced options, which vary from setting to setting.

Follow these steps to review and configure group policy settings on a Windows Vista Business, Enterprise, or Ultimate system:

  1. Click Start. In the Search text box, type mmc and press Enter. When the User Account Control dialog box appears, click Continue. An empty MMC window opens.

  2. Click File → Add/Remove Snap-in.

  3. At the Add Or Remove Snap-ins window, select Group Policy Object Editor (as shown in Figure 4-10) and click Add.

    Image from book
    Figure 4-10: Adding the Group Policy snap-in to manage Local Computer Policy settings.

  4. When the Select Group Policy Object window appears, click Finish. Click OK to close the Add Or Remove Snap-ins window.

  5. Expand Local Computer Policy → User Configuration → Administrative Templates → Desktop. Click the Standard tab. A list of user desktop-related configurable policy settings appears, as shown in Figure 4-11. In this case, the State of all settings is Not Configured.

    Image from book
    Figure 4-11: Reviewing user desktop configuration settings.

  6. Double-click a setting such as Desktop Wallpaper to open its Properties window, as shown in Figure 4-12.

    Image from book
    Figure 4-12: Reviewing the Properties of a Local Computer Policy setting.

  7. If you want to enable the setting (which in this case would force a particular desktop wall-paper image to appear on all users' screens, click Enable to enter a path to the image file, and then click OK. If you later decide that you want to undo this action, change the state of the setting back to Not Configured.

  8. If you did enable the Remove Recycle Bin icon from Desktop setting, close the Local Security Policy MMC and return to your desktop. The Recycle Bin icon should no longer be visible on the desktop.

Caution

Be careful when configuring restrictive Local Computer Policy settings on a Windows Vista system. The settings that you configure with the Local Computer Policy MMC apply to all users, including Administrators. If you configure settings that are too restrictive, you may actually stop all users (including Administrators) from being able to undo the changes.


Summary

Windows Vista includes a variety of built-in tools and settings that help improve system security. Keep the following points in mind when using built-in tools and settings to secure your Windows Vista system:

Use the Processes tab in Task Manager to determine which programs and background processes are running on your Windows Vista system. Unknown or unfamiliar processes could be malware or other programs that represent a security risk.

Review the Security log in Event Viewer regularly to check for potential security issues that might need to be addressed, or to gather information on past events.

Periodically open the Security Center applet in Control Panel to check the status of your firewall, Automatic Updates, antivirus and antispyware programs, User Account Control, and Internet Explorer. Address issues as they're discovered, and keep an eye on Windows Vista's taskbar for Security Center warning icons and messages.

Review Local Security Policy and Local Computer Policy settings on a Windows Vista system to determine whether implementing any of these settings will help you to better secure and protect your system. Always exercise caution when implementing these settings, however, because all configured settings impact all users, including those with Administrator accounts.


Part II: Making Surfing Safer

Chapter List

Chapter 5: Securing Your Web Browser
Chapter 6: Implementing Parental Controls


Chapter 5: Securing Your Web Browser

Overview

It may come as a surprise to many new users that the Internet isn't limited to the World Wide Web and e-mail facilities alone. Although there's certainly a great deal of Internet real estate beyond these components, it's hard to argue that the Web isn't the face of the Internet. In fact, the vast majority of users rely on one particular program - their web browsers - to access every facet of the Internet. From using web-based e-mail services to browsing Usenet newsgroups via specialized web sites, there are few corners of the Internet that one cannot reach via a web browser like Internet Explorer.

As handy and ubiquitous as the web browser may be, its popularity has made it an increasingly popular target for hackers, crackers, and other shady organizations in the online world. As the capabilities of web browsers have grown beyond accessing simple HTML-based web pages, so too have the risks associated with using browsers as an interface to the Internet. The experiences offered to the web surfers of today are much more dynamic in nature, allowing them to interact with sites in a variety of new and exciting ways. The drivers behind these innovations include technologies like Java, scripting languages, ActiveX, and the like. Unfortunately, many of the same technologies and features that make surfing the web a more interesting and dynamic experience for the web surfers of today are the same ones that are putting the browsing public at a more serious security and privacy risk than ever before.

And so the time has come when every Internet user - and (arguably) especially those who use Internet Explorer - needs to give serious consideration his web browser's security. From malware threats like spyware and browser hijackings to the privacy risks associated with tracking cookies, there's just no shortage of security and privacy threats that can find their way onto your Windows Vista system via your web browser.

In this chapter you'll learn more about the need for web browser security, and how to implement it using the Windows Vista native browser Internet Explorer 7 (IE7). You'll also learn why many people are looking beyond Internet Explorer to many alternative web browsers as substitutes in their quest to surf the Web with a higher degree of system security and personal privacy.


Securing Internet Explorer

The development of high-speed Internet connections has given rise to a whole slew of new and dynamic web technologies and with them, the forces of evil (so to speak). In fact, in many cases users need to do nothing more than visit a web site programmed to include malicious code in order to find their computer infected by threats like Trojan horse programs, spyware, relentless pop-up advertising windows, and even cookies that track their every move on the Internet for (primarily) market research purposes. In effect, the hacking, cracking, and general bad guy communities online have taken advantage of the usability features of web browsers to infect and infest computers with a wide variety of objects that present very real risks to the security and privacy of Internet users.

Perhaps the worst thing about browser-based threats is that as a user, you really don't need to do anything more than click a (seemingly) harmless link or open the wrong web page to end up with a computer rife with security and privacy threats. Unfortunately, these browser-based threats tend to sneak by not only antivirus software packages, but also personal firewall programs. With the majority of Windows computers infected by some form of malware (AKA malicious software), the security and privacy risks to the web surfers of today are both very real and incredibly common. With that in mind, it's absolutely imperative that you take the steps necessary to configure your browser so that the threats posed by web-based pests don't put the security of your PC and your own personal privacy at risk.

As the native web browser included with Windows Vista (as well as previous Windows versions), it's little surprise that Internet Explorer is the most popular web browser in use on the Internet. Where once Netscape Navigator was a surfer's browser of choice, Internet Explorer has firmly established its dominance amongst the web surfing public - for better or worse.

As the most popular web browser in use, Internet Explorer has also become the prime target for all manner of security-related threats. This is especially true of malware objects, which have found their way onto the majority of Windows systems by way of (historically) lax security settings in Internet Explorer. With support for all major web-scripting languages, interactive components like ActiveX controls, and its own Java virtual machine, Internet Explorer has arguably been the perfect vehicle for malware developers looking for a way to infect and infest Windows users' PCs. Effectively, those aiming to compromise the security of Windows systems made Internet Explorer's focus on usability as a gateway to compromise system security and user privacy. Thankfully, Microsoft recently made a newfound commitment to system security and developed a number of improvements to Internet Explorer with the release of IE7.

To its credit, Internet Explorer is a highly configurable web browser that includes a number of helpful and effective security-related features and components. These include the capability to:

  • Divide web sites into different web content zones, and apply different security-related settings to each.

  • Configure privacy options globally, or for individual web sites.

  • Prevent browser pop-up windows, and manage add-on components designed to extend the capabilities of Internet Explorer.

  • Protect against phishing-related threats.

Each of these Internet Explorer security and privacy features is explored in more detail in the following sections.

Configuring IE Zone Security Settings

One of the most powerful security features available in Internet Explorer is the ability to categorize web sites into what are referred to as web content zones. Internet Explorer has four of these zones,

three of which you can customize to include the sites you specify. The benefit of this zone-based approach is that you can configure different zones to different levels, applying a set of security settings to all sites that are members of the zone. This enables you to place web sites with high potential risk factors into a zone with very restrictive security settings, and place sites you consider safe into zones with more permissive settings.

The four Internet Explorer web content zones include:

  • Internet. The Internet zone is the default web content zone in which all sites that you do not specifically add to other zones reside. The default security level assigned to sites in the Internet zone is Medium-high.

  • Local intranet. The Intranet zone is a special zone designated to all web sites that reside on your private network. For example, if you have a web server running on a computer on your home network, it's considered part of the Local intranet web content zone. The default security level assigned to sites in the Local intranet zone is Medium-low.

  • Trusted sites. The Trusted sites zone is a manually configured list of web sites and domains that you explicitly trust. For example, you might add your bank's web site address to this list, as well as others like the address of your web mail provider, preferred online news sources, and other trusted sites you visit frequently. The default security level assigned to the Trusted sites zone is Medium.

  • Restricted sites. The Restricted sites zone is a manually configured list of web sites and domains that you do not trust. All less secure browsing features are disabled when you visit a site on this list. The default security level assigned to the Restricted sites list is High.

Internet Explorer enables you to assign one of four different pre-configured security levels for any of its web content zones, or to define your own custom settings. The four pre-configured security levels that you can assign to web content zones include:

  • Low. This is the least secure level that you can configure for a web zone, but also the most functional. Minimal safeguards and warning prompts are provided at this level, and most types of content from sites are downloaded and run without issue.

  • Medium-low. This security zone level is effectively the same as the medium level, but with fewer prompts. Most types of content are downloaded and run without issue, although unsigned ActiveX controls are not downloaded. This level is most appropriate for the Local intranet zone.

  • Medium. This security zone level tries to strike a reasonable balance between browsing functionality and security. This level prompts the user before potentially unsafe types of content are downloaded, and never downloads unsigned ActiveX controls. This setting is most appropriate for the Trusted sites zone.

  • Medium-high. This level prompts the user before potentially unsafe types of content are downloaded, and never downloads unsigned ActiveX controls. This setting is most appropriate for the Internet zone.

  • High. This security zone level is the most restrictive from a security standpoint, but also the least functional. All less-secure features are disabled at this level in a bid to stop dangerous content from infecting or impacting your system. This setting is most appropriate for the Restricted sites zone.

Although the pre-configured security level settings typically meet the needs of most users, custom level settings can also be assigned to any zone. To define custom level settings for a zone, select the zone's icon and then click the Custom Level button. This opens the Security Settings window, as shown in Figure 5-1.

Image from book
Figure 5-1: Configuring custom security settings.

When you configure custom settings for a web content zone, the ability to choose a new security level via the slider tool is disabled. However, you can return to any site's default settings (and regain access to the security level slider) at any time by selecting the zone in question and clicking the Default Level button.

As a general rule, you do not need to change the security level settings associated with a given web content zone when using IE7. Instead, add specific web sites to a suitable web content zone. For example, add a site that you trust (http://www.google.com, for example) to your Trusted sites list, and add potentially dangerous sites (like http://www.coolwebsearch.com) to your Restricted sites list. These sites then inherit the security settings applied to its parent zone.

Follow these steps to add a web site to your Trusted sites list:

  1. Click Start → Internet Explorer → Tools → Internet Options → Security.

  2. On the Security tab (as shown in Figure 5-2), click Trusted Sites, and then click the Sites button.

    Image from book
    Figure 5-2: The Internet Explorer Security tab.

  3. In the Trusted sites window, enter the address of the trusted web site in the Add This Website To The Zone text box, as shown in Figure 5-3. Click Add.

    Image from book
    Figure 5-3: Adding a web site to the Trusted sites web content zone.

  4. Add additional sites to the Trusted sites zone as necessary, and then click Close once complete.

Note

You can add web sites to your Restricted sites list in exactly the same manner you add others to the Trusted Sites zone. However, the process of individually adding each and every site that you consider dangerous is a huge undertaking. Thankfully, a utility named IE-SPYAD2 can do all of the dirty work for you. IE-SPYAD2 is a tool that adds a comprehensive list of web sites and domain names associated with online advertisers, marketers, and malware developers to the Internet Explorer Restricted sites list. This tool is free, and the list is updated with new site and domain details on a regular basis. You can download IE-SPYAD2 for free from http://www.spywarewarrior.com/uiuc/resource.htm.

Protecting your Windows Vista system from the dangers associated with malware objects is not a matter of configuring web browser security settings alone. Every Windows Vista system should also have a suitable antimalware program installed to remove malware threats as they're discovered - or better still, prevent them for finding their way onto your PC in their first place. You'll learn more about the techniques and programs used to fight malware threats in Chapter 10.

Configuring IE Privacy Settings

The capability to completely block access to potentially dangerous web sites by adding them to the Restricted sites web content zone is great, and certainly helps to improve Internet Explorer (and by extension Windows Vista) security when used correctly. However, you also need to give some serious thought to your personal privacy when surfing the web - specifically about whether you should allow the sites you visit to identify you, and whether you should allow those sites to collect certain types of information. A banner ad displayed on a web page may seem harmless enough, but it's not uncommon for online advertisers to place a special file (known as a cookie) on your computer to track the sites you visit for marketing or research purposes.

Internet Explorer includes three main features to improve your personal privacy online. These include:

  • Configurable privacy settings that enable you to control how your computer deals with cookies. Cookies are files that web sites create (and store on your computer) that often contain information about your personalization preferences for web sites, but can also include username or e-mail address information. It's important to recognize that the vast majority of cookies are not malicious - they're often required to visit secure sites like those associated with online banking, for example.

  • Privacy alert messages that appear when you attempt to access a site that doesn't meet the privacy criteria you've configured.

  • The capability to view a web site's P3P privacy policy. Many web sites now include P3P documents that outline exactly how they use any information that they collect when you access the site, or exactly what details are stored in their cookies.

Follow these steps to configure Internet zone privacy setting in Internet Explorer:

  1. Click Start → Internet Explorer → Tools → Internet Options → Privacy.

  2. The Privacy tab displays details of the current security level, as shown in Figure 5-4. Use the slider to configure a higher security level according to your preferences. As a general rule, do not set the Internet zone's privacy settings any lower than Medium.

    Image from book
    Figure 5-4: The Internet Explorer Privacy tab.

  3. If you don't feel that any of the Privacy tab's pre-defined settings meet your needs, you can also click the Advanced button to define custom settings as shown in Figure 5-5.

Image from book
Figure 5-5: Configuring Advanced Privacy Settings.
Note

Most of the major online advertising and marketing entities have designed sites such that their cookies are allowed even if you configure the Internet Explorer privacy option to the High setting. If you absolutely want to ensure that your computer does not receive cookies from a certain web site or online advertiser, then block its address on the Per Site Privacy Actions screen accessible via the Sites button on the Privacy tab.

Follow these steps to allow or deny cookies from a particular web site:

  1. Click Start → Internet Explorer → Tools → Internet Options → Privacy.

  2. Click the Sites button. At the Per Site Privacy Actions screen, enter the web site address or domain name from which you want to allow or deny cookies in the Address Of Website text box.

  3. With the web site address or domain name entered, press the Block or Allow button. This adds the site to your Managed Web sites list, as shown in Figure 5-6. Click OK when you add all sites you want to allow or block.

Image from book
Figure 5-6: Blocking cookies from a web site.
Caution

If you configure Internet Explorer's privacy settings to block all cookies, you may not be able to access secure web sites that require your computer to accept cookies in order to function. To block most cookies, configure your web browser to use the High privacy setting, and then click the Advanced button to add individual web sites or domains for which cookies should always be allowed, such as your online banking web site.

Follow these steps to view a web site's privacy policy settings:

  1. Click Start → Internet Explorer. Browse to a web site of your choice. The web site visited in this example is the P3P Public Overview web page at http://www.w3.org/P3P.

  2. Click Page → Web Page Privacy Policy. This opens the Privacy Report dialog box, as shown in Figure 5-7.

    Image from book
    Figure 5-7: The Internet Explorer Privacy Report dialog box.

  3. Click the address of the web site in this list and then click Summary to view the Privacy Summary document for the site, as shown in Figure 5-8. The summary provides key details on how the site collects and users information about its visitors.

Image from book
Figure 5-8: Reviewing a web site's Privacy Summary.
Note

Although it would be great if every web site published Privacy Policy information, the vast majority of sites still do not - in other words, it's not unusual to visit a web site with Internet Explorer and then receive a "Could not find a privacy policy for" message when you select the Page → Web Page Privacy Policy menu option. For more details about Privacy Reports and the P3P project, visit http://www.w3.org/P3P.

Managing Access to Web Content

As great a resource as the Web is, it certainly contains no shortage of potentially offensive content. From sites that include inappropriate language and violent content to those that contain materials of a sexually explicit nature, even a basic web search can lead you to pages that many people find inappropriate.

To help address this issue and give you more control over the types of web sites that Internet Explorer users can access, Internet Explorer includes Content Advisor settings. These settings (which are effectively disabled by default) enable you to control the types of content that users can gain access to according to defined levels. For example, you can configure Content Advisor settings to allow users to access web sites that contain mild expletives, while denying them access to sites containing graphic depictions of sex, violence, or nudity.

To control access to potentially offensive web sites, Internet Explorer's Content Advisor feature relies on what are known as content ratings. By default, Internet Explorer includes the built-in ratings capability that the Internet Content Rating Association (ICRA, formerly known as RSACi) supplies. However, you can also install ratings from other Internet rating systems to better suit your specific content filtering needs.

Beyond simply filtering out potentially offensive content, the Internet Explorer Content Advisor settings also allows you to define lists of approved sites (ones that are never subject to filtering settings), and protect settings with a supervisor password to ensure that other users cannot make changes to the filtering settings that you've configured.

Follow these steps to configure Content Advisor settings in Internet Explorer:

  1. Click Start → Internet Explorer → Tools → Internet Options → Content.

  2. On the Content tab's Content Advisor section, click Enable.

  3. When the User Account Control dialog box appears, click Continue.

  4. On the Ratings tab (shown in Figure 5-9), click one of the category listings (such as Language) and then adjust the slider to specify the types of content in that category that users are allowed to view.

  5. Click the Approved Sites tab, shown in Figure 5-10. If you add a site's address in the Allow This Web Site text box and click Always or Never, the setting you choose applies to the site, regardless of the settings configured on the Ratings tab.

    Image from book
    Figure 5-9: Configuring Content Advisor Ratings in Internet Explorer.

    Image from book
    Figure 5-10: Configuring the Approved Sites settings in Internet Explorer.

  6. Click the General tab as shown in Figure 5-11. Configure settings in the User options section according to your preferences, and then click the Create Password button in the Supervisor section to configure a password that you will need to enter when you want to make changes to Content Advisor settings or allow users to access a restricted web site.

Image from book
Figure 5-11: Configuring the General Content Advisor settings.
Cross Reference

Although the Internet Explorer Content Advisor settings can help you to regulate what users can access on the web, these capabilities are no match for dedicated content filtering techniques like the new Parental Control feature built into Windows Vista. You'll learn more about making the Internet safer for your family with the help of parental controls in Chapter 6.

Internet Explorer Security Features

One of the easiest ways to improve the security of Internet Explorer is to ensure that you're running the latest version, IE7. This shouldn't be difficult, because it's already built into Windows Vista. IE7 includes a number of security-related features and capabilities that were originally introduced in IE6 once Windows XP Service Pack 2 was installed, making it less susceptible to threats like malware and providing you with more control over how your browser responds when the sites you visit attempt to download elements like files or ActiveX controls.

Many of the core security features integrated into IE7 are behind-the-scenes in nature and require little in the way of user interaction. However, there are four key features that you should be familiar with. These include:

  • The capability to manage Internet Explorer add-ons.

  • A new integrated pop-up window blocker.

  • The new information bar that informs you when a site tries to download a file, install an ActiveX control, or display a pop-up window on your PC.

  • Phishing Filter, a feature designed to minimize the chance that you'll fall prey to phishing threats.

Each of these features is explored in more detail in the following sections.

MANAGING BROWSER ADD-ONS

One of the most powerful features of Internet Explorer is that users can extend and enhance IE7 capabilities by installing any of hundreds of different third-party browser add-ons. For example, if you install Adobe's Acrobat Reader software, its browser add-on component makes it possible to open and view PDF files from within the Internet Explorer browser window. Other add-ons are designed to add useful features to your browser by way of installing new toolbars. For example, you can use the Google toolbar to perform Internet searches without visiting the Google web site first, and you can highlight the term you've searched for in a resulting page, to easily find the information you're looking for.

Although there's no denying that adding a wide range of new features and capabilities to Internet Explorer is a very powerful option, not all browser add-ons are helpful. In fact, many Internet Explorer add-ons have more malicious intents in mind such as monitoring your web surfing activities, collecting personal information about you, or even displaying annoying pop-up ads. In some cases, these add-ons quietly hide in the background and go about their business in an almost completely transparent manner. In others, they add their own dedicated toolbar to your Internet Explorer window, and appear as though they allow you to perform some useful function (like performing and saving web searches).

It can be difficult to determine whether a browser add-on is legitimately useful or malicious in nature, and sometimes even tougher to figure out which add-ons are actually installed and running on your system. The appearance of a new toolbar (that you didn't purposely install) in Internet Explorer is usually a sign that malware or some other pest has found its way onto your PC. Thankfully, the Manage Add-ons feature can help you to determine which add-ons are present on your system, while allowing you to selectively enable, disable, or even update individual items.

To view the Internet Explorer add-ons installed on your system, click Tools → Manage Addons → Enable or Disable Add-ons. The Manage Add-on window displays a list of all browser addons that have been installed, giving you information about the add-on's name, publisher, status, and file details (see Figure 5-12).

Some add-ons are fairly easy to recognize, like the Shockwave Flash Object - if this is present in your browser, you almost certainly installed the Adobe Flash plug-in to view Flash-based web sites. You may find it more difficult to determine the origin or purpose of other objects, especially in cases where a long number (like {}, a number known as a CSLID) is shown as the add-on name. To enable or disable an add-on, simply click its name and select the appropriate option from the Settings section of the Manage Add-ons window, as shown in Figure 5-13. As a general rule, you should disable any add-on that you don't recognize or feel completely comfortable with until you can gather more information about any potential threats that it may pose. If you find that you've disabled a legitimate tool that you want or need to use, you can always re-enable it from the Manage Add-ons window as a later time.

Note

Windows Vista includes a safer version of Internet Explorer with all add-on components disabled by default. To open it, select Start → All Programs → Accessories → System Tools → Internet Explorer (No Add-ons).
Image from book
Figure 5-12: The Internet Explorer Manage Add-ons window.
Image from book
Figure 5-13: Disabling a browser add-on.

A great resource to help you determine whether an Internet Explorer add-on is legitimate is the CLSID/BHO List/Toolbar Master List available at the CastleCops web site at http://www.castlecops.com/CLSID.html. You can use this site to search for browser add-ons by name or CSLID number. When the name or CLSID is found, the site displays details about the add-on, including whether it's a legitimate tool or one that represents a security/privacy threat to your PC (as is often the case with add-on malware objects).

Cross Reference

The Internet Explorer capability to manage add-ons is helpful, but it's important to note that simply disabling an add-on doesn't completely remove it from your Windows Vista system. Although they may no longer present a viable threat while disabled, you should still take the steps necessary to remove potentially dangerous add-ons from your computer by uninstalling them completely (using Add Or Remove Programs in Control Panel), or employing the services of an antispyware program. You'll learn more about dealing with malware-related threats in Chapter 10.

BLOCKING POP-UP WINDOWS

Internet marketers and advertisers are always dreaming up new ways to gain exposure for their various products and services on the Internet. Although advertising methods like banner ads are now widely accepted (and basically expected) as a necessary evil on free web sites, ads that pop up in their own smaller browser windows are still largely reviled. In some cases, these pop-up ads are no more than an annoyance, easily dismissed by simply closing the offending browser window. In other cases, however, the onslaught of pop-up ads is relentless - even if you close one such window, another two may appear in its place.

The pop-up windows that close cleanly are a legitimate (although generally considered annoying and intrusive) form of online advertising, and can be easily controlled. You can configure IE7 to block all pop-up windows from opening, or to only allow pop-ups from certain web sites. A number of third-party Internet Explorer add-ons also include pop-up blocking capabilities, such as the Google and Yahoo! toolbars. The pop-up blocker you choose to use is largely a matter of personal preference - for the most part, they all perform the same basic function. With IE7, the pop-up blocker feature is enabled by default. Select Tools → Pop-up Blocker → Pop-up Blocker Settings to configure pop-up blocker settings, as shown in Figure 5-14.

Although a pop-up blocker may put an end to the annoyance that is pop-up advertising, it's important to recognize that this capability offers little in the way of any security-related functionality. For example, if your Windows Vista system is infected by malware designed to display pop-up windows as part of its programming, simply blocking the pop-up doesn't mean that your computer is any more safe or secure. In fact, chances are good that the malware component (now sans pop-ups) is still doing its thing silently in the background, while continuing to represent a security and privacy threat to you and your PC.

Image from book
Figure 5-14: Configuring the Internet Explorer Pop-up Blocker Settings.

Although there's no denying that pop-up blockers are a helpful solution to an annoying problem, always keep in mind that these tools are designed to stop an annoying behaviour, not remove or prevent security threats from your PC. Like sweeping dirt from a floor under a rug, don't rely on a popup blocker to solve what may actually be the signs of a bigger problem, such as a spyware infection. As annoying as they may be, a relentless onslaught of browser pop-up windows is one of the best clues that something more dark and dangerous may be lurking on your PC.

THE INFORMATION BAR

The information bar is a visual feature that appears just below the Internet Explorer address bar for the purpose of displaying information about downloads, blocked pop-up windows, potential security risks, and more. For example, if you have turned on the Internet Explorer pop-up blocker and a site attempts to launch a pop-up window, the information bar appears and displays a message alerting you to the fact that a pop-up was blocked.

The information bar keeps you informed about potential risks encountered when you surf the web with Internet Explorer. Whenever this bar appears, you can click the message it contains to display a shortcut menu with additional options, such as allowing the stated action or configuring related settings. An example of this shortcut menu is shown in Figure 5-15.

Image from book
Figure 5-15: An example of the shortcut menu that appears when you click the Internet Explorer information bar.

Ultimately, the Internet Explorer information bar feature informs you of potential security risks to your PC as you browse the web. It's important to note, however, that the information bar is just that - a feature that gives you with information about potential risks, but one that also leaves you in control of the actions taken as a result of the details it gives. The information bar does not stop you from downloading a potentially dangerous file or ActiveX control if you explicitly tell it to allow the action - in other words, keep an eye on the details that the information bar provides, read the messages you encounter carefully, and then make an informed decision on how you want to proceed.

PHISHING FILTER

Phishing Filter is a new security feature in IE7. Phishing (pronounced like fishing) is a technique whereby a malicious web site attempts to steal personal details like username and password combinations under the guise of being a legitimate web site. For example, a typical phishing attempt begins with an e-mail message (purporting to be from eBay or PayPal) that suggests that you need to log on to the web site to confirm your account details. When you click the link supplied in the official-looking message, you're actually taken to a bogus web site that looks entirely legitimate. If you submit your username and password details, you've effectively supplied a malicious user with everything they need to access your account. In other words, your personal information has been phished.

The IE7 Phishing Filter attempts to limit your exposure to phishing threats in three primary ways:

  • It maintains a list of safe sites on your PC, and compares all sites you visit to this list.

  • It alerts you to any suspicious phishing-like characteristics on the web sites you browse - for example, if Phishing Filter detects that a site is impersonating eBay, it alerts you to the threat.

  • You can configure the Phishing Filter to send details of suspect sites (with your permission) to Microsoft for further analysis.

In its default configuration, Phishing Filter automatically checks all of the web sites you visit for phishing-like characteristics. If you turn it off, Phishing Filter displays a notification icon on the status bar that you need to click to check whether a web site exhibits any phishing-like traits. If you want to change the Internet Explorer Phishing Filter settings, you can do so at any time by selecting Tools → Phishing Filter → Phishing Filter Settings. As shown in Figure 5-16, Phishing Filter settings are configured from the Advanced tab under Internet Options.

You can also use the Phishing Filter menu item to check the phishing status of the web site you're currently viewing by selecting Tools → Phishing Filter → Check This Website. That opens a dialog box similar to the one shown in Figure 5-17.

If you want to get more involved in the fight against phishing web sites, IE7 makes it easy. If you happen upon a site that appears to be a little, well, "phishy", head to Tools → Phishing Filter → Report This Website and enter details about the site for analysis.

Image from book
Figure 5-16: Configuring the Phishing Filter settings.
Image from book
Figure 5-17: Phishing Filter makes it easy to check for phishing-related web sites.
Caution

If you suspect that details from one or more of your online user accounts have been phished, you should immediately change the password or PIN associated with the account, place a fraud alert on your credit reports, and contact the bank or online merchant associated with the account. For more specific details on phishing threats and how to deal with them, visit http://www.anti-phishing.org.


Using Other Web Browsers

Prior to the release of Windows XP Service Pack 2, a number of security vulnerabilities led security and media organizations to recommend that users stop using Internet Explorer and switch to a safer web browser. Although there's no denying that many of the more recent browser-related exploits specifically targeted Internet Explorer (especially as a result of its scripting-, Java-, and ActiveX-related capabilities), there is no rock-solid guarantee that malware developers are not targeting other web browsers, or that they won't do so in the future.

Regardless, increasing numbers of users are switching to alternative web browsers every day. Although IE7 is still the obvious choice for most users (because it is already included with Windows Vista), a number of third-party web browsers exist. Users who make the switch to these browsers typically sacrifice little in the way of browser functionality, and are often zealous in supporting them - as an alternative to what they perceive as the dangers of Internet Explorer, regardless of how safe (or unsafe) it may actually be when properly secured.

Some of the most popular alternative web browser programs include:

  • Firefox. This open-source web browser, shown in Figure 5-18, has firmly entrenched itself as a viable alternative to Microsoft Internet Explorer and has a rapidly expanding user base. Some of this browser's key features include tabbed browsing (where a single browser window can be used to open multiple web pages, each on its own tab), integrated Google search facilities, and support for live bookmarks and RSS feeds. Firefox is available as a free download from http://www.getfirefox.com.

  • Netscape. Once the undisputed king of web browsers, Netscape's popularity waned as Internet Explorer's feature set advanced and surpassed it years ago. The latest versions of Netscape have vastly improved, and users are once again returning to it as an alternative to Internet Explorer. You can download the latest version of the Netscape web browser from http://www.netscape.com.

  • Opera. Opera is another popular alternative browser that includes features like tabbed browsing, integrated search and password management tools, and advanced customization features. You can download Opera, billed as "The Fastest Web Browser on Earth," from http://www.opera.com.

Image from book
Figure 5-18: The Firefox web browser is a popular alternative to Internet Explorer.

Regardless of whether you intend to switch from Internet Explorer to an alternative browser permanently, it's well worth your time to download at least one of these programs to explore them further. Using a different web browser does entail a slight adjustment period, but some of their advanced features and capabilities make them well worth taking for a test drive.

Caution

No program or web browser will ever offer complete or absolute security. Although Internet Explorer certainly receives it fair share of bad press, vulnerabilities have been discovered in other web browser programs. To review both old and new security issues discovered in Internet Explorer and competing products in more detail, visit the Secunia Advisories web site at http://www.secunia.com/advisories.


Summary

Web browsers like Internet Explorer are among the most popular and oft-used tools on any Windows Vista system. Unfortunately, a number of security and privacy threats can impact a Windows Vista system without proper browser security settings configured.

Keep the following points in mind when it comes to securing your web browser:

  • Add web sites to web content zones to define the security parameters that should apply to sites you visit frequently.

  • When configuring web content zone settings, never configure lower settings than those recommended by Internet Explorer. More restrictive settings are always more secure, but may impact browsing functions.

  • Install a tool like IE-SPYAD2 to add hundreds of web sites that are known to be dangerous to the Internet Explorer Restricted sites web content zone.

  • Configure appropriate Internet Explorer privacy settings to control the amount of information about your browsing habits that will be shared with online marketers, advertisers, and web site owners.

  • Explore the Internet Explorer Content Advisor settings as a method of controlling the types of content that you and other users can view on the web, but understand that the new Windows Vista Parental Control feature is a much more powerful option.

  • Disable any unknown or suspicious looking browser add-ons immediately - these are often malware programs or components.

  • Use the built-in Internet Explorer Pop-up Blocker to stop advertising pop-up windows from appearing. Understand, however, that blocking pop-ups does nothing to address underlying security risks (like malware infections) that may exist.

  • Consider using an alternative web browser like Firefox or Netscape if you're concerned about the security and privacy risks associated with Internet Explorer. Although there's no guarantee that other web browsers are more secure, you may find that an alternative browser better meets your web surfing (and security) needs.


Chapter 6: Implementing Parental Controls

Overview

There's no denying that the Internet has revolutionized the way in which we obtain information. Once upon a time, learning about the finer points of perennial gardening or the architecture of ancient Greece almost certainly meant taking a trip to the local library and digging through card catalogues in a quest to find books on the subject. Today, you can simply fire up your web browser, perform a keyword search, and gain access to thousands of pages of information on just about any subject imaginable. If information is power, then the Internet certainly flexes more than its fair share of muscle.

As great a resource as it may be, the Internet also has a large and dangerous dark side. There are literally millions of web pages devoted to pornography. Tens of thousands of computers are connected for the purpose of swapping pirated software, music, and videos. Scores of web sites are dedicated to spreading messages of hate and intolerance, and even promoting violence. It's literally the best and worst of society mixed together in a never-ending maze of information, delivered directly to your desktop. That's the same desktop that your children may be using to chat with a friend, or to research a subject to complete their homework.

You would be hard-pressed to find a teenager who hasn't used the Internet, and many kids are now hopping online at ages as young as four. It sounds scary, but the vast majority of children are accessing the Internet without direct supervision, and with no real restrictions or controls in place. That not only leaves them exposed to a wide variety of sensitive information, but also makes it easily accessible. Where the top shelf of the magazine rack at your local variety store may be just out of reach, gaining access to even more explicit content on the Internet is never more than a click away.

Unfortunately, the dangers of the Internet don't begin and end with shady content. There are some very questionable people online as well, with hundreds of reported cases of adults hanging out in Internet chat rooms attempting to befriend young users. These adults typically pose as minors themselves, attempting to engage children in explicit conversations or arrange real-life meetings. Ultimately, the Internet has the ability to put children in harm's way on a number of fronts.

Thankfully, all is not lost. The Internet can be a safe and secure resource with the right approach. Technology can provide part of the solution, but it does not offer a complete answer-ensuring that they use the Internet safely also means educating your children about potential dangers, and giving thought to how you monitor their online activities. In this chapter you'll learn about some of the key dangers that children face online, and methods that you can use to help mitigate these risks. This includes some practical tips for parents of children venturing online, an explanation of how content filtering software can help keep your Windows Vista system clean, and a look at why restricting access to the Internet isn't a solution just for kids anymore.


Keeping Children Safe Online

In a perfect world, the Internet would automatically shield children from contact with questionable content and dangerous people. Unfortunately, nobody exercises complete control over the online world in any centralized manner. What is considered illegal in one country may not even be considered an issue in another. Although a myriad of laws and regulations exist for the purpose of enforcing the rules in different jurisdictions, the Internet is not bound by geography. If a certain type of content is disallowed on Internet servers located in the United States, the owner can easily make the switch to a server in another country with more relaxed laws. To the Internet user, the physical location of a particular web site really doesn't make a difference-it's just another site, accessed by clicking yet another link.

Ultimately, what this means is that you cannot rely on anyone else-from lawyers and politicians to web site owners-to keep your children safe online. Hopefully things will be different in the future, but that's not the case right now. Today, keeping your children out of harm's way on the Internet is a responsibility left almost solely in your hands. Don't ignore the dangers or pretend they don't exist-if you have a computer with Internet access in your home, it's up to you to ensure that your children (and potentially their friends) aren't being exposed to inappropriate materials or dangerous people online.

Understanding Online Risks and Dangers

Any reasonable parent would agree that they don't want their child reading pornographic, hateful, or violent magazines. Similarly, they would almost certainly never allow their child to have personal conversations with a complete stranger, or arrange to meet someone they don't know at the local mall. In the physical world, most parents go to great lengths to teach their children the differences between right and wrong, and educate them about the dangers and risks that they'll encounter in everyday life. Unfortunately, almost all of these important messages pertain to the physical world only-interactions with real objects, people, and places.

For better or worse, the Internet is basically an electronic mirror of the physical world, and children need to be educated about online risks and dangers. What good is teaching your children not to talk to strangers if they only believe the risk applies to people on the street and not "happykid93", an otherwise anonymous chat buddy that they met on the Internet? Clearly, the potential dangers associated with chatting up a nameless and faceless person on the Internet are at least as great as doing the same with some random person walking down the street.

Although realities in the physical and online worlds can be strikingly similar, most parents are at a relative disadvantage when it comes to warning their kids about the dangers on the Internet. In a nutshell, many children are better versed (from experience) in the ways of the Internet than their parents. Be this as it may, it's important for parents to understand the risks that children face in the online world, and then come up with appropriate solutions to ensure that their children remain safe and protected.

Some of the key risks and dangers that children face on the Internet include:

  • Online predators. Adults posing as children or teens represent a very real threat to child safety online. These predators (as they've come to be known) tend to hang out in Internet chat rooms geared toward a younger audience, posing as minors themselves. Many seek to befriend children in the hope of gaining their trust, and sometimes arranging a real-life meeting. Although the number of adults engaged in predator-like activities is extremely small, the threat they pose is very real. Unfortunately, many younger Internet users simply take their online chats and correspondences at face value, never considering that someone might not be who they claim to be.

  • Access to pornography and other objectionable content. It's almost impossible to use the Internet for any extended period of time without coming into contact with objectionable materials like pornography, hate literature, or worse. By its very nature, the Internet is home to all manner of content, including the good, the bad, and the ugly. Finding these materials is no more difficult than performing a simple search on sites like Yahoo! or Google. Compounding the issue is the fact that children can easily stumble upon these materials without purposefully seeking them out.

  • Disclosing personal information. Although there are laws in place to stop web sites from gathering personal information from Internet users under 13 years of age without parental permission, there's little that actually stops children from submitting their information online. Some sites will use the information they collect to market to children, whereas others use it for demographic purposes. Regardless, it's never a good idea for children to submit their name, address, or contact details online. This information can be used for a myriad of purposes, some of which might put your child in harm's way.

  • Misunderstanding sources. The Internet is a wonderful research tool, literally overflowing with information. Alas, along with the myriad of excellent learning resources available online, there are also an astonishing number of sites containing incorrect and misleading information, not to mention outright lies. Younger Internet users may have trouble distinguishing whether what they've read is true or false, and whether a source is even reliable-you can't believe everything that you read, and that's especially true on the Internet.

Practical Tips for Parents

Getting children to understand and appreciate the risks associated with using a resource like the Internet isn't always easy. The following sections outline some practical tips for parents looking for ways to help improve the online safety of their children.

TALK THE TALK

Educating children about anything starts with a discussion, and there's arguably no better way to help keep your children safe on the Internet than by sitting down and having a chat about the potential dangers and risks associated with using the Internet.

A great way to start is by asking your child about how they use the Internet right now. Do they surf the web frequently? Do they use instant messaging programs, e-mail, and perhaps a web camera to communicate with friends? Do they download songs in MP3 format from file sharing services or play online games? An important part of helping to protect your children against online risks involves understanding how they use the Internet as a resource.

After discussing how they currently use the Internet, talk to them about some of the risks and dangers that they may be exposed to. Ask them about their own experiences, and even those of their friends. Remind them that even though the Internet may not seem "real" in a physical sense, there actually are people using the Internet in a myriad of different ways, and that not everyone is actually who they claim to be. Most importantly, try to instill in your child that the same rules that apply to keeping safe in the physical world also apply on the Internet.

Finally, take some time to discuss the ways in which your children are allowed to use the Internet. For example, if you don't want them hanging out in Internet chat rooms, let them know. Similarly, you might want to broach issues like your feelings on pornography, hate literature, and the like. Come to a reasonable agreement on what you will (or will not) allow when it comes to them using the Internet. Of course, this agreement may vary greatly depending upon your own thoughts, feelings, and beliefs, not to mention the age and needs of your children.

Tip

For some great advice related to understanding online dangers and explaining them to your children, visit the GetNetWise website at http://www.getnetwise.org.

LOCATION, LOCATION, LOCATION

Back in the old days, parents purchased PCs for their children with thoughts of a glorified typewriter in mind-in other words, it would be an educational tool to aid in completing their schoolwork. However, computers have very much become the ultimate entertainment center, especially with the growth of high-speed Internet connections. From chatting with friends online to playing games and even watching movies, there's no shortage of things for a PC- and Internet-connected kid to do.

When the PC is thought of as a study tool, most parents will gladly agree to locate it in a child's bedroom or in another quiet area in the home. Although this makes sense in cases where the PC actually is being used for educational purposes, it also makes monitoring a child's Internet activities very difficult. If your (or your child's) PC is located in a private area, keeping an eye on what your children are doing online can be next to impossible.

With that in mind, you may want to consider where you place your home computer(s) a little more carefully. If you want to keep the temptation of venturing into the darker corners of the Internet minimized, few things help more than setting up the Internet-connected computer in a high-traffic area. If you have more than one PC in your home, you may want to consider connecting only those in public areas to the Internet, leaving the rest disconnected to act as glorified typewriters.

USE PARENTAL CONTROLS

Discussing online dangers and keeping an eye on their surfing habits can go a long way toward making the Internet a safer place for your children. However, even kids with the best intentions will wander into the unknown out of curiosity, and monitoring Internet usage could be a full-time job on its own. Thankfully, you don't have to go it alone-help is available in the form of content filtering software, sometimes referred to as parental control programs.

As the name suggests, parental controls are designed to put you in control over what your children can and cannot do online. For example, these programs typically enable you to block all access to all pornographic web sites at the click of a button. This ultimately stops users from attempting to visit known adult web sites, or search for related terms. When an attempt to access blocked or filtered sites is made, most parental control programs display an error message and log the attempt to a file that can be referenced at a later time.

Beyond simply blocking content, parental controls typically enable you to configure times when Internet usage is allowed, and control which programs can be used. For example, you might decide that your children should only be allowed to access the Internet between 6 and 8 p.m., and even then cannot use access Internet file sharing or instant messaging programs. In the meantime, you could allow all other users to access the Internet without restrictions.

Ultimately, parental controls put you in control over how your children access the Internet, and to what extent. If you do choose to go this route, consider letting other users know that the software or feature is enabled, and exactly what it does and does not allow. Nobody likes to feel as though his or her activities are being monitored or watched. However, if the situation has been discussed and everyone knows that the filtering software is present, all users are certain to think more carefully about where they attempt to venture online. Parental controls are explored in more detail in the following section.


Restricting Internet Access Using Parental Controls

When it comes to policing how children and other users of a Windows system access the Internet (as well as the PC and programs for that matter), few solutions offer as great a degree of flexibility and power as the Windows Vista built-in parental control feature. Some of the key features associated with the Windows Vista parental controls include the capability to:

  • Restrict access to different types of Internet content by category, or by defining your own custom filters. The Windows Vista parental control feature allows you to block access to different categories of content-for example, all pornographic Internet content-by enabling a single filter. Where a built-in category doesn't meet your exact needs, you can allow or deny access to other types of content by specifying web site addresses.

  • Control access to the Internet using different communication methods and program types. This feature blocks access to instant messaging or file-sharing programs, while allowing users to surf the web with a browser like Internet Explorer or Firefox.

  • Control the times at which access to your PC is allowed or denied. The Windows Vista Parental Control feature enables you to specify a schedule whereby a user can only log on to your PC at certain times of the day, on certain days of the week. Using this feature, parents can effectively stop their child from accessing the Internet as necessary.

  • Log users' PC and Internet activity, including the web sites that they've attempted to access and the contents of instant messaging conversations. Logging and reporting features are an important part of the Windows Vista Parental Control feature, keeping parents informed of all Internet activity or attempts to access restricted web sites.

  • Enable content filtering for all users, or only certain users. The Windows Vista Parental Control feature includes the ability to enable content filtering for certain users only, thus allowing other users to access the Internet without restrictions.

  • Control access to games and other programs. In addition to controlling Internet access, the Windows Vista Parental Control feature gives parents control over the types of games that users can play by rating or title, and restricts access to individual programs installed on the PC.

Although Windows Vista offers parental control capabilities as a built-in feature, you can also use a number of different third-party programs to accomplish content filtering objectives. Each offers similar (but slightly different) combinations of features and capabilities. Some of the more popular parental control software packages include:

  • CYBERsitter. CYBERsitter combines excellent web filtering features with the ability to control access to instant messaging tools, FTP sites, file sharing programs, and even USENET newsgroups. It includes the capability to filter e-mail messages based on their content, to configure a schedule to control when Internet access is allowed, and to control which Windows Vista user accounts should have their online activities filtered. Available from http://www.cybersitter.com, CYBERsitter costs approximately $40.

  • ContentProtect. Available from http://www.contentwatch.com, ContentProtect costs approximately $40. ContentProtect stands out from many other content filtering programs because of its excellent reporting features and dynamic filtering capabilities.

  • NetNanny. Available from http://www.netnanny.com, NetNanny costs approximately $40 for a 1-year subscription. NetNanny extends on the basic filtering capabilities found in similar tools by including the capability to block access to online games.

Note

For a detailed review of different parental control programs options, see PC Magazine's Parental Controls Buying Guide at http://www.pcmag.com/article2/0,1759,1954772,00.asp.

Enabling Parental Control Restrictions

Follow these steps to implement parental control restrictions for a particular user of your Windows Vista system:

  1. Click Start → Control Panel → Parental Controls.

  2. When the User Account Control dialog box appears, click Continue.

  3. Click the name of the user to whom you want parental controls to apply.

  4. By default, parental controls are turned off for all users. To enable parental controls, click On, Enforce Current Settings. The section below the username will show the user's parental control settings (see Figure 6-1). Note that the default settings enforce a medium level of web restrictions.

    Image from book
    Figure 6-1: Implementing parental control settings for a user.

  5. Click Windows Vista Web Filter in the Windows Settings section. This opens the Which Parts of the Internet Can Username Visit? screen, shown in Figure 6-2.

    Image from book
    Figure 6-2: Filtering a user's access to the web.

  6. To explicitly allow or block access to specific web sites, click Edit The Allow And Block List link.

  7. In the Block Web Content Automatically section, choose a restriction level for the user based on what this user should be allowed to access online. If you choose a level like Medium Restriction, for example, access to unratable content and sites related to mature content, pornography, drugs, hate speech, and weapons will be blocked. To exercise more granular control over the types of web content that a user can access, click the Custom level and choose the types of content that should be blocked manually.

  8. To prevent the user from downloading files from the Internet, check the Block File Downloads check box in the Internet access section. After you've configured web restrictions for the user as per your requirements, click OK to return to the main User Controls screen.

  9. In the Windows Settings section, click Time Limits. In the day/time grid, click and drag your mouse across the days and times for which the user cannot use the computer. Figure 6-3 shows settings where the user is never allowed to log on to the computer between 10 P.M. and 7 A.M. After you have configured your preferred time settings, click OK.

    Image from book
    Figure 6-3: Controlling access to Windows Vista by time of day and day of week.

  10. Click Games. This section enables you to control whether the user can play games at all, and if so, it sets restrictions on the games that he or she can play by name or content rating.

  11. If you allow the user to play games, click the Set Game Ratings link. This opens a screen that enables you to set the highest game rating that the user can play (see Figure 6-4). When you set a maximum rating level, you can scroll down to block games that include specific types of content (irrespective of their rating) like Nudity, Violence, and so forth. Click OK after you have configured your preferred settings.

    Image from book
    Figure 6-4: Configuring access to games based on their ESRB rating.

  12. If you want to block or allow access to specific games by title, click the Block or Allow Specific Games link, set individual titles to User Rating Level, Always Allow, or Always Block (see Figure 6-5). Click OK once complete, and click OK again to return to the main User Controls screen.

    Image from book
    Figure 6-5: Controlling which games a user can play.

  13. Click Allow and block specific programs. This opens the Application Restrictions screen, as shown in Figure 6-6. By default, the user is allowed to use all programs. To control which programs the user can open, select Username Can Only Use The Programs I Allow, and then check the individual program names that are allowed. If a program name doesn't appear on the list, click the Browse button to add the program (by its file and folder location) to the list. Click OK once to complete. Click OK again to begin enforcing your parental control settings.

    Image from book
    Figure 6-6: Controlling access to installed programs.

Review Reports

After enabling the Windows Vista Parental Control features you should take the time to review the report of each user's activities regularly. These reports not only provide details about web sites that the user attempted to visit (and whether these requests were allowed or blocked), but also details about any files that were downloaded, the contents of instant messenger conversations, and more.

Follow these steps to review activity reports for a particular user:

  1. Click Start → Control Panel → Parental Controls.

  2. When the User Account Control dialog box appears, click Continue.

  3. Click the name of the user whose activity details you want to review.

  4. At the User Controls screen, click the View Activity Reports link. The Activity Viewer screen displays activity details associated with the user account over the past week, as shown in Figure 6-7.

    Image from book
    Figure 6-7: Reviewing activity reports for a user subject to parental control settings.

  5. Scroll down through the screen to obtain complete details on the user's activities, including top web site visits that were allowed, blocked, and more. If you want to review these items individually (rather than as a summary), expand the Username Account Activity menu in the upper-left corner and select the name of the activity item that you want details about.

  6. If more than one Administrator is managing Parental Control settings, click General System in the upper-left corner. The General System Information screen displays information relating to changes to Parental Control settings, account changes, logon attempts, and more, as shown in Figure 6-8.

    Image from book
    Figure 6-8: Reviewing General System Information relating to Parental Controls activities.


Using Content Filtering in Business Environments

You might think that online children need to have their online activities regulated and monitored, but that's just not the case. Almost all large companies-and increasingly, smaller companies as well-use some type of content filtering software to stop employees from venturing to all corners of the Internet on company time.

In the business world, content filtering is implemented for two main reasons. The first is an attempt to help reduce inefficiency-it's been estimated that Internet-surfing employees costs American companies billions of dollars annually in lost productivity. The second is to mitigate the potential for litigation and lawsuits resulting from workers being exposed to objectionable content on company premises.

The degree to which a company filters its employees' Internet activities varies greatly from one company to the next. Some filter all non-work-related sites; others selectively block only objectionable materials like pornography, hate literature, and any type of illegal content. Given the popularity of web-based e-mail and instant messaging programs, many companies block access to these services as well, or limit their use to certain times of the day only (for example, at lunch hour or break times).

Where standalone content filtering features like those found in Windows Vista are an ideal solution for implementing control over a small number of computers, businesses typically install server-based filtering programs that work in conjunction with proxy servers to control employee Internet access in a centralized manner. For details on popular content filtering programs that work with proxy servers like Microsoft Internet Security and Acceleration (ISA) Server, see http://www.microsoft.com/isaserver and http://www.isaserver.org/software/ISA/Content-Security.


Summary

The Internet can be a dangerous place, particularly for children. From objectionable content to shady users, the potential risks to users are as real as there are in the physical world. Keep the following points in mind when it comes to restricting access to the Internet:

  • The Internet has a dark side, one that can put children in harm's way. Educate children about the potential dangers they face online, and monitor their Internet activities.

  • Enable Windows Vista parental control features to ensure that children cannot access objectionable content on the Internet. These programs also give you more control over when users can access the Internet, and the types of software they can use while online.

  • In order for parental controls to be effective, ensure that all Computer Administrator accounts are protected by a strong password, and that users subject to parental controls are assigned a standard user account (to stop them from changing settings).

  • Review Parental Control activity log files regularly.

  • Content filtering isn't for children alone. If you run a business that gives employees access to the Internet, consider installing content filtering software to avoid having objectionable content accessible to users, and to help increase employee productivity.


Part III: Protecting Windows Vista Against Internet Threats

Chapter List

Chapter 7: Protecting Windows Vista with a Firewall
Chapter 8: Keeping Windows Vista Patched and Protected
Chapter 9: Protecting Against Viruses
Chapter 10: Fighting Malware-Protecting Against Spyware, Adware, and Browser Hijackers


Chapter 7: Protecting Windows Vista with a Firewall

Overview

There's little question that the Internet is one of the most valuable resources of our time. It's not only a reliable and effective communication facility, but also an invaluable research tool. As a global network of networks, the Internet is very much a community, complete with elements both good and bad. Although there's little question that the vast majority of Internet users are honest folks trying to make use of a great resource, there also exists a large (although percentage-wise relatively small) group of people online who would like nothing more than to compromise the security of your PC for their own gain.

These malicious users are the hackers, crackers, and script kiddies that represent the enemy to millions of legitimate Internet users worldwide. Unfortunately, you have little choice but to ensure that your computer is protected from these users and their threats. The number sounds almost unbelievable, but it's been estimated that an unprotected and unpatched computer running Windows is typically compromised less than 20 minutes after being connected to the Internet. From infecting your computer with viruses and spyware to installing remote control programs, the risks associated with leaving your PC unprotected are very real. In the same way that you lock your car doors when parking in a public location, you need to lock down your PC when venturing online.

In the case of computers connected to the Internet, the lock in question is a firewall. Although the capabilities of various firewalls vary, the primary role of a firewall is to act as the gatekeeper between your computer and the Internet. A firewall enables you to control what level of access (if any) Internet users have to your PC, and potentially which programs and services on your computer can gain access to the Internet. Quite simply, without the protection of a firewall your PC will quickly end up being a revolving door of incoming and outgoing traffic, remaining exposed to an Internet's worth of security and privacy threats.

In this chapter you learn more about how a firewall works to protect your PC from the dangers of the Internet, and how you can use some to control what leaves your computer destined for the online world. You'll also be introduced to the benefits, limitations, and configuration of different software firewalls, including the native Windows Vista Windows Firewall. Finally, you'll learn about the tools and techniques that you can use to test firewall security, helping you to ensure that your chosen firewall solution is actually providing the levels of protection that it should be.


Understanding the Role of a Firewall

At the most basic level, a firewall is a software program that acts as a security intermediary between your computer and a network like the Internet. The job of the firewall is to inspect all packets sent and received by your PC, and then decide whether to allow or disallow them based on its configured rules. When the firewall allows a certain type of traffic (for example, packets sent and received by an instant messaging program), communication occurs in the same manner as if no firewall were in place at all. However, if the firewall denies another type of traffic, communication attempts using that method will fail-the firewall intercepts the packets, compares them to configured rules, and then determines that the communication attempt should not be allowed, discarding the packets in the process.

Ultimately, a firewall puts you in control over which traffic is allowed to enter your PC, and which traffic is allowed to leave. In their default configuration, most firewalls allow all communication attempts originating from your PC to go on their way unencumbered-assuming that because the request came from your computer, it's good traffic and should be allowed to proceed. Conversely, almost all firewalls are configured to deny all connection attempts to your PC originating from the Internet by default-in other words, the firewall protects your computer from being connected to by Internet users unless you tell it to do otherwise. This default setup ensures that you can access the Internet in whatever way you choose, while stopping all outside users from connecting to your PC.

Although this firewall setup appears perfectly reasonable at first glance, the security risks associated with the Internet today actually make it less than optimal. In the following sections you learn more about how firewalls control inbound and outbound traffic, and why you need to carefully consider each of these traffic directions when it comes to ensuring that your firewall provides adequate security.

Inbound Filtering

Inbound filtering is the term that describes how a firewall deals with unsolicited traffic that it receives from the Internet. Unsolicited traffic is a connection attempt that does not correspond to any request that originated from your computer. In other words, if you fire up your web browser and make a request to view a certain web page, the information that the web server sends back to your system is not unsolicited-you made the request, and the web server simply replied. In the eyes of a firewall, an unsolicited connection attempt is where an Internet user or computer tries to connect to your PC without you doing a thing. A remote user attempting to connect to FTP server software installed on your PC is an example of an unsolicited request. In its default configuration, a firewall will typically deny these types of requests.

Of course, there may be times when you actually want Internet users to connect to your computer. For example, you may want to play an online multiplayer game, or exchange files over an instant messaging session. For times where you do want another user to be able to connect to your PC for these reasons, you can configure a firewall to allow the action. Doing this is sometimes referred to as opening a port, acting as a server, or configuring an exception. In the case of an online game, you may need to configure your firewall to open the ports that the game uses in order to allow your competitor to connect to your PC. As part of doing this, you tell the firewall to continue blocking all incoming connection attempts, except those required to play the game.

Inbound filtering is as close to a universal firewall feature as you'll find. With no additional configuration necessary, a firewall blocks all incoming connection attempts by default, and then only allows certain types of traffic through based on the rules you configure. Ultimately, inbound filtering is what stops any user on the Internet from connecting to your PC without your permission. When a firewall is not installed and enabled, no inbound filtering takes place, meaning that Internet users can connect to available services on your PC without any intermediary keeping an eye on things.

Outbound Filtering

Where inbound filtering is designed to control which traffic originating from the Internet can enter your PC, outbound filtering controls which traffic can leave your computer destined for the Internet. By default, most firewalls are configured to allow all traffic leaving your computer to access the Internet without restriction-the basic assumption being that you made the request, and know what you're doing.

The capability to access anything on the Internet may seem great at first glance, but filtering outbound traffic is important for a number of reasons. First, you may actually want to restrict what users of your computer have access to online. For example, perhaps you want to allow all users to surf the web and send and receive e-mail messages, but block them from using the computer to connect to file sharing services. If your firewall supports outbound filtering, you can control and restrict the types of traffic that leave your PC.

Although controlling inbound traffic is imperative, implementing a firewall that includes outbound filtering capabilities has become particularly important from a system security perspective. If a virus infects your computer, it may try to use your PC and Internet connection to infect other systems. Similarly, many spyware programs are designed to collect information (like files, personal details, and even credit card numbers) from your computer and then send it off to a server on the Internet. Unless you have a firewall installed that is capable of outbound filtering, these pests can use your Internet connection without restriction, silently connecting to the Internet without your knowledge.

Firewalls that support outbound filtering implement the feature in a few key ways. Some work at the port level, allowing or denying traffic based on its type. For example, you can configure this type of firewall to disallow outbound FTP connections. Other firewalls function at a program or service level, enabling you to specify exactly which programs should be granted access to the Internet. With this type of firewall, you could allow a program like Windows Mail to access the Internet, but deny a file-sharing program from connecting online.

Ultimately, a firewall that supports both inbound and outbound filtering capabilities offers the best protection for your PC. As with any security feature, however, the ability of a firewall to protect your system is dependent upon it being configured correctly.


Configuring Windows Firewall

When Windows XP was first released, its built-in firewall component was known as Internet Connection Firewall (ICF). This firewall feature was not enabled for any network or dial-up connections by default, leading to a situation whereby most Windows XP systems were left unprotected. Things changed when Windows XP Service Pack 2 was released-installing it replaced ICF with the new Windows Firewall, which is automatically enabled to protect all network connections, by default. Building on the foundation that Windows XP provided, Windows Vista includes a new advanced version of Windows Firewall.

The version of Windows Firewall that was built into Windows XP offered support for inbound traffic filtering only. In other words, the Windows XP version of Windows Firewall lacks the ability to filter or control Internet-bound traffic. Although it does a good job of protecting your PC from connection attempts by Internet users, it does nothing to stop viruses or spyware already installed on your computer from using your Internet connection to infect other computers or send off your personal information to third parties. With the release of Windows Vista, Windows Firewall behaves in the same manner by default, but a new capability-known as Windows Firewall with Advanced Security-now allows advanced users to configure outbound traffic filtering rules if they desire. Unfortunately, configuring outbound traffic filtering with Windows Firewall with Advanced Security is far from a simple task, requiring a comprehensive understanding of how individual programs and related processes communicate on a port/protocol level.

In its default configuration, Windows Firewall is a suitable option only in cases where you're sure that your computer is both 100 percent virus- and spyware-free. This is possible if your system is protected by updated antispyware and antivirus software, assuming that you scan for threats (and remove them, as found) regularly. However, if pests do manage to infect your computer, Windows Firewall will allow them to access the Internet without impunity, putting both your security and privacy at risk.

Having said that, relying on Windows Firewall to protect your PC is still a better option than not using a firewall at all. For this reason, the configuration of Windows Firewall and its settings is explored in more detail throughout this section.

Cross Reference

You learn more about protecting your computer against viruses in Chapter 9, and about dealing with spyware and related threats in Chapter 10.

Check Windows Firewall Status

Windows Security Center is a Control Panel tool designed to help keep you informed on the current status of your computer's firewall, virus and spyware protection, operating system updates, and more. On the firewall front, Windows Security Center outlines whether Windows Firewall is on, or if another third-party firewall is installed and enabled. In cases where all firewall components are turned off, Windows Security Center displays a warning message in its program window, and also alerts you via a Security Center icon and message box on your taskbar, as shown in Figure 7-1.

Image from book
Figure 7-1: Notification message from Windows Security Center when no firewall is protecting a Windows Vista system.

Follow these steps to check the status of Windows Firewall in Windows Security Center:

  1. Select Security Start → Control Panel → Security Center. The current status of your Firewall is listed as shown in Figure 7-2.

    Image from book
    Figure 7-2: Viewing firewall status information in Windows Security Center.

  2. If the status message for your Firewall reads Off (see Figure 7-3), the simple way to remedy the problem is by clicking the Turn On Now button. Alternatively, you can also click the Show Me My Available Options link to search for third-party firewall programs online, or let Windows Vista know that you will be managing and monitoring your own firewall software without the need for Security Center's input. For all but the most experienced users, this second option is not recommended.

    Image from book
    Figure 7-3: Windows Security Center displays information about the current status of your firewall, automatic updating, antivirus, antispyware software, and more.

Note

Open Security Center regularly to check (and potentially remedy) the status of your firewall, automatic update settings, antivirus programs, and antispyware software.

Enabling or Disabling a Specific Connection

When Windows Firewall is turned on, it is enabled for all network connections present on your Windows Vista system by default. Although leaving all connections protected in this way is your best bet if you plan to stick with Windows Firewall, there may be certain connections that you do not want protected by a firewall, such as one that connects to other computers on your home network only. Windows Firewall can be selectively enabled or disabled for different connections if necessary.

Follow these steps to enable or disable Windows Firewall for a specific connection:

  1. Select Start → Control Panel → Windows Firewall.

  2. Click the Change Settings link.

  3. At the Windows Firewall Settings window, click the Advanced tab. In the Network Connections section (see Figure 7-4), select or clear the check boxes next to specific network or dial-up connections to enable or disable Windows Firewall for those connections. When complete, click OK.

    Image from book
    Figure 7-4: The Windows Firewall Advanced tab.

Caution

Never completely disable or turn off the firewall you are using to protect your Internet connection-doing so puts your Windows Vista system at serious risk.

Configuring Exceptions

If you're running Windows Firewall and want to allow incoming connections to a certain program or service on your computer, you need to configure an exception. In simple terms, you can think of individual exceptions as a statement that says, "Block all incoming connections, with the following exceptions." So, to allow a user to connect to your computer for the purpose of offering remote assistance, you need to configure an exception for the incoming Remote Assistance connection. Similarly, to allow Internet users to connect to an FTP server installed on your Windows Vista system, you need to configure an exception for incoming FTP connections.

You can configure exceptions with Windows Firewall by:

  • Specifying the program that external users will connect to. For example, if you had FTP server software installed and want users to connect it, you can specify an exception for the FTP server program. Windows Firewall then opens the necessary ports to allow incoming connections automatically.

  • Specifying the communication port that a program or service uses. When programs are capable of accepting incoming connections, they are often said to be acting as a server. Any program capable of acting as a server listens for connection attempts on what are known as TCP or UDP ports. A port is simply a unique number that a particular service uses-for example, an FTP server program listens for incoming connection attempts on TCP port 21, whereas a web server listens for connections on TCP port 80 by default. Windows Firewall enables you to open communication ports in order to allow incoming connections to reach your computer correctly. For cases where you need to open ports on your firewall to allow incoming connections (as is often the case with online multi-player games), consult the program's documentation for details on the correct port(s) to open.

Follow these steps to configure an exception for Remote Assistance with Windows Firewall:

  1. Select Start → Control Panel → Windows Firewall → Exceptions. The Windows Firewall Exceptions tab shows a check mark next to the programs and services that it is not blocking from accepting incoming connections, as shown in Figure 7-5.

    Image from book
    Figure 7-5: The Windows Firewall Exceptions tab.

  2. To allow another user to connect to your Windows Vista system for the purpose of providing help via Remote Assistance, select the check box next to Remote Assistance, as shown in Figure 7-6. Note that depending on the configuration of your system, this setting may be checked already.

    Image from book
    Figure 7-6: Configuring an exception for Remote Assistance connections.

  3. Click OK to save your changes and implement the setting that will now allow outside users to connect to your PC for the purpose of offering help via Remote Assistance.

The Windows Firewall Exception tab lists a number of commonly configured program and service exceptions in its list by default. This list is far from comprehensive, however, so Windows Firewall provides the capability to add new custom exceptions for programs or services not on this list.

Follow these steps to add an exception for a specific program, like an online multiplayer game:

  1. Select Start → Control Panel → Windows Firewall → Exceptions.

  2. Click the Add Program button, and then click the name of the program in the Programs list (as shown in Figure 7-7), or click the Browse button to specify the path to a program not included on the Programs list.

    Image from book
    Figure 7-7: Adding an exception for a program.

  3. Click the Change scope button to limit users able to connect via this exception, or click OK to enable the exception for all users (scope settings are explained in more detail later in this chapter). When complete, the exception appears selected on the Exceptions tab, as shown in Figure 7-8.

    Image from book
    Figure 7-8: Reviewing the exception created for a new program.

  4. Click OK to close Windows Firewall.

Note

You can also add Windows Firewall exceptions by specifying the TCP or UDP port number on which a particular program accepts incoming connections. The port numbers that need to be configured are typically listed in the program's user manual. However, you can also find an updated list of common port numbers online at http://www.iana.org/assignments/port-numbers.

Although exceptions are required any time that you want to allow outside users to make an incoming connection to your computer through Windows Firewall, they should also be disabled when they're no longer required (even if only temporarily). By disabling an exception, you stop users from making inbound connections to your PC, which is a more secure option-especially when you no longer use the program or service in question. To disable an exception, simply clear the check box next to its name on the Exceptions tab in Windows Firewall.


Using Windows Firewall with Advanced Security

Windows Firewall did much to improve the security of Windows XP systems when it was originally released as part of Service Pack 2, but the knock against it has always been its lack of outbound traffic control features. Although the version of Windows Firewall built into Windows Vista functions in a very similar manner by default, it's now possible to control outbound traffic via a new tool called Windows Firewall with Advanced Security.

Caution

Windows Firewall with Advanced Security is a very powerful tool that makes it possible to control all network traffic in a very granular fashion. Unfortunately, this tool is not geared toward normal everyday users. The configuration of advanced settings are quite complex, and making changes without understanding their repercussions can easily result in a situation whereby individual programs (or even your entire system) cannot connect to the Internet at all. For that reason, Windows Vista users looking for a more powerful firewall-and one that's relatively easy to configure-are better served by installing one of the third-party personal firewall programs explored later in this chapter.

Windows Firewall with Advanced Security is accessible through the Administrative Tools section of Control Panel. When you first open the tool, the Overview screen displays summary information about the status of your firewall (see Figure 7-9). To account for the fact that some computers (such as laptops) are moved between locations, Windows Firewall with Advanced Security supports three different profiles called Domain, Private, and Public. The basic idea is that you can configure one set of firewall rules that apply at work (Domain), one at home (Private), and one in all other locations (Public). To keep things simple, this explanation will be limited to the configuration of basic settings in the Private profile.

Image from book
Figure 7-9: The Windows Firewall with Advanced Security Overview screen.

Blocking Inbound and Outbound Connections

Take a closer look at the summary information for the Private Profile in Figure 7-9 and you'll notice that inbound connection attempts that do not match a rule are blocked by default, and outbound connections that do not match a rule are allowed by default. The only exceptions are those that you explicitly configure. In the world of Windows Firewall with Advanced Security, these exceptions take the form of rules designed to allow or deny certain types of traffic in a given direction (inbound or outbound).

The easy way to configure a rule that allows a certain type of inbound connection is by bypassing Windows Firewall with Advanced Security completely and heading to the Exceptions tab in Windows Firewall. Checking a box on the Exceptions list effectively creates the rule for you. However, Windows Firewall doesn't provide a similar interface that enables you to block outbound traffic. It's all allowed to proceed by default, and if there's anything you want to block, you must create rules with Windows Firewall with Advanced Security.

To block certain types of outbound communication, you generally need to either block the program completely, or know a great deal about how it communicates, including details like the protocols and ports being used. If you block a program completely (like Windows Mail), any attempt to connect to the Internet using Windows Mail is blocked. However, if you want to stop users from accessing Usenet newsgroups with Windows Mail while still allowing the program to send and receive e-mail, another approach is required. Windows Firewall with Advanced Security supports both scenarios, but in the second case you must block outbound NNTP traffic (the protocol used to connect to Usenet newsgroups) rather than the entire Windows Mail program. In this particular example, you must create a rule that denies outbound access to TCP port 119. Once implemented, all outbound connections to NNTP servers are blocked, regardless of the program attempting the connection.

The following sections provide an example of how you can implement both of the previous scenarios using Windows Firewall with Advanced Security. In the first set of steps, all users are blocked from accessing the Internet using Windows Mail. In the second, users are blocked from accessing Usenet newsgroups only. Both examples give you a basic idea of how you can implement simple rules using the advanced capabilities of Windows Firewall with Advanced Security.

BLOCKING OUTBOUND CONNECTIONS

Follow these steps to configure Windows Firewall with Advanced Security to stop all users from accessing the Internet using Windows Mail:

  1. Select Start → Control Panel → Administrative Tools → Windows Firewall with Advanced Security.

  2. Select Outbound Rules in the left column, and then click the New Rule link in the right column.

  3. On the Rule Type screen, ensure that Program is selected and click Next.

  4. On the Program screen, click the Browse button and then browse to the location of the program's EXE file. In the case of Windows Mail (see Figure 7-10), this location is C:\Program Files\Windows Mail\WinMail.exe. Click Next.

    Image from book
    Figure 7-10: Specifying the path to a program in the New Outbound Rule Wizard.

  5. On the Action screen, ensure that the Block The Connection option is selected as shown in Figure 7-11, and then click Next.

    Image from book
    Figure 7-11: Configuring a rule's action.

  6. On the Profile screen, select all profiles to which the rule will apply and then click Next.

  7. On the Name screen, give the rule an appropriate name and a description that accurately describes its purpose, as shown in Figure 7-12. Click Finish to begin enforcing the new rule.

    Image from book
    Figure 7-12: Adding a name and description for a rule.

When you enable this particular rule, all attempts to access the Internet via Windows Mail are blocked.

BLOCKING INBOUND CONNECTIONS

Follow these steps to create a rule that blocks all users from accessing newsgroups via any program:

  1. Select Start → Control Panel → Administrative Tools → Windows Firewall with Advanced Security.

  2. Select Outbound Rules in the left column, and then click the New Rule link in the right column.

  3. On the Rule Type screen, ensure that Port is selected and click Next.

  4. On the Protocols and Ports screen, ensure that the TCP option is selected and enter 119 in the Specific Local Ports box, as shown in Figure 7-13. The NNTP protocol used to access newsgroups uses TCP port 119. Click Next.

    Image from book
    Figure 7-13: Configuring a rule's protocol and port settings.

  5. On the Action screen, ensure that the Block The Connection option is selected and click Next.

  6. On the Profile screen, check the profiles to which this rule should apply and click Next.

  7. On the Name screen, enter an appropriate name and description for the rule as shown in Figure 7-14, and then click Finish.

    Image from book
    Figure 7-14: Naming and describing a rule to block outbound access to newsgroups.

When you enable this rule, users cannot connect to Usenet newsgroups using any program, including Windows Mail. Assuming that you only implement this rule (and not the one blocking Windows Mail completely), users can still use Windows Mail to send and receive e-mail messages.

Note

You can enable or disable rules at any time by opening Windows Firewall with Advanced Security, selecting Inbound Rules or Outbound Rules (as applicable), right-clicking a particular rule, and then selecting Enable Rule or Disable Rule as required.

Setting Logging and Scope Settings

Even if you decide not to make changes to inbound and outbound communication rules via Windows Firewall with Advanced Security (a wise choice if you don't feel comfortable with the process), there are two main configuration settings worth exploring (and potentially changing) if you plan on sticking with Windows Firewall to keep your Windows Vista system protected. The first involves making changes to the firewall's logging settings. By default, Windows Firewall does the job of allowing and blocking connections silently, without keeping any records of its actions. If you're curious to see what types of connection attempts are being made via your firewall, then you should enable logging. The second set of settings worth exploring are those related to scope, a concept that will be explained shortly.

ENABLING LOGGING SETTINGS

To enable logging settings for Windows Firewall, follow these steps:

  1. Select Start → Control Panel → Administrative Tools → Windows Firewall with Advanced Security.

  2. On the Overview screen, click the Windows Firewall Properties link.

  3. Click the Private Profile tab.

  4. In the Logging section, click the Customize button.

  5. Change the settings in the Log Dropped Packets and Log Successful Connections drop-down menus to Yes as shown in Figure 7-15. Click OK twice to implement your new logging settings.

    Image from book
    Figure 7-15: Configuring logging settings for Windows Firewall.

If you opt to enable Windows Firewall logging, you should review the contents of the log file at least periodically to investigate whether any potential security issues exist. The name of the log file is pfirewall.log, and you can find it in the C:\Windows\system32\logfiles\firewall folder by default.

Note

The Windows Firewall logs can be difficult to decipher due to the large (and fairly cryptic) information they contain. To make the process of reviewing the Windows Firewall log file easier, use a third-party log reading tool, such as the Windows XP Log Reader (it also works with log files generated by Vista's Windows Firewall), available from http://www.winxpcentral.com/windowsxp/fwlog.php.

ENABLING SCOPE SETTINGS

When you configure rules with Windows Firewall with Advanced Security, you are effectively implementing those rules for all computers. For example, if you decide to allow incoming connections for the purpose of obtaining Remote Assistance from another user, you simply enable the built-In Exception for Remote Assistance, so that incoming connections are allowed from any computer at any address. For added security, however, you can limit who is actually allowed to connect. In the context of Windows Firewall, you limit who can connect by associating a scope with the rule or exception. Scope options that you can apply to rules and exceptions include:

  • Any computer. This option, selected by default, makes the exception accessible to all computers, including all users on the Internet.

  • My network (subnet) only. This option makes the exception accessible to all computers on your private network only. For example, Windows Firewall automatically creates and enabled an exception for the File and Printer Sharing service, but limits the scope of this exception with this option. Ultimately, this ensures that other computers on your home network can connect to the protected computer for the purpose of sharing files or printers, but stops Internet users from being able to do so.

  • Custom list. This option enables you to specify the unique IP address (or addresses) of computers that you want to allow to connect via the exception. For example, if you plan to use an exception to play a multiplayer game with only a few friends, you should select this option and enter your friends' IP addresses. By selecting this option, only the addresses listed are able to connect to the exception, stopping all Internet users from connecting through the exception's opening in your firewall.

The version of Windows Firewall included with Windows Vista requires that you configure most scope settings from the Windows Firewall with Advanced Security tool. The following steps explain how to configure scope settings for incoming Remote Assistance connections such that only a user at one IP address (presumably the IP address of a friend or family member who is going to offer you help from a remote location) can connect to your computer. When you configure this scope setting, incoming Remote Assistance connection attempts from all other users are denied.

  1. Click Start → Control Panel → Administrative Tools → Windows Firewall with Advanced Security.

  2. In the left column, click Inbound Rules.

  3. Scroll down until you see the rule named Remote Assistance (TCP-In). Right-click this rule and select Properties.

  4. Click the Scope tab. In the Remote IP Address section click These IP Addresses, and then click the Add button. Enter the IP address from which you want to allow Remote Assistance connections, and then click OK. The example shown in Figure 7-16 allows inbound Remote Assistance connections to your computer from a system with the IP address 24.10.10.10. Click OK to implement your new scope settings.

    Image from book
    Figure 7-16: Limiting the scope of a rule to connections from one remote computer.


Implementing Third-Party Firewall Software

Windows Firewall doesn't implement outbound filtering capabilities by default, and making it do so (using Windows Firewall with Advanced Security) is best left in the hands of a seasoned system administrator. For that reason most users should consider making the switch to third-party firewall software that includes both inbound and outbound filtering capabilities. Some of the more popular personal firewall packages available for Windows Vista include:

  • ZoneAlarm. Available from http://www.zonelabs.com, ZoneAlarm comes in both paid and free- for-personal-use editions.

  • AVG Plus Firewall Edition. Available from http://www.grisoft.com, this product combines AVG's popular antivirus product with a personal firewall. AVG Plus Firewall Edition costs approximately $50 (for a 2-year subscription) after a free 30-day trial period.

  • McAfee Personal Firewall Plus. Available from http://www.mcafee.com, McAfee Personal Firewall Plus costs approximately $40 after a free 30-day trial period.

  • Norton Internet Security. Available from http://www.symantec.com, Norton Internet Security costs approximately $50 after a free 15-day trial period.

All of the personal firewall packages in the preceding list offer both inbound and outbound filtering capabilities, including the free-for-personal-use editions, as applicable. The paid versions of each program tend to include a variety of advanced and value-added security features, such as virus scanning, privacy tools, cookie management capabilities, and more.

Caution

Prior to purchasing any personal firewall program for your Windows Vista system, review its system requirements carefully. To function correctly, the program must be designed for compatibility with Windows Vista. As a general rule, older firewall programs (including those designed for Windows XP) do not work with Windows Vista. If you purchased firewall software for an older PC and want to keep using it, contact the vendor to see whether an update or upgrade to a Windows Vista-compatible version is available.

Every personal firewall product functions in a slightly different manner, and includes different features and capabilities. However, some of the key features of personal firewall software packages include the capability to:

  • Allow or deny specific programs or services from making outbound or receiving inbound connection attempts. You can configure a single program to allow it to make outbound connections and not to receive inbound connections, or a combination thereof.

  • Have the firewall alert you every time a new program attempts to access the Internet. When a program attempts to access the Internet for the first time, an on-screen message appears alerting you to the action. You are prompted to allow or deny the program, and can typically select an option to have the firewall remember your choice, avoiding additional prompts for that specific program or service in the future.

  • Alert you whenever an outside user attempts to make a connection attempt to your PC. Most firewall programs alert you with an on-screen message any time that an outside user attempts to connect to your PC. Not only does the message provide you with details like the IP address of the remote user, but also the specific port to which the connection was attempted. Some firewalls even let you know about specific security exploits that relate to the connection attempt, helping to keep you well informed about potential threats. You can typically turn off on-screen alert messages if you don't want to be informed of every connection attempt; details are stored in a log file for future reference instead.

  • Enable different security settings for programs attempting to communicate on your home network or the Internet. For example, you might configure your firewall such that file and printer sharing inbound connection attempts from other computers on your home network are always allowed, whereas those originating from the Internet are always denied. In some firewall programs, your home network is referred to as the trusted zone.

  • Allow incoming or outgoing connections by TCP or UDP port numbers, ranges of IP addresses, and more.

Beyond configuring inbound and outbound connection settings for different programs and services, many personal firewall programs allow you to configure a wide range of advanced security settings that can better protect your Windows Vista system. Some of the more popular options include the capabilities to:

  • Password-protect the configuration of your firewall. When password protection is enabled, only a user who supplies the correct password can change the firewall's configuration settings.

  • Stop all inbound and outbound traffic instantly by clicking the Stop All Traffic button.

  • Control whether certain programs and services are allowed to start at all, and whether a particular program has the capability to launch another.

  • Configure custom rules that allow or deny certain types of inbound or outbound traffic.

All of the personal firewall packages available for Windows Vista include different advanced features and capabilities. Prior to settling on any one particular firewall, test some of the alternatives available to determine which best meets your needs. You may find that you prefer one firewall's interface to another's, or deem one easier to use than the rest. As one of the most important pieces of software installed on your computer, it's imperative that you pick a firewall package that you feel comfortable with-there's nothing worse than fighting with a program that you find annoying or hard to use.

Image from book
Hardware Firewalls

If you're the proud owner of a broadband (DSL, cable, or satellite) Internet connection and a home network, then you're probably using a hardware router of some sort to share your Internet connection. Home routers come in both wired and wireless varieties, and ultimately act as an intermediary between your home network and the Internet. An example of a hardware router designed for home users is shown in the following figure.

Image from book

In addition to allowing you to share your broadband Internet connection among computers on your home network, these devices also include an integrated firewall component, leading many people to refer to them as a hardware firewall.

By default, the firewall components of these routers behave in a manner very similar to Windows Firewall. They deny all incoming connection attempts from Internet users by default, but allow all outgoing traffic to find its way onto the Internet, unrestricted. This tends to be the best default option for inexperienced users who want the security protection that a firewall provides in stopping Internet users from accessing their network, but still want to surf the Internet without restriction.

Unlike Windows Firewall, however, a hardware firewall typically enables you to control not only what can enter your network, but also what can leave it destined for the Internet. For example, imagine that you want to restrict access to the Internet to allow only web surfing and sending e-mail messages. With a hardware firewall, you could configure rules that would allow only these types of outbound Internet access, and restrict all others, for example. The capability to configure these types of rules is especially helpful if your goal is to stop users on your network from accessing file sharing services, online multiplayer games, or even instant messaging chats.

Some hardware firewalls even enable you to schedule rules so that they only apply during certain times of the day. For example, you might configure your firewall with a scheduled rule that denies all Internet access from 3 to 8 p.m., and then allow complete access from 8 to 10 P. M. If you're looking for a way to keep the kids from surfing when they should be doing their homework, this technique works perfectly. Making things better still is the ability to apply rules to certain PCs only, ensuring that other computers still have unrestricted access as required.

Certainly a hardware firewall is a powerful device, and can offer great protection when correctly configured. However, you shouldn't expect your hardware firewall to alert you to configuration issues or settings in the same manner as a software firewall. Additionally, you may occasionally run into problems when attempting to run both a hardware and software firewall on the same network. For example, if you have a hardware firewall in place and have Windows Firewall enabled on your Windows Vista system at the same time, you may occasionally run into problems, the most common where you want to allow inbound access into your network by an Internet user, perhaps to play an online game. Configuring an exception for the game in Windows Firewall is not enough-you also need to open the appropriate ports on your hardware firewall to allow traffic through, or it will never reach your Windows Vista system.

Consult your router's user manual for more details on configuring its firewall features and settings. For details on allowing inbound access through your hardware firewall, you can also consult the step-by-step instructions available online at http://www.portforward.com.

Image from book


Testing Your Firewall

After you have firewall software installed, it's important to test it (at least occasionally) to be sure that it provides appropriate and adequate protection for your Windows Vista system. Two primary methods are used to test firewall security:

  • Port scans. A port scan tests the inbound security of your firewall by scanning through ranges of TCP and UDP port numbers in an attempt to determine whether individual ports are open (allow incoming connections), closed (block incoming connections), or stealth (don't even appear to exist as far as Internet users are concerned). The information that a port scan provides ensures that you haven't left certain ports open by accident, and also helps you to understand how outside users see your system when it's connected to the Internet. Hackers commonly use Port scanners to determine which ports are open on a computer. For example, a hacker might perform port scans against thousands of IP addresses to see whether a particular vulnerability is installed on any computers. By testing your own firewall with a port scanner, you gain access to the same types of information used by hackers, and can then configure your firewall with appropriate settings to mitigate any potential risks to your PC. A number of web sites enable you to perform free port scans from your web browser, including Shields UP!! (http://www.grc.com/x/ne.dll?bh0bkyd2), Broadband Reports (http://www.dslreports.com/scan), AuditMyPC (http://www.auditmypc.com), and others.

  • Outbound security tests. A few different utilities are capable of testing the outbound filtering capabilities of your firewall by attempting to access your Internet connection without your knowledge. The basic idea is that you download and install such a tool, which attempts to connect to the Internet by bypassing your firewall's outbound security settings. If your firewall catches the attempt (by alerting you to the fact that a new program is attempting to access the Internet), the test has passed. If you are not alerted to the connection attempt and the tool can communicate over the Internet successfully, the outbound security test has failed. Outbound security tests are particularly important as part of ensuring that your firewall does not allow spyware programs and other threats to connect to the Internet undetected if they've found their way onto your system. Two of the more popular tools that test outbound firewall security include FireHole (available from http://www.keir.net/firehole.html) and LeakTest (available from http://www.grc.com/lt/leaktest.htm).

Follow these steps to test the security of your firewall via an online port scan:

  1. Select Start → Internet Explorer, or open your preferred web browser.

  2. In the Address bar, type http://www.grc.com/x/ne.dll?bh0bkyd2 and press Enter.

  3. Read through the agreement information on the Shields UP!! web page and then click Proceed.

  4. In the Shields UP!! Services section (see Figure 7-17), click Common Ports. This option scans your system in an attempt to determine the status of ports to which Internet users commonly try to connect.

    Image from book
    Figure 7-17: Testing your firewall with the Shields UP!! port scanning web site.

  5. After the scanning process is complete, a result (including a Passed or Failed message) appears, as shown in Figure 7-18.

    Image from book
    Figure 7-18: The results from a Shields UP!! port scan.

Caution

The port scan outlined in the previous example scanned common port numbers only. If you believe that other inbound connection ports on your firewall may be open, complete a scan of All Service Ports with Shields UP!! (which tests your system's first 1056 ports), or a scan of all 65,000+ ports with the Firewall test tool at http://www.auditmypc.com.

Follow these steps to test the outbound security of your firewall using the LeakTest tool:

  1. Download leaktest.exe from http://www.grc.com/lt/leaktest.htm.

  2. Double-click leaktest.exe to open the tool, and then click OK.

  3. At the Ready To Test screen (see Figure 7-19), click the Test For Leaks button.

    Image from book
    Figure 7-19: LeakTest is a basic tool to test the outbound security of your firewall.

  4. Read the instructions provided on the First Time Help screen, and then click OK.

  5. If your firewall did nothing to stop LeakTest from connecting to the Internet, the Firewall Penetrated! is displayed. If your firewall alerted you to the fact that LeakTest was attempting to access the Internet and you denied the action, an Unable To Connect message is displayed, letting you know that your firewall will detect (and allow you to block, as necessary) outbound connection attempts.


Summary

When it comes to securely protecting a Windows Vista system that connects to the Internet, arguably no single component is as important to the process as a firewall. Keep the following points in mind when it comes to protecting your Windows Vista system with a firewall:

  • Never consider a firewall an optional component on a Windows Vista system. Every Windows Vista system connected to the Internet should have firewall software installed and enabled, and preferably a package that supports both inbound and outbound filtering.

  • Windows Firewall is the native firewall component included with Windows Vista systems. Windows Firewall is enabled for all connections automatically, but does not implement outbound filtering features by default. You can enable outbound filtering via the new Windows Firewall with Advanced Security tool.

  • When you need to allow incoming connections from Internet users, do not disable your firewall. Instead, configure an exception or rule for the program or service that external users need to connect to. When these inbound connections are no longer required, disable their associated exceptions or rules.

  • Consider installing a personal firewall software package on your Windows Vista system. With the proliferation of virus and spyware threats on the Internet, it's more important than ever before to use a firewall that not only supports both inbound and outbound filtering, but also alerts you to suspicious connection attempts as they occur.

  • Periodically test the security of your firewall using online port scanners and outbound testing utilities. Doing so helps to ensure that you haven't mistakenly left a port open or exception enabled that could be used to compromise the security of your Windows Vista system.


Chapter 8: Keeping Windows Vista Patched and Protected

If you've ever purchased a new car, you may be familiar with the concept of a factory recall. In the automotive world, recalls occur when a flaw is found in a component, typically one that could impact the overall safety of the vehicle. When discovered, manufacturers issue a factory recall to all of the current owners of the specific make and model in question, allowing them to have the component replaced-typically at no charge.

In the world of operating systems like Windows Vista, processes similar to factory recalls also occur from time to time. For example, a new security flaw might be discovered that could allow another user to connect to your Windows Vista system, or remotely issue commands to make changes to its configuration. When these issues are discovered, Microsoft works to determine the cause of the problem, and then creates and issues a free fix that you can download and install to correct the issue. Unlike a factory recall, Microsoft doesn't ask you to bring your PC in for repairs. Instead, they provide you with the necessary details and tools, and ask you to fix it yourself. In the world of Windows Vista, these tools are software programs known as security updates and Service Packs.

Ultimately, you (and you alone) are responsible for ensuring that your system is adequately patched and protected from the latest security threats. If your Windows Vista system is properly updated, it's usually much less susceptible to the latest viruses, worms, and other security issues. Leave your system unpatched, however, and you run the risk of becoming a hacker's new best friend.

Thankfully, Windows Vista makes it easy to keep your system updated against the latest security threats. In this chapter you learn more about the functions of security updates and Service Packs, as well as how to keep your Windows Vista system updated and protected.

Windows Vista Security Updates

It has been estimated that Windows Vista was programmed using somewhere in the ballpark of 50 million lines of code. That's a mammoth undertaking to be certain, and one in which hundreds (if not thousands) of different programmers, analysts, and managers played a role.

Given the scope of such a project, it's not surprising that everything from small to more serious flaws will be identified in Windows Vista from time to time. Some of these flaws pose no real security risk, and are addressed at a later time. Others are more serious and demand immediate attention, resulting in the release of what are often referred to as patches, hotfixes, or updates.

In the world of Windows, security issues discovered after the initial release of an operating system like Windows Vista are addressed by way of fixes known as security updates and Service Packs. Both of these methods of addressing security issues are explored in more detail in the following sections.

Security Updates

A security update is a fix that addresses a single security issue on a Windows Vista system. Sometimes referred to as patches or hotfixes, security updates are periodically released, as required. When new and potential exploits are discovered, a team of programmers at Microsoft works to develop an update that addresses the issue, and then distributes the updated code in such a way that you can install it just like any other program.

Security updates for Windows Vista are normally released once a month (typically on the second Tuesday). Some months may pass without as much as a single Windows Vista update, while others may include 10 or more. In cases where the security risk is particularly time-sensitive-for example when infection from a new virus or worm is spreading rapidly-Microsoft may release a security update within hours of the news.

To help users understand the risk associated with a given issue, each security threat is assigned what is known as a severity rating. As a general rule, you should apply all updates marked Critical or Important or Recommended as soon as possible. Those with lesser ratings typically don't present as serious a risk.

Caution

Microsoft never sends you security updates as an attachment to an e-mail message. If you receive messages claiming they are updates from Microsoft, do not open the attachment because it almost certainly contains a virus or similar threat. Microsoft does have a security notification system, but its e-mail messages only alert you to the fact that updates have been released, and provide a link to their web or FTP site. For more details on Microsoft's software distribution policy, see http://www.microsoft.com/technet/security/bulletin/info/swdist.mspx.

Service Packs

Although a security update is a patch addresses a single security issue, a Service Pack is a comprehensive collection of updates bundled together as one large package. As a general rule, a Service Pack includes all security updates that preceded it, along with other minor fixes and feature improvements that have nothing to do with security at all. In this way, installing a Service Pack is effectively the same as updating to a more feature-rich and secure version of Windows Vista.

In addition to including all updates that preceded their release, Service Packs are also cumulative-Service Pack 2, for example, would include all updates originally provided with Service Pack 1. In other words, you can jump straight into installing Service Pack 2, even if you don't currently have Service Pack 1 installed.

Updating Windows Vista to the latest Service Pack version is highly recommended from a security perspective. If you choose not to install the latest Service Pack, your system could be missing one or more critical security updates, leaving it at risk.

Depending on how Windows Vista was originally installed on your computer, you may already have the most recent Service Pack installed (if applicable).

Here's how to determine which Service Pack (if any) is currently installed on your Windows Vista system: click Start → Control Panel → System. The Windows edition section of the System screen displays information about your Windows Vista edition followed by Service Pack details, if one has been installed. Figure 8-1 shows a Windows Vista system without any Service Pack installed (because none had been released at of the time of writing).

Image from book
Figure 8-1: Use the System screen to determine which Service Pack (if applicable) has been installed on a Windows Vista system.


Windows Vista Update Options

To satisfy the needs of different Windows Vista users in home and office environments, Microsoft makes security updates and Service Packs available through a number of different distribution mechanisms. You can update Windows Vista systems to include the latest security updates and Service Packs using two primary methods:

  • Using the Windows Vista Windows Updates feature

  • Manually downloading and installing updates

Each of these methods is explored in more detail in the following sections.

Using Windows Update

The primary method by which critical security updates and Service Packs are distributed to Windows Vista systems is through the Windows Update feature. Born of the Automatic Updates feature found in Windows XP as of Service Pack 2, Windows Update makes the download and installation of important updates entirely seamless from the user's perspective. In fact, simply leaving the feature's default settings intact ensures that updates downloaded and install automatically as they become available.

Of course, putting the critical update process on "auto pilot" in this manner doesn't work for all users, which is the reason why you can change Windows Update settings to meet different user needs or preferences.

The Security Center tool in Control Panel lets users know whether Windows Update is turned on, and whether the Windows Vista system has firewall antispyware, and antivirus software installed and enabled.

Cross Reference

Chapter 7 explores Firewall software for Windows Vista. Chapter 9 discusses antivirus software in more detail.

Follow these steps to check the status of the Windows Update feature on your Windows Vista system:

  1. Click Start → Control Panel → Security Center to open the Windows Security Center screen, as shown in Figure 8-2.

    Image from book
    Figure 8-2: The Windows Security Center tool.

  2. If the Automatic Updating title includes a green icon, your system is already configured to download and install updates automatically. If the icon is red, Windows Update has been disabled. If the icon is yellow, your system has custom Windows Update settings configured.

You can modify Windows Update settings through the Change Settings screen, as shown in Figure 8-3. To access this screen, click the Windows Update link in the upper-left corner of the Windows Security Center screen, click Change Settings, and then choose one of the following options:

  • Install updates automatically (recommended). This option downloads updates automatically, and installs them at the time specified. If your computer is turned off at the specified installation time, updates are installed the next time you restart your computer. In some cases, you may still need to accept an End-User Licensing Agreement before you can install a particular update.

  • Download updates but let me choose whether to install them. This option downloads updates automatically. When the download process is complete, the Windows Update icon appears in the notification area for administrators, prompting them to install the updates.

  • Check for updates but let me choose whether to download and install them. When you select this option, the Windows Update icon appears in the notification area of the taskbar to alert administrators that new updates are available for download. Once the update download process is complete, the Windows Update icon appears again, prompting you to install the updates.

  • Never check for updates (not recommended). When you select this option, Windows Vista never checks for critical updates, leaving your PC vulnerable to security threats.

Image from book
Figure 8-3: Configuring Windows Update settings.

The Change settings screen includes an option that enables you to specify whether you also want to include recommended updates as part of the Windows Update process. This option is selected by default.

In cases where updates have been downloaded but not installed, the Windows Update icon appears in the notification area of your taskbar when updates are ready for you to install (see Figure 8-4).

Image from book
Figure 8-4: The Windows Update icon notifies you that updates are ready to install.

When you click this icon, the Windows Update screen opens and outlines the updates that are available to install, as shown in Figure 8-5. To view more details about the updates, click View Available Updates. To download important or critical updates immediately, simply click the Install Updates button.

Image from book
Figure 8-5: Installing downloaded updates.

Depending on the nature of the update being installed, you may be prompted to restart Windows Vista to complete the update process, as shown in Figure 8-6.

Image from book
Figure 8-6: Prompt to restart Windows Vista after some updates are successfully installed.

Installing Service Packs and Security Updates Manually

Although Windows Update makes the process of patching and protecting Windows Vista systems easier than ever before, downloading and installing these updates the old fashioned way is still a popular option. There are still plenty of users out there who prefer to download and install updates manually, rather than to rely on any automated process to do the job for them.

Note

Administrators of networks that include a Windows 2000 Server or Windows Server 2003 system can effectively create their very own Windows Update server in-house by installing Microsoft's free Windows Server Update Services (WSUS) software. When installed, this software acts as a local Windows Update server from which systems like Windows Vista can obtain critical security updates and service packs. Effectively, the WSUS system downloads updates once, and then allows administrators to approve individual security updates and Service Packs for distribution on the network. For more details on WSUS, visit http://www.microsoft.com/windowsserversystem/updateservices/default.mspx.

In the vast majority of cases, this preference has nothing to do with the work involved in finding, downloading, and then installing individual updates. In a corporate or small office environment, the administrator's job is to ensure that all systems function correctly and are properly secured. As such, many administrators prefer to download and install updates on a test system first, and then deploy the update after it has been proven to be stable and secure. This puts the administrator in control over how individual desktop systems are updated, and minimizes the risk that an update could result in system downtime. In a nutshell, many administrators have learned that it's usually better to be safe than sorry.

Sometimes, the decision to go the manual update route has more to with practicality than control. A great example is the case of an administrator responsible for managing a network of Windows Vista systems where only a slow dial-up Internet connection is available. If a method like Windows Update were used in an attempt to update systems in this environment, the Internet connection would quickly come to a grinding halt, impacting other services like e-mail and web browsing in the process. It's much more practical for the administrator to download each security update or Service Pack once, and then use that download to update each computer on the network individually.

For more details on downloading the latest updates and patches for your Windows Vista system, visit http://www.microsoft.com/athome/security/update/default.mspx.

Tip

If you prefer downloading and installing Windows Vista updates manually, you can easily keep on top of things by subscribing to Microsoft Alerts, a free service that notifies you when new updates are posted to the Microsoft Security web site. These alerts can be sent to MSN Messenger, your e-mail program, or even a mobile device. To sign up for this service, visit http://www.signup.alerts.msn.com/alerts/login.do?PINID=3274.

Although most security updates and Service Packs install without issue, you may occasionally find that Windows Vista experiences problems after patches are applied. Thankfully, in the same way that you can install updates and Service Packs manually, you can also uninstall most, if necessary.

Follow these steps to remove an installed security update or Service Pack:

  1. Click Start → Control Panel → Programs.

  2. Under Installed Programs, click View Installed Updates.

  3. To remove an update, select it from the list and click the Remove button as shown in Figure 8-7. Follow the prompts associated with the update to complete the process.

    Image from book
    Figure 8-7: Removing a security update using View Installed Updates.


Patching Beyond Vista

Securing Windows Vista with the latest security updates and Service Packs is certainly important, but you also need to give some thought to the status of other installed software. Although it's less common for individual programs to be subject to the same types of security threats as an operating system, it's not unheard of. From your personal firewall software to your preferred web browser or even Microsoft Office, it's possible that the version of a program you have installed could present a security risk.

The best way to stay abreast of the latest patches and updates for programs you have installed is to keep an eye on their developer's web site. Most of these sites include a dedicated support section from which you can download critical updates or patches as they're released. To check which version of a particular program you have installed for reference purposes, select Help → About Program as shown in Figure 8-8.

Image from book
Figure 8-8: Checking the version of an installed program.

Additionally, the following web sites release security advisories related to specific programs, operating systems, and threats like viruses as they're discovered:

  • CERT Coordination Center: http://www.cert.org

  • Bugtraq: http://www.securityfocus.com/archive/1

  • Secunia: http://www.secunia.com

  • CIAC: http://www.ciac.org


Summary

Updating Windows Vista with the latest security updates and Service Packs is one of the most important steps that any user can take to ensure better system security. If left unpatched, a Windows Vista system may become vulnerable to specific threats that are both well known and documented. The Windows Update feature provides the easiest way for users to keep a Windows Vista system properly patched, because updates are downloaded and installed automatically.


Chapter 9: Protecting Against Viruses

Overview

Nobody likes to be sick, and most people do their best to steer clear of the latest bug, be it the flu, the common cold, or some other nasty virus. You don't have to be a doctor to recognize that prevention really is the best medicine, particularly when the alternative is acquiring and then trying to defeat the bug that's found you. Quite simply, you're almost always better off if you can avoid being infected in the first place.

When it comes to illnesses, computers and people share a common bond. Certainly your PC is not susceptible to the common cold (although it is a capable transmission vehicle!), but computers get sick, too. In PC land, malicious programs and bits of code known as computer viruses cause the illnesses. From users opening infected e-mail attachments to users neglecting to apply the latest operating system security patches, there's no shortage of ways for your computer to be potentially infected by the latest bout of some particularly nasty virus.

Unfortunately, when your computer is infected with a virus, both its security and your privacy are extremely at risk. Computer viruses used to be designed to be annoying or destructive, but the viruses of today are of a much meaner and more malicious ilk. Some are designed to allow Internet users to remotely control your computer, whereas others propagate themselves by using communications methods available on your PC such as e-mail or file-sharing programs. There are even viruses designed with the explicit purposes of stealing credit card or online banking details from your PC.

The threats posed by viruses are very real, so both preventing and removing these pests need to be considered an absolute priority in the quest for a more secure Windows Vista system. In this chapter you learn more about the different types of viruses that exist, what they're out to do, and methods that can be used to prevent them from infecting your system in the first place. You also examine some of the tools that can be used to remove viruses from your PC if it is infected, even if you don't have antivirus software installed. Most importantly, you learn how to ensure that your PC is properly geared up so that the threat of acquiring viruses in the future is as low as possible.


Understanding Viruses

In simple terms, a computer virus is a software program or a bit of scripted code designed to compromise the integrity of your PC or cause it harm. Many people wonder what would prompt someone to write a virus, but the potential reasons are almost as complex as human nature itself. Some people write viruses with financial gain in mind, looking to steal banking or credit card details from your PC. Others are out to prove their programming prowess or cause embarrassment to large corporations (such as Microsoft) by exploiting flaws in operating systems like Windows Vista. Some are teenagers, university students, or just regular folks looking for a challenge or the notoriety associated with being the person who managed to unleash the latest virus to spread worldwide. Still others want to steal e-mail addresses for the purpose of sending spam or even to use your PC as a "zombie" that can be remotely controlled to send junk e-mail messages or launch hacking attacks against different web sites and corporations. There have even been cases where someone has claimed to write a virus with the intention of undoing the damage caused by a virus that preceded it.

Ultimately, there's little point in worrying about why viruses exist-they've been around since before the dawn of the PC age, and they're not going away anytime soon. Instead, you should focus your attention on understanding the risks that viruses pose, how to remove them if your PC is infected, and most importantly how to protect your computer against virus threats in the first place.

Types of Viruses

The term virus has become a generic umbrella term used to describe almost all types of infectious and malicious code. Some people consider anything that they didn't explicitly install on their computer to be a virus, whereas others categorize virus-like threats according to their infection techniques and goals. Broadly speaking, viruses can be divided into the following subcategories:

  • Viruses. Although the term is now used to generically describe a broad grouping of threats that also includes worms and Trojan horses, a virus is best described as malicious code with the capability to replicate itself. Viruses are typically attached to programs and files, infecting other programs and files as they're opened and executed. One of the key distinguishing traits of a virus is that it cannot replicate without direct user intervention of some sort, such as opening an infected file.

  • Worms. Computer worms are fundamentally similar to viruses, but with one key difference-a worm can replicate itself using different network communication methods without user intervention. For example, if a worm infects one computer as a result of that system missing a critical security patch, the worm might use the infected computer's Internet connection to scan for, detect, and then infect other computers on the Internet that are unpatched and not properly secured. Because they don't require human intervention to spread, it's not unusual for a worm to infect thousands of PCs worldwide in just a few hours.

  • Trojan horses. Named after the fabled wooden horse that helped Odysseus trick and defeat the Trojans at Troy, a Trojan horse is a type of virus that masquerades as a legitimate program, usually with the intent to install a backdoor program on your computer. In some cases, the Trojan horse program actually performs the legitimate task that it originally claimed to, such as functioning as an FTP client. In others, installing the Trojan horse simply installs the malicious backdoor program that allows remote users to connect to and control your PC over the Internet.

Different risks associated with each of these virus categories are explored in more detail in the following sections.

Cross Reference

Many people consider security threats like spyware and adware to be viruses. Strictly speaking, these malware threats are different than viruses, even if their infectious aims and intentions are often similar. You'll learn more about dealing with malware threats in Chapter 10.

Virus Risks

Viruses, worms, and Trojan horses always represent a risk to PC security and your personal privacy, but some are worse than others. In much the same way that a program can be designed to do just about anything, so too can a virus. The main difference between a regular program and a virus, however, is that a virus is usually designed with malicious intent in mind. Even a virus that does nothing inherently bad represents a real risk-when unleashed onto the Internet, it's not unusual for another user to take what was a relatively harmless virus to begin with and reprogram it to carry out more damaging tasks.

Some of the more common types of damage caused by viruses, worms, and Trojan horses include:

  • Using your PC as a remotely controlled zombie for the purpose of sending spam e-mail or launching hacking (denial-of-service) attacks against other computers or web sites.

  • Theft of credit card information, banking details, or other personal information from your PC. This information can be used to purchase goods and services, potentially racking up thousands of dollars in charges to your accounts.

  • Harvesting e-mail addresses to sell to spammers. In the world of spam, known good e-mail addresses are like money in the bank. Many viruses are designed to infect your computer and then harvest all of the e-mail addresses present in your contact lists or address books, which are subsequently forwarded to a server on the Internet. Beyond simply collecting addresses, many viruses attempt to forward themselves to users in your address book by sending those users infected e-mail attachments that appear to be coming from you personally.

  • Shutting down security programs like firewalls, antivirus software, and antispyware tools. Knowing that security programs are the biggest barriers in their quest to infect or remotely control your computer, many virus writers have taken to disabling common security tools as part of their infection process.

  • Installing backdoor programs that capture all of your PC activities in the background including screenshots, mouse clicks, keystrokes, and more. The information captured by these viruses can be forwarded to remote users on the Internet, and then used for a variety of purposes ranging from identity theft to blackmail.

  • Infecting individual files or program templates. Some viruses are designed to infect macros or templates in programs like Microsoft Word, causing all documents you create to be infected as well. When an infected document is sent to another user and opened on her PC, the virus also infects that computer.

  • Deleting files, formatting hard drives, or altering critical system settings. Some viruses are simply designed with destruction in mind, be it deleting your personal files, formatting or erasing disks, or even changing system configuration settings to the point that your PC will no longer start and your operating system will need to be completely reinstalled.

Ultimately, all viruses are dangerous and must be taken seriously. Although some represent a bigger risk to your security and privacy than others, it's critical to assume that every virus is a danger to either you or your computer, and take appropriate action immediately.


Protecting Against Viruses

The best way to keep your Windows Vista system virus-free is by taking adequate preventative measures to reduce your risk of infection. Certainly installing antivirus software is a good first step, but it's equally important to ensure that you keep that software properly updated with all of the latest virus definitions-if you install antivirus software but neglect to update it regularly, your computer will still be exposed to all of the newest viruses, which are usually the ones that pose the greatest risk.

Although running updated antivirus software is probably the single best way to minimize the risk of a virus infection, using Windows Vista and Internet tools (such as e-mail) wisely are arguably just as important. With this in mind, essential tasks and concepts for keeping your Windows Vista system virus-free include:

  • Installing antivirus software

  • Keeping virus definition files updated

  • Configuring virus scanning settings and options

  • Scanning for viruses regularly

  • Avoiding viruses by using common sense and best practices

Each of these tasks and concepts are explored in more detail in the following sections.

Installing Antivirus Software

The first step toward maintaining a virus-free Windows Vista system is to install an antivirus program. There are many different antivirus programs available for Windows Vista, but some of the most popular include:

  • Norton AntiVirus, available from http://www.symantec.com.

  • McAfee VirusScan, available from http://www.mcafee.com.

  • Sophos Anti-Virus, available from http://www.sophos.com.

  • Panda Titanium Antivirus, available from http://www.pandasoftware.com.

  • AVG Anti-Virus, available from http://www.grisoft.com.

The antivirus program that will work best for you is largely a matter of personal preference as well as your budget. Many users seek out an antivirus program that is packed with different features to address specific needs; others simply use the antivirus program that shipped with their computer, whereas others seek out free alternatives. Some of the more common features found in the popular antivirus programs include:

  • Real-time virus protection

  • Scheduled virus scanning

  • Automatic virus definition updates

  • Inbound and outbound e-mail message scanning

Additionally, some antivirus programs include extended capabilities such as scanning files sent and received over instant message chats in real-time, and detecting and removing spyware. Some packages even go as far as to bundle multiple security tools together, as is the case with AVG Plus Firewall. This particular program groups antivirus, antispyware, and firewall capabilities into a single security suite.

Windows Security Center can be used to determine the status of virus protection on your computer. Specifically, the Virus Protection section will let you know whether you have antivirus software installed, and whether its virus definition files are up-to-date. When antivirus software is not installed (or your virus definition files are out of date), Windows Security Center also alerts you through an icon and notification balloon on your Windows taskbar.

Follow these steps to determine the current status of virus protection on your Windows Vista system:

  1. Click Start → Control Panel → Security Center.

  2. In the Windows Security Center window, review the Malware Protection section as shown in Figure 9-1. If the status message displays anything other than ON, read the message provided to determine which steps you need to complete to protect your computer from viruses, such as installing antivirus software, or updating an installed program's virus definition files.

    Image from book
    Figure 9-1: Reviewing the status of Malware protection in Windows Security Center.

Note

The antivirus software used for illustrative purposes in this chapter is AVG Free Edition, available from http://www.free.grisoft.com. AVG Free Edition is free for personal use (with no yearly subscription fees), and includes the common antivirus program features outlined earlier in this section.

Follow these steps to install AVG Free Edition on your Windows Vista system:

  1. Click Start → Internet Explorer, or open your preferred web browser. Head to http://www.free.grisoft.com and download the latest version of AVG Free Edition. After the download is complete, double-click the file to begin the installation process.

  2. When the Security Warning dialog box appears, click Run. When the User Account Control dialog box appears, click Continue.

  3. At the Welcome screen, click Next. Follow the steps until the Installation Complete screen appears, and then click OK.

  4. When the AVG First Run window appears, click Next. Various scanning operations can be completed using the First Run wizard, but for the sake of brevity you can also click Next through all of these screens.

  5. Click Continue to complete the First Run wizard. The AVG Free Edition Test Center screen appears, as shown in Figure 9-2. This is the primary working environment to initiate virus scans or check for updated virus definitions with AVG Free Edition.

    Image from book
    Figure 9-2: The AVG Free Edition Test Center window.

You will learn more about scanning for viruses and updating definition files in the following sections of this chapter.

Updating Virus Definitions

After you install antivirus software on your Windows Vista system, it's important to keep it updated with the most recent virus definition files. If you neglect to download and install these updates as they're released (which is typically anywhere from once a day to once a week), your computer will be vulnerable to all of the latest viruses.

Thankfully, almost all antivirus programs include a feature that enables you to check for (and then download and install) new updates automatically, according to a schedule that you define. Many antivirus programs will configure a virus definition update schedule automatically, whereas others require you to enable the feature and configure a schedule manually.

Follow these steps to update virus definition for AVG Free Edition:

  1. Right-click the AVG Free Edition icon on the notification area of the taskbar and select Check For Updates.

  2. At the Update window, select the Do Not Ask For The Update Source Next Time check box, and then click Internet.

  3. The AVG Update File Download window appears, followed by the Update selection screen (if new updates are available) as shown in Figure 9-3. Click the Update button. When the update process is complete, click OK.

    Image from book
    Figure 9-3: Downloading virus definition files with AVG Free Edition.

  4. AVG Free Edition automatically checks for updates every day at 8:30 A.M. To change this schedule, right-click the AVG Free Edition icon on your taskbar and select Launch AVG Control Center. Then, right-click Scheduler and select Scheduled Tasks. To change the time at which updates are checked, click Update Plan In Basic Mode (see Figure 9-4), and then click Edit Schedule to select a new update time.

    Image from book
    Figure 9-4: Reviewing scheduled tasks in AVG Free Edition.

Caution

Many people leave their Windows Vista system at risk by letting the subscription to their antivirus software lapse after its trial period ends. Unfortunately, you cannot rely on out-of-date virus definitions to protect your system from all the newest threats, which impart the maximum threat. Either update your antivirus software subscription or switch to a product like AVG Free Edition to protect your Windows Vista system and keep viruses at bay.

Configuring Virus Scanning Options

Every antivirus program implements slightly different default virus scanning settings, so it's important to be sure that your Windows Vista system is being protected to an appropriate degree. For example, some antivirus programs scan every file that you attempt to open by default, but do not scan e-mail messages unless you configure them to do so. Similarly, some antivirus programs automatically scan the contents of any disk (floppy, CD, DVD, and so forth) that you insert into a drive, whereas others scan disks only if you explicitly enable the option to do so. Never assume that your Windows Vista system is being completely and thoroughly protected if you haven't taken the time to confirm its virus scanning settings and options.

Follow these steps to configure scanning options with AVG Free Edition:

  1. Right-click the AVG Free Edition icon on the notification area of the taskbar and select Launch AVG Control Center.

  2. Right-click AVG Resident Shield and select Properties.

  3. In the AVG Resident Shield window, select the check boxes in the Scan Details and Advanced Settings sections according to your scanning preferences. AVG Free Edition scans files that can be infected by default (but can also be configured to scan all files), as shown in Figure 9-5.

    Image from book
    Figure 9-5: Configuring virus-scanning options with AVG Free Edition.

    Note

    Heuristic analysis (often called heuristic scanning) is a technique by which antivirus programs attempt to detect virus-like activities even when a file is not infected with any known virus. Heuristic scanning watches for suspicious behavior by files or programs, and when these are found, alerts you in a manner similar to any other virus. As a general rule, leave heuristic options in your antivirus software enabled-they might just catch the latest viruses making the rounds on the Internet before your antivirus vendor releases an update to address it.

  4. Click OK to enable your new scanning options.

In addition to ensuring that scanning options are configured in a manner that meets your needs, it's equally important to periodically test your antivirus program to ensure that it's functioning correctly. Now, you probably shouldn't download a virus-infected file from the Internet for the purpose of testing whether your antivirus program will detect and quarantine it, but it's never a bad idea to ensure that features like e-mail message scanning are enabled and functioning correctly. When an inbound or outbound e-mail message is scanned for viruses, a certification note to that effect (including details on the product used) is typically added to the footer of all e-mail messages.

Follow these steps to configure and test the inbound and outbound e-mail scanning capabilities of AVG Free Edition:

  1. Right-click the AVG Free Edition icon on the notification area of the taskbar and select Launch AVG Control Center.

  2. Right-click E-mail Scanner and select Properties.

  3. On the Plugins tab, click Configure. By default, AVG Free Edition scans all incoming and outgoing messages (see Figure 9-6). Use this tab to configure additional e-mail scan settings, such as automatically removing certain types of e-mail attachments if necessary.

    Image from book
    Figure 9-6: Reviewing e-mail message scanning options in AVG Free Edition.

  4. Click the Details button. The E-mail Scanning Details window enables you to configure certification messages to be added to both incoming and outgoing messages, as shown in Figure 9-7. You can change the default message to your own custom message, or leave the default messages intact. Click OK.

    Image from book
    Figure 9-7: Configuring virus certification messages.

  5. Open your preferred e-mail client program (Microsoft Outlook or Windows Mail, for example).

  6. Compose a new message and send it to yourself. When the message is received, open it to view the message contents. The certification messages stating that the file was checked for viruses when it was sent and received are displayed.

Scanning for Viruses

When you have antivirus software installed, its real-time protection feature typically scans all files that you attempt to access or open to ensure they're virus-free. However, it's possible that a virus found its way onto your system before the software was installed, and that other files that haven't been opened in a while may be infected. For this reason, it's important to perform complete virus scans of your hard drive and other disks frequently-at least each week.

Much like antivirus programs usually check for new virus definition file updates automatically, most also schedule a complete scan of your system for viruses either daily or once per week. As with all security-related tasks, it's never a bad idea to err on the side of caution when it comes to scanning for viruses. Although running a full virus scan once a day may seem excessive, the process generally takes less than a half hour to complete (depending on the size of your drives and the number of files to be scanned), and it's always better to be safe than sorry.

Of course, antivirus programs also enable you to initiate virus scans manually if you'd rather have more control over how and when these scans occur. For example, you might choose to start a complete scan just before you head out to run errands, or scan certain drives only (such as C:) more frequently. All of the major antivirus programs provide a high degree of flexibility when it comes to configuring virus scan settings, both through a schedule and manually.

Follow these steps to complete a full virus scan:

  1. Right-click the AVG Free Edition icon on the notification area of the taskbar and select Launch AVG Test Center.

  2. To complete a full scan of all drives on your computer, click the Scan Computer button. To scan only the drives you specify, click Scan Selected Areas instead, and you'll be prompted to select the drives to scan, as shown in Figure 9-8.

    Image from book
    Figure 9-8: Antivirus programs usually provide options to scan your entire computer or only selected areas.

  3. Check the drives and locations that you want to scan for viruses, and then click Scan Selected Areas.

  4. After the scanning process is complete (remember, this may take half an hour or more), the Finished window appears (see Figure 9-9). Review and take action on any viruses that were found (if applicable), and then click Close.

    Image from book
    Figure 9-9: Results of a virus scan.

Beyond Antivirus Software

Running antivirus software with updated virus definition files and real-time protection features enabled is perhaps the best way to keep your system protected from virus threats. However, even the best-protected system can succumb to a new virus threat because there's generally a small lag between the time when a new virus (or a new variant of an existing virus) is discovered and a vendor's virus definition files are updated to address the threat. Some new viruses spread so rapidly that literally tens of thousands of systems are infected within hours, a situation that can typically be avoided by ensuring that you adhere to some basic guidelines and best practices to minimize your chances of acquiring an infection.

Use the following best practices to help ensure that your system remains free and clear of viruses to the greatest degree possible:

  • Always run antivirus software and keep it updated. Never disable it when connected to the Internet.

  • Use antivirus software that includes both inbound and outbound e-mail message filtering. Besides removing infected e-mail attachments, these programs usually warn you when you attempt to open file types commonly used to transmit viruses.

  • Never assume that e-mail attachments received from friends, family, and colleagues are virus-free. (Remember, many worms are designed to infect one user's system, and then use that user's e-mail address and contact list to send infectious e-mail attachments to others.) If your antivirus program doesn't scan e-mail messages as they're received, save attached files to disk and then scan them for viruses prior to opening them.

  • Be very careful with files that you download from the Internet, especially those found in Usenet newsgroups, on file-sharing services, and FTP servers. Internet downloads are a notorious source for virus-infected files, so take the time to complete virus scans on every file that you download prior to opening it.

  • Always keep your Windows Vista system up-to-date with the latest security updates and patches. Many viruses, worms, and Trojan horse programs take advantage of operating system flaws to infect systems. The easiest way to keep your system protected from threats that try to exploit those flaws is to enable the Windows Vista Automatic Updates feature. If you choose to download and install updates manually, do so regularly.

  • Ensure that you have firewall software installed-preferably one that offers both inbound and outbound packet-filtering capabilities. If all inbound ports are blocking connections, outside users cannot connect to your PC if a remote control program or Trojan horse infects it. Outbound filtering is also important, helping to stop viruses and other threats from connecting to the Internet to send off sensitive personal information or launch hacking attacks against other computers.

  • Always think before you click, and never assume any file to be virus-free.


Removing Viruses

There may come a time where your Windows Vista system (or one belonging to a friend) ends up being infected by a virus. It may be that you didn't have antivirus software installed, enabled, or updated, which provided the opening that the virus needed to infect your system. If you don't have antivirus software installed, it can be very difficult to tell whether your PC is infected. You may notice that your system is slower than usual, or that Windows Vista is doing weird things. When your computer is acting a little on the strange side, it's absolutely possible that it has acquired a virus infection, although there are other possibilities, such as a spyware infestation.

The obvious solution to removing a virus is to install antivirus software, update it, and then run a complete system scan in search of potential pests. Unfortunately, that isn't always possible-some viruses are now designed to disable (or prevent the installation of) antivirus programs as part of their dirty work. Ultimately, that means you'll need to look elsewhere for a way to get the virus off your system.

When push comes to shove, you generally have three options:

  • Try to back up your personal files and e-mail, and then completely reinstall Windows Vista and all programs-a long and potentially arduous process.

  • Boot Windows Vista into safe mode (by pressing F8 when your PC starts and selecting the appropriate option from the menu), and then attempt to scan for viruses or install an antivirus program. This option sometimes does the trick, but it really depends on the virus you've managed to acquire, and the manner in which it has lodged itself on to your computer.

  • Explore the world of standalone virus removal tools. Almost all antivirus vendors (as well as Microsoft) release free utilities for the purpose of helping you to remove a particular virus from your PC. Unfortunately, many of these tools are designed with removing a specific virus in mind, so if you're not sure what you've got, you'll have a tough go of things.

Tip

In addition to standalone virus removal tools, some vendors offer web-based tools capable of scanning, detecting, and sometimes even removing viruses through your web browser. Microsoft recently introduced a whole suite of online scanning tools on its Windows Live web site. To access these tools and perform a security scan visit http://www.safety.live.com.

Thankfully, there are a few virus removal tools out there that are capable of detecting and removing all of the most common and dangerous viruses. One such tool is McAfee AVERT Stinger, which is capable of detecting and removing more than 50 pesky viruses, including Sober, Sobig, Sasser, Netsky, and MyDoom. Stinger is updated regularly to address the latest and greatest virus threats, so it's important to download the latest version from http://www.vil.nai.com/vil/stinger before you run your scan.

Caution

Never rely on virus removal tools such as McAfee AVERT Stinger or online scanning tools as an alternative to using antivirus software with real-time protection. These tools exist to help you remove dangerous viruses that might be infecting your PC, but they do nothing to stop your system from being infected (or re-infected) by viruses in the future.

Follow these steps to complete a virus scan with a third-party virus removal tool (McAfee AVERT Stinger, in this case):

  1. Click Start → Internet Explorer, or open your preferred web browser. Browse to http://www.vil.nai.com/vil/stinger, and then download Stinger. After the download is complete, double-click the file to open the program (no installation required).

  2. When the Stinger window appears, click the Preferences button. You'll see the screen shown in Figure 9-10, which enables you to configure virus detection settings. Check additional options if necessary, or simply click OK to leave the default settings intact.

    Image from book
    Figure 9-10: Configuring virus scanning and detection preferences with Stinger.

  3. By default, Stinger only scans your C: drive in an attempt to detect viruses, as shown in Figure 9-11. If necessary, click the Add or Browse buttons to have the program scan the drives you specify.

    Image from book
    Figure 9-11: Stinger scans only drive C: by default, but can be configured to scan other drives.

  4. After you've configured the drives to be scanned, click Scan Now. Stinger scans the selected drive(s), a process that can take anywhere from a few minutes to much longer depending on the number of drives and files to be scanned.

  5. When the scan is complete, the Stinger window displays the scan results, and prompts you to take additional actions, if required.

Image from book
Danger, Read All About It!

There's no question that viruses present a real danger to Windows Vista, but thankfully there's no shortage of great virus-related resources on the Internet. Whether you're trying to determine the risks that a particular virus poses, want to keep abreast of the latest virus threats, or are looking for a removal tool for a specific virus, the details you seek can be found on a myriad of different web sites.

Some of the more popular web resources for details about viruses include:

  • Microsoft Security (http://www.microsoft.com/security)

  • Symantec Security Response (http://www.sarc.com)

  • CERT Coordination Center (http://www.cert.org)

  • PC Magazine Security Watch (http://www.pcmag.com/category2/0,4148,12,00.asp)

In addition to providing comprehensive virus information, many of these web sites also include a feature whereby you can have alerts on the latest virus threats sent to you by e-mail, and some even include a dedicated Really Simple Syndication (RSS) feed for virus alerts. If you want to be informed of all the latest virus threats but not be deluged with related e-mail messages, RSS is often the least intrusive option. For details on accessing and subscribing to RSS feeds, see the PC Magazine article "RSS Rocks," http://www.pcmag.com/article2/0,1759,1544705,00.asp.

Image from book


Summary

Infections from viruses, worms, and Trojan horses are among the most prevalent and constant threats to your PC's security and your personal privacy. New viruses are being developed and released onto the Internet almost daily, so it's critical that you keep your PC properly protected and free of infection.

Keep the following points in mind when it comes to preventing and removing virus infections:

  • Install antivirus software, and keep it running and updated with the latest virus definitions at all times. (Remember that running antivirus software without updated virus definition files is almost the same as working without virus protection at all.) Use the scheduling capabilities of your antivirus software to check for updates at least once a day.

  • Use an antivirus program that scans both inbound and outbound e-mail messages for viruses. This stops your computer from sending viruses to other users, and helps to ensure that your computer is properly protected when viruses are received in e-mail messages from others.

  • Always scan all programs and files downloaded from the Internet (or obtained from other users) for viruses prior to opening them.

  • Run a complete virus scan for all drives on your computer at least once per week.

  • Ensure that the latest security updates and Service Packs are applied to protect your Windows Vista system. Many virus-like threats are designed to seek out and infect unpatched Windows systems.

  • Install personal firewall software that supports both inbound and outbound packet filtering capabilities. Although a firewall won't actually remove or prevent a virus that finds its way onto your system, it can help to minimize the damage that occurs as a result of a virus infection.

  • Always think before you click. Never assume that any file is virus-free, regardless of its original source.


Chapter 10: Fighting Malware-Protecting Against Spyware, Adware, and Browser Hijackers

Imagine a world where your every move was being watched-your comings and goings tracked, your telephone calls recorded, and all messages sent or received monitored by some nameless and faceless person or corporation. Sounds a little scary, doesn't it? The worst part is that this world already exists, and it's probably sitting right on your desk.

Malware-often referred to as spyware-is the latest in a breed of almost virus-like pests that have taken to infecting computers at an alarming rate. Unlike viruses, however, these new strains of infection are less concerned with spreading and more interested in keeping tabs on you. From tracking your online wanderings to collecting details of every key you press, there's literally an army of malware threats quietly infiltrating computers and stripping away the privacy of Windows users worldwide. Unfortunately, most people still have no idea what malware threats are, the dangers they pose, or the fact that their computer is (more than likely) already infected.

Thankfully, all is not lost. Although malware represents one of the largest and most wide-scale threats to PC security and personal privacy that the world has ever known, you can nurse even a badly infected Windows Vista system back to a clean bill of health with the right knowledge and tools. In this chapter you learn about what malware is, the different types of threats that exist, the real dangers that these threats pose, and finally the tools and techniques you can use to clean up your system and keep it protected from future threats.

Understanding Malware

Back in the good ol' days, viruses represented the most clear and present danger to a computer's security. As long as you were geared up with antivirus software and the latest virus definition files, you could consider your PC to be adequately protected. Unfortunately, times have changed and a whole new breed of pests is now infecting computers at an alarming rate. The last few years have seen the rise of an entirely new set of threats broadly known as malware, and it's been estimated that as many as 8 out of every 10 Windows computers are already infected by malware in one form or other.

Strictly speaking, malware and viruses are different beasts. Malware isn't nearly as concerned with propagating itself from computer to computer in the manner of a virus or worm, so much as it's interested in infecting your computer to spy on you. It often tracks your web surfing habits or logs all of your PC activities silently in the background. Other forms of malware are designed to mine your computer for useful bits of information, or hijack your web browser's configuration so that your home page and search settings are no longer under your control. Still others install dialers that use your modem to call exotic locales, resulting in hundreds to thousands of dollars of long-distance charges to your monthly phone bill. Although originally seen as little more than an annoyance, malware is arguably the most prevalent and under-recognized threat in the PC world today.

Types of Malware

In much the same way that the term virus generically describes a group of threats that includes viruses, worms, and Trojan horses, malware is the umbrella term that describes different security and privacy risks that include spyware, adware, and browser hijackers. Although each of these threats is technically a little different, the line between what constitutes spyware and adware is blurry and subject to interpretation-quite simply, a given malware threat might be best described as adware based on how it behaves, but also include components that are more commonly associated with spyware. This lack of a clear definition means that many people generically refer to all malware threats as malware, spyware, or adware. You can expect to see any of these terms used to describe the new breed of pests that infect millions of PCs in a virtually silent assault.

SPYWARE

Objects deemed to be spyware include malicious programs or bits of code designed to spy on you and your PC-related activities. Some spyware objects silently track your Internet activities in the background, collecting details like the sites you've visited and then forwarding them along to a server on the Internet. Others are more insidious, designed to steal personal information like usernames and passwords, files, e-mail messages, and more. Unfortunately, the sky is the limit when it comes to what available spyware can accomplish on a computer that you have not properly secured, and the spyware infection problem is getting worse every day.

Most people have a fundamental problem understanding why anyone would want to spy on them specifically. The truth is that spyware developers are seldom after any specific person, but rather aim at having their spyware component infect as many computers as possible-often with a profit motive. Some spyware developers use the information collected from your PC for web marketing purposes, whereas others are after usernames and passwords for your Internet banking account. It's a safe bet to assume that one day the information that spyware objects collect will be used for purposes, such as blackmail, impersonation, and identity theft-if they're not already being used for those purposes.

Some of the more common types of spyware include:

  • Keyloggers. A keylogger is a malware program designed to capture keystrokes, mouse clicks, and screenshots of your computer activities. After they collect this information and save it to a file, keyloggers typically forward it to a server on the Internet. In some cases, this information is mined for details like username and password combinations, but key-loggers can also spy on correspondence like e-mail, IM chats, and more.

  • Dialers. A dialer is a particularly nasty breed of pest that uses your modem to place long distance or toll calls to overseas locations for the purpose of racking up charges on your phone bill. For a dialer to function, your modem must be connected to a phone line, so dialup Internet users are particularly at risk. Don't expect to discover a dialer by those familiar modem sounds either-dialers typically work in the background, silently inflating the charges on your phone bill to astronomical levels.

  • Data miners. A data miner is a pest designed to mine your PC for all sorts of useful information. The most common types of data miners are ones designed to track your web surfing or PC usage habits, and then use this information for marketing purposes (such as displaying targeted advertisements as you browse the web). Some data miners collect personal information about you (such as your name and address), or even lists of the programs installed on your PC. Although they may not represent a major security risk in the same manner as keyloggers or dialers, data miners are definitely a threat to your privacy-the ones that collect information about your surfing habits today could easily be redesigned to harvest e-mail addresses or dig through the contents of your personal files tomorrow.

  • Tracking cookies. Cookies are small text files that web sites and browsers use to keep track of personalized user settings, to customize content layout, and to reduce the need to enter username and password information each time you visit sites that require you to log on. When used judiciously, cookies typically don't represent a security threat and do little to put your personal privacy at risk-in fact, many sites (such as those associated with online banking) require your browser to accept their cookies as part of the connection process. Although cookies are not dangerous in the same manner as viruses or other malware threats, they do represent a potential threat to your personal privacy. This is especially true with tracking cookies, where the cookie's reason for being it to keep tabs on all of the web sites that you visit, and the ways in which you surf the Web. Ultimately, this information can be used to create a profile on your Internet activities or habits, and then used to display targeted advertisements based on your personal interests.

ADWARE

Software is distributed over the Internet in a number of different ways. Some of the programs that you download and install are licensed commercial programs that you must pay for. Others, known as shareware, enable you to try the program for free, but require you to purchase it if you intend to continue using it. Freeware is another popular type of software, where the developer grants you the right to use the program, free of charge.

Over the past few years, however, a new software distribution method has become increasingly popular. Adware, or advertising-supported software, provides a way for developers to release their software to the general public for free, while still making money. The idea is that an advertiser's banner, message, or even another program is bundled together with the adware program for a fee, which keeps the developer in business. In effect, the money made from advertising is the developer's payment for creating the program.

Where once adware-style programs did little more than include the advertiser's banner somewhere within a program window, today, adware is much more complex-and potentially dangerous. Many adware programs collect information about your PC or how you use the Internet, and then deliver targeted ads to you. Sometimes these ads display with the main program window, and sometimes they're of the pop-up variety-those annoying browser windows that literally open out of nowhere to display an advertisement as you're trying to accomplish another task.

Perhaps the most common examples of adware in action are the free versions of popular file sharing programs like Kazaa and BearShare. These programs typically install an adware component (a separate program in the case of BearShare, as shown in Figure 10-1) during the program installation process, and most users agree to allow this-while some adware programs let you know that an ad-related component is being installed on your PC, others simply bury this detail in the licensing agreement. In effect, you agree to install adware on your PC (and have different types of information about you collected) by accepting the license agreement-it's up to you to read the fine print, after all.

Image from book
Figure 10-1: The free version of the popular BearShare file-sharing program informs you that adware will also be installed.

There's little question that adware has the potential to put your privacy and security at risk, but the extent to which this is true varies largely from program to program. Some people think that giving away details of their usage or surfing habits by using adware is a better deal than paying for the full version of a program. Others find the deluge of pop-up windows or integrated banners often associated with adware programs to be annoying and beyond reproach. Certainly, adware is a legitimate method for developers to be paid for their work, and not every adware program is dangerous. However, you should always take the time to read the licensing agreement associated with an adware program before you install it. If the program doesn't include details about what information is being collected about you (if any) and how this information will be used, you're always better off seeking out an alternative program.

BROWSER HIJACKERS

As the name suggests, browser hijackers are all about taking control of your web browser. Specifically, browser hijackers are a form of malware designed to replace your own web browser settings with new values that you typically cannot remove or change by traditional means. For example, a browser hijacker might change your browser's home page and search engine settings, or even add its own shortcut links to your Favorites or Bookmarks list. When you try to remove these entries and return to your original settings, a browser hijacker will almost always undo your changes and return to its own preferred settings.

Browser hijackers are without a doubt one of the most annoying types of malware, but also have the potential to be both offensive and dangerous. For example, it's not uncommon for a browser hijacker to replace your preferred home page with a pornographic or a gambling site. Similarly, browser hijackers are seldom interested in changing browser settings alone-although that may be the visual part of the equation, most also infect your PC with various spyware and related objects that may be a threat to your security and privacy.

The most common and dangerous browser hijacker making the rounds on the Internet is known as CoolWebSearch. The particular pest is among the worst of the worst (and most prevalent) in the malware world, and can be next to impossible to remove even with the help of anti-spyware software. You'll learn more about detecting and removing browser hijackers (and specifically CoolWebSearch) later in this chapter.

How Malware Infects Your PC

Malware typically infects PCs in a very different ways than viruses and worms. Viruses typically rely on the user opening an infected file, whereas worms can take advantage of operating system security holes that exists as a result of not applying patches and updates as they're released. Infecting a system with malware, on the other hand, often requires you to do nothing more than visit an infectious web page or even click a hyperlink.

Perhaps the primary reason why so many computers are infected by malware is a result of the sneaky nature of spyware developers. Some trick you into downloading malware objects by displaying misleading web pages suggesting that your computer is already infected. Others use pop-up ads that appear to be normal Windows dialog boxes that coax you into clicking what is actually a link. There are even web pages that download and install malware on your computer automatically when you do nothing more than visit a certain web address.

Some of the most common ways through which malware infects PCs include:

  • Program installations. Malware is commonly bundled into seemingly legitimate programs, and installed on your system as part of the primary program's installation process. In some cases, the legitimate tool is designed with the purpose of distributing spyware. In others, a spyware developer has taking an existing program and recompiled it to include malware components.

  • Toolbar installations. You can greatly extend the capabilities of Internet Explorer and other web browsers by using legitimate third-party toolbars, like the ones that Google and Yahoo! offer. However, many third-party toolbars that appear to be loaded with useful features actually contain malware components. In some cases, toolbars are installed into web browsers like Internet Explorer when you do nothing more than visit an infectious site or click misleading links. Toolbars that extend the capabilities of browsers are commonly referred to as Browser Helper Objects (BHOs).

  • Surfing the Web. Some web sites are programmed by spyware developers to automatically download and install malware-related threats when you visit the site or a particular web page. These sites typically take advantage of low security restrictions in web browsers like Internet Explorer to download and install malware components using technologies like ActiveX or Java. Malware threats that are downloaded and installed in this fashion are often referred to as drive-by downloads.

  • Pop-up ads. Web browser pop-up windows are among the most notorious sources of malware infections. These smaller browser windows typically include an advertisement or warning message stating that your computer is already infected by spyware, or supposedly provide a link to a free spyware-removal tool. Others look like legitimate Windows dialog boxes, complete with Yes and No buttons. When used as a malware delivery vehicle, clicking these ads installs malware objects on your PC. It should be noted, however, that only a small percentage of pop-up ads relate to the installation of malware.

  • Cookies. As you surf the Internet, chances are good that most of the web sites you visit will place cookies on your PC, usually for legitimate purposes. However, many web sites display banners provided by web advertising services, which often track and collect visitor information via tracking cookies. Unless you've chosen to block all cookies or only allow ones from certain web sites, chances are good that one or more tracking cookies are already present on your computer.

Cross Reference

For details on managing browser security settings-including disabling pop-up windows, configuring cookie settings, and managing browser add-ons-refer to Chapter 5.

Signs of Infection

The best way to determine whether your computer is infected by malware-related threats is to complete a scan with a dedicated spyware detection and removal tool. However, you should also keep an eye open for the following warning signs, which often indicate that any number of different malware threats are infecting your computer:

  • One or more pop-up windows appear when you log on to Windows Vista or open your web browser.

  • Your computer is noticeably slower than in the past.

  • You're experiencing system errors or crashes with greater frequency.

  • You see unfamiliar icons in your system tray.

  • Your web browser's home page has been changed to a new web site.

  • You notice new and unfamiliar toolbars on your web browser.

  • Your computer is behaving strangely, or different than it normally does.

  • Your phone bill arrives and is loaded with charges for calls made to toll numbers or overseas locations.

Note

If any of the warning signs outlined in the previous list describe your PC, it doesn't necessarily mean that your computer has a malware infection. It could be that your system is infected by a virus, or in need of maintenance tasks like removing unused programs and files or defragmenting your hard drive. Any time that you notice behavior outside of expected parameters, however, it's not a bad idea to scan your system for possible malware threats.

Malware Risks

There's simply no shortage of ways in which malware can cause you or your computer harm, with new and even more dangerous methods being developed all the time. Some of the security risks and common types of damage caused by malware include:

  • Information or identity theft. Many malware threats are designed for the expressed purpose of stealing information from your PC. Items sought after can include virtually everything from username and password combinations to files to correspondence like e-mail messages or IM chats.

  • Internet tracking. A number of malware threats are aimed at tracking your Internet usage history and habits for the purpose of displaying targeted advertisements. Some of these objects track your Internet activities relatively anonymously, but others seek out personal details as well.

  • System stability issues. Just like any other piece of software, malware threats can be poorly programmed, and by extension lead to system stability issues or even crashes. Some malware objects are known to overwrite or replace important operating system files, whereas others disable security programs like antivirus or firewall software.

  • Inability to change web browser settings. Almost all browser hijackers lodge themselves onto your computer so that it's virtually impossible to return to your original settings without using anti-spyware software or a dedicated threat removal program. In some cases, completely reinstalling your system is the only way to remove these pests for good.

  • Inability to access certain web sites. Many malware threats are designed to stop you from accessing certain popular web sites, or to redirect you to other sites (typically carrying advertising) in cases where a page cannot be found.

  • Inability to use your computer reliably. From relentless pop-up ads to disabled software, there's no shortage of ways in which malware can harm your computer so that you cannot use it reliably. For example, a number of malware threats continuously open pop-up windows with banner ads regardless of whether you close existing windows or even stop underlying processes like Internet Explorer.

  • Financial costs. Some of the more advanced and extreme malware threats are designed to hit you where it hurts-right in the pocketbook. Dialers almost always lead to massive charges on your phone bill, but malware that steals credit card or banking information can also lead to financial losses, not to mention identity theft issues.


Protecting Against Malware

As with viruses, the best ways to protect your system again the risks of malware is to stop these pests from finding their way onto your Windows Vista system in the first place. Many users mistakenly rely on malware removal tools to keep their system protected, effectively allowing the bad guys in before periodically getting them out. Some of the key methods that you can use to protect your Windows Vista system from infection by malware include:

  • Installing anti-spyware software (or using the Windows Vista anti-spyware tool, Windows Defender)

  • Updating spyware definition files regularly

  • Configuring real-time protection and advanced anti-spyware settings

  • Scanning for malware regularly

  • Thinking before you click

Each of these methods is explored in more detail in the following sections.

Installing Anti-Spyware Software

It doesn't take much for malware objects to find their way onto your PC, even if you're being very careful about how you use your Windows Vista system and the Internet. For this reason, it's imperative that you have anti-spyware software installed to ensure that your system remains properly protected, and preferably with an anti-spyware program that offers real-time protection. Windows Vista includes its own anti-spyware software in the form of Windows Defender, but a number of very capable third-party anti-spyware tools also exist.

Some of the most popular third-party anti-spyware software packages available for Windows Vista include:

  • Spybot Search & Destroy (available from security.kolla.de)

  • McAfee AntiSpyware (available from http://www.mcafee.com)

  • Webroot Spy Sweeper (available from http://www.webroot.com)

  • Ad-Aware (available from http://www.lavasoftusa.com)

  • Trend Micro Anti-Spyware (available from http://www.trendmicro.com)

  • eTrust PestPatrol Anti-Spyware (available from http://www.pestpatrol.com)

  • Norton AntiVirus (which includes anti-spyware capabilities, available from http://www.symantec.com)

When researching different anti-spyware packages to find the one that works best for you, keep in mind that most of the free tools made available by different companies are reactive in nature and generally do not provide real-time protection against malware threats. In most cases, the free versions of anti-spyware programs provide malware detection and removal capabilities, whereas the paid or full versions add real-time protection and other advanced features.

Windows Defender, the native anti-spyware tool included with Windows Vista, does an excellent job of detecting and removing spyware infections, as well as proactively preventing them in the first place. Follow these steps to check the status of Windows Defender on your Windows Vista system:

  1. Select Start → Control Panel → Security Center.

  2. In the Windows Security Center window (see Figure 10-2), review the status of the Malware Protection section. The Malware Protection section shows that Windows Defender is actively protecting the computer.

    Image from book
    Figure 10-2: Reviewing the status of Malware protection in Windows Security Center.

Updating Spyware Definition Files and Scanning for Malware

In much the same way that your anti-virus software is only truly useful if you've updated it to include the latest virus definition files, the same is true of anti-spyware programs. For these programs to effectively detect, remove, and protect against the latest malware threats, you need to update their definition files regularly. Some anti-spyware vendors offer updated definition files every day, whereas others make updates available anywhere from a few times to once a week.

Although the real-time protection features of tools like Windows Defender help to ensure that your Windows Vista system remains protected against new malware threats, it's still important to perform a Full scan for spyware at least once per week. By default, Windows Defender scans for malware once per day, but this interval will be different depending on the anti-spyware program you decide to use. Along with the Quick scan that Windows Defender performs automatically each day, you can also initiate more comprehensive scans manually.

Follow these steps to perform a full spyware scan with Windows Defender:

  1. Select Start → All Programs → Windows Defender.

  2. If the Windows Defender definition files are out-of-date (as shown in Figure 10-3), click the Check Now button.

    Image from book
    Figure 10-3: Windows Defender with outdated definition files.

  3. Click the arrow next to the Scan menu. Windows Defender supports three types of scans: Quick, Full, and Custom. Quick scan is the fastest, whereas Full scan is the most comprehensive. The Custom scan enables you to select the specific system areas that should be scanned for malware, as shown in Figure 10-4.

    Image from book
    Figure 10-4: Configuring custom scanning options in Windows Defender.

  4. Select the Full scan option from the Scan drop-down menu. When the scan is completed, Windows Defender displays its results, as shown in Figure 10-5.

    Image from book
    Figure 10-5: The results of a Windows Defender scan.

  5. If spyware objects are found on your computer, click the Review Items Detected By Scanning link. This opens the Scan Results screen, shown in Figure 10-6. Use the Action drop-down list to select an appropriate action for each object:

    • Ignore. Leaves the malware object intact, but will discover it again during subsequent scans.

    • Quarantine. Effectively paralyzes the malware object, placing it in a special quarantined storage so that it cannot harm your system. You can restore quarantined items later, if necessary.

    • Remove. Completely removes the malware object from your system.

    • Always allow. Tells Windows Defender that you trust the object and want to exclude it from future scans. You can reverse this action in the future, if necessary.

    Image from book
    Figure 10-6: Selecting actions for objects uncovered by a Windows Defender spyware scan.

  6. Click Apply Actions.

Windows Defender Tools

Windows Defender includes a range of configurable tools and options beyond its spyware scanning and removal capabilities. While the need to use these tools is minimal if your PC is spyware-free, there are times when they may come in handy. To access Windows Defender's selection of built-in tools, click the Tools button to open the Tools and Options screen, as shown in Figure 10-7.

Image from book
Figure 10-7: The Windows Defender Tools screen.

The Windows Defender Settings section provides access to the following:

  • Options. These settings enable you to schedule Windows Defender scans to occur automatically and configure default actions that should be taken if or when malware objects are discovered.

  • Microsoft SpyNet. SpyNet is Microsoft's collaborative environment that helps all Windows Defender users share information about spyware objects and new programs as they're discovered via scans. Select this option to choose your preferred level of involvement in the SpyNet community.

The Tools section on the same screen includes the following items:

  • Quarantined items. Use this tool to view any items that you've quarantined, and to remove or restore them if necessary.

  • Software Explorer. Use it to manage the programs that start with Windows Vista, review currently running programs, programs with open network connections, and details about Winsock Service Providers. With it, you can modify startup program settings to terminate running programs or those with open network connections.

  • Allowed items. This tool enables you to review lists of objects that you've previously configured to Always Allow. If you decide that you no longer want to grant that privilege to an allowed object, use this tool to remove it from the list.

  • Windows Defender web site. This is a link to the Windows Defender home page at http://www.Microsoft.com.

Caution

If you complete a spyware scan and many different threats are detected, select the option to remove them, restart your computer, and then complete another full scan. Some malware threats lodge themselves onto your system so forcefully that it can sometimes take two or even three scan passes to ensure that your system is clean and malware-free.

Beyond Anti-Spyware Software

Installing anti-spyware software with real-time protection and keeping it properly updated is the single best way to ensure that your system remains free and clear of malware threats. However, it's also important to give some thought to how you use the Internet with an aim toward avoiding interactions with malware in the first place. Use the following best practices to help ensure that your system remains free and clear of malware threats to the greatest degree possible:

  • Install anti-spyware software that includes real-time protection and ensure that it's always updated with the latest spyware definition files. Scan for malware regularly.

  • Install firewall software that includes both inbound and outbound filtering capabilities. If a malware threat that attempts to phone home is installed on your computer, a firewall capable of outbound filtering will likely alert you to the connection attempt.

  • Install anti-virus software and keep it properly updated. Although typically not as comprehensive as anti-spyware tools, many anti-virus programs are capable of detecting malware threats and suspicious activities.

  • Be careful about the web sites that you visit because less reputable sites are common sources of malware infections. Visiting online casinos, pornography sites, and web sites offering pirated materials (AKA warez) may increase your malware exposure risk.

  • Ensure that your Windows Vista system is patched and protected with the latest security updates and Service Packs.

  • If Internet Explorer is your preferred web browser, ensure that you have its security settings configured appropriately (as originally outlined in Chapter 5). Switching to an alternative browser without ActiveX support can also help to reduce the risk of malware infections, so you may want to consider options beyond IE, such as Firefox, Opera, or Netscape. Regardless of the browser you choose, be sure to keep it updated with the latest security patches as they're released.

  • If you're not using your modem to connect to the Internet or to send and receive faxes, disconnect it from your phone line.

  • Use a Standard user account (rather than an Administrator account) to complete day-today tasks on a Windows Vista system. Many malware threats (as well as viruses) rely on the current user having Administrator privileges to do their dirty work.

Image from book
HOSTS with the Most

It's next to impossible to know which web sites could be potential sources of malware infections via techniques like drive-by downloads. Although you certainly wouldn't expect to be infected by a major site like Google or Yahoo!, the differences between legitimate and fly-by-night sites can sometimes be hard to distinguish. It's entirely possible that you could find yourself browsing to an infectious web site by clicking the results provided by a search engine, or a link supplied on another site.

Although it may be hard for the average user to determine which sites are safe and which are not, there are people out there trying to create a roadmap of potentially dangerous sites. Specifically, some folks at the http://www.MVPs.org web site have been busy creating a HOSTS file that includes entries for potentially dangerous sites.

When your Windows Vista system tries to connect to a site like http://www.pcmag.com, it uses Domain Name System (DNS) servers to translate the name to the IP address associated with the site. However, before it queries DNS for this information, it first checks its local HOSTS file, and if an entry for the site exists, uses the IP address specified in the file instead.

The HOSTS file made available on the http://www.MVPs.org web site lists hundreds of dangerous sites, and maps them all to a special IP address-127.0.0.1. This is known as the loopback address, and when specified, contacts your local computer. So, in cases where you try to connect to a potentially dangerous site, the connection request is sent to your local computer, where the attempt is denied-leaving you safer in the process.

In addition to listing sites that include malware- and virus-related threats, the HOSTS file available from http://www.MVPs.org includes entries for online advertisers. This means that certain banner ads may be blocked if you download and use the file. If there are certain advertisements that you do want to view, however, you can always open the HOSTS file and place a # sign in front of any given entry. That tells the HOSTS file to ignore the line, allowing you to connect to the site (or see the ads).

To obtain and install the HOSTS file, visit http://www.mvps.org/winhelp2002/hosts.htm. The site includes a regularly updated file that you can download, and details on installing correctly for Windows Vista systems.

Image from book


Removing Malware

As you now know, installing anti-spyware software and keeping it properly updated is the best way to keep your computer free of malware threats. However, there still may be times when you need to explore other tools to eliminate a specific malware threat, or you may just want to scan for malware with more than one tool, just to be on the safe side. In this section, you learn more about using third-party malware removal tools, and how to deal with more advanced malware threats like the CoolWebSearch browser hijacker.

Using Spyware Removal Tools

As a general rule, never install and run more than one anti-virus program on your computer at the same time, lest the programs interfere with one another and leave your computer at risk. The same is generally true with anti-spyware programs, but as long as you're not trying to run two or more programs that offer real-time protection simultaneously, there's nothing wrong with installing multiple tools. In fact, you may just find that one tool detects (or can remove) a threat that another program had trouble with.

If you've already invested in one anti-spyware tool, then there's no need to run out to purchase a second. Instead, consider downloading one of the many free spyware detection and removal tools from the Internet instead. The same vendors that produce the popular commercial tools typically make free versions of their programs available for download on their web sites. So, you might opt to run Microsoft AntiSpyware as your primary anti-spyware tool, and then periodically run scans with a tool like Ad-Aware SE Personal for the sake of completeness.

If you have a computer already infected by malware, you may have a tough time installing an anti-spyware tool to begin with. Many of the advanced threats are programmed to block popular anti-spyware tools from installing, so it is possible that you may have to try installing two or three different programs before you find one that works. To increase your chances of success on an infected system, however, you may want to attempt the installation process from the Windows Vista Safe Mode. (Safe Mode is a special Vista mode in which only a limited set of drivers and services are loaded. You can boot into it by pressing F8 when your computer first starts and then choosing Safe Mode from the Advanced Boot Options menu.)

Caution

A wide variety of different tools exist for the purpose of removing malware threats, but don't assume that every scanning program is as legitimate as it looks or claims to be. Many of the supposed scanning tools that exist are of dubious origin, and some even produce false positive results as a way to entice you into purchasing the full version of the program. Before you purchase any anti-spyware program, check the "Rogue/Suspect Anti-Spyware Products and Web Sites" list online at http://www.spywarewarrior.com/rogue_anti-spyware.htm.

Follow these steps to complete a malware scan with Ad-Aware SE Personal:

  1. Select Start → Internet Explorer, or open your preferred web browser. Browse to http://www.lavasoftusa.com/software/adaware/ and click the Download Ad-Aware Here link. Choose a download link, and save the installation file to a suitable folder.

  2. Double-click the Ad-Aware SE installation file to begin the installation process.

  3. When the User Account Control dialog box appears, click Allow.

  4. On the Ad-Aware SE Personal Welcome screen, click Next.

  5. On the License Agreement screen, check I Accept The License Agreement and click Next.

  6. On the Destination Location screen, click Next.

  7. On the Install To All Users menu screen, click Next.

  8. On the Start Installation screen, click Next. When the process is complete, click Finish to update the program's definition files and begin a full system scan, as shown in Figure 10-8.

    Image from book
    Figure 10-8: Scanning for malware with Ad-Aware SE Personal.

  9. Once the scanning process is complete click Next. On the Scanning Result screen, click the plus sign next to each target family detected to display the TAC (Threat Assessment Chart) rating for each group of objects, as shown in Figure 10-9. Objects with a higher TAC rating are considered to be more dangerous. TAC ratings range from 1 (low risk) to 10 (extremely dangerous).

    Image from book
    Figure 10-9: Viewing detailed scan results.

  10. Check the check boxes next to the items that you want Ad-Aware SE Personal to place into quarantine, and then click Next. When the confirmation window appears, click OK.

Note

It's possible that you may run a scan with Ad-Aware SE Personal and then accidentally remove and quarantine legitimate items. You can always review quarantined items by clicking the Open Quarantine List link on the Status screen, and then selecting the option to restore items that you removed by accident. Additionally, you can opt to delete quarantined items so that they are unrecoverable.

Eliminating Browser Hijacks

Although most anti-spyware tools can detect and remove almost all malware threats, a number of programs still have difficulty with some of the more complex (programmatically) pests, such as the CoolWebSearch browser hijacker. If your computer is infected with CoolWebSearch, your best bet is to try removing it with whichever anti-spyware tool you have installed first. Assuming that your anti-spyware program doesn't get the job done, your next step should be to try a dedicated removal tool like Trend Micro's CWShredder.

CWShredder is a free tool designed to detect and remove only one specific threat, namely Cool-WebSearch. However, a number of CoolWebSearch variants exist, and new ones are appearing all the time. CWShredder is updated regularly to deal with new variants as they're discovered, and truly represents your best chance of completely removing a CoolWebSearch infection once and for all.

Follow these steps to scan for and remove CoolWebSearch variants with CWShredder:

  1. Select Start → Internet Explorer, or open your preferred web browser. Browse to http://www.trendmicro.com/cwshredder, and then click the Remove CoolWebSearch link. Save the cwshredder.exe file to an appropriate folder.

  2. Double-click cwshredder.exe. When the Security Warning screen appears, click Run.

  3. On the License Agreement screen, select I Agree.

  4. When the main program window appears, click Fix to complete a scan for CoolWebSearch variants, as shown in Figure 10-10. If you choose Scan Only instead, CWShredder does not remove CoolWebSearch if it is found, but alerts you about any variants that are installed on your system.

    Image from book
    Figure 10-10: CWShredder is the premier tool for removing the CoolWebSearch browser hijacker and its numerous variants.

  5. When the scanning process is complete, scroll through the result to determine whether any CoolWebSearch variants were found (as shown in Figure 10-11), and whether they were fixed.

    Image from book
    Figure 10-11: Results of a CWShredder scan.

CoolWebSearch may be the worst of a bad lot on the malware front, but it's certainly not the only malware threat that you may have trouble removing from your Windows Vista system. Malware is constantly evolving, and although most of the popular anti-spyware tools are up to the task of detecting and defeating all of the latest threats, newer variants may sometimes slip through the cracks and remain undetected.

Image from book
All the Dirty Details

The world of malware is a shady place, and the Internet is loaded with hundreds of malware-related web sites. Some are shrill sites hawking useless products that purport to detect and remove malware when in fact they do nothing useful at all. Others are lined with incorrect or misleading information in an attempt to trick you into a purchase, or worse, an infection. Thankfully, a number of excellent resources exist for the purpose of researching malware threats and getting help in cases where you find your PC infected.

Some of the best spyware-related resources on the web include:

  • SpywareInfo (http://www.spywareinfo.com)

  • CastleCops (http://www.castlecops.com)

  • Microsoft AntiSpyware Home Page (http://www.microsoft.com/athome/security/spyware/software/default.mspx)

  • SpywareWarrior (http://www.spywarewarrior.com)

  • CA Spyware Encyclopedia (http://www.3.ca.com/securityadvisor/pest/search.aspx)

  • PC Magazine Antispyware Product Guides and Reviews (http://www.pcmag.com/category2/0,1738,1639157,00.asp)

Image from book

If you believe that your system is infected even after completing scans with multiple anti-spyware tools, your best bet probably lies in a tool like HijackThis (available from http://www.spywareinfo.com/~merijn/downloads.html). This tool scans for and detects all sorts of browser hijackers and browser-related malware issues. Effectively, HijackThis scans your system and creates a log of all browser-related settings (including BHOs) installed on your computer. The log includes details like changed settings, suspect Registry entries, and the like. Ultimately, HijackThis is a tool for advanced users, but if you use it to scan your system, you can post the log file it generates to web sites like the support forums at SpywareInfo or CastleCops, and a forum user experienced with the tool should be able to help you determine whether a new malware threat or browser hijacker variant is present on your system.


Summary

Malware is one of the biggest (and yet least appreciated) threats to the security and privacy of Windows Vista systems and users. With an estimated 9 out of 10 Windows systems infected by malware in some form or another, it's critically important for all users to scan for and remove any existing threats present on Windows Vista systems, and then take the necessary steps to avoid future infections.

Remember the following points when it comes to keeping your Windows Vista system free of malware-related threats:

  • Install anti-spyware software that includes real-time protection. Keep it updated, and then scan for malware threats regularly.

  • Install a firewall that offers both inbound and outbound packet filtering capabilities to stop malware threats from phoning home.

  • Keep your system up to date by installing all of the latest security updates and patches.

  • Don't underestimate the need to have both anti-virus and anti-spyware software installed on your PC simultaneously. These programs complement (rather than conflict with) one another.

  • Consider installing more than one anti-spyware tool-a second opinion never hurts!

  • Ensure that Internet Explorer is properly secured, or switch to an alternative web browser like Firefox, Opera, or Netscape.

  • Be careful what you click, and stay away from shady web sites-what appears to be a simple banner or dialog box may actually be the gateway to infecting your Windows Vista system with another malware threat.


Part IV: Messaging Your Way to E-mail Security

Chapter List

Chapter 11: The Dark Side of Spam
Chapter 12: Securing E-mail Messages Using Encryption and Digital Signatures


Chapter 11: The Dark Side of Spam

Overview

Give any way of communicating time to become popular, and someone will find a way to abuse it for monetary gain. It started with traditional junk mail in the form of those unsolicited flyers, pamphlets, and letters that have no doubt found their way into your postal mailbox. Next came the telemarketers, taking advantage of your personal phone number to pitch you carpet cleaning and lawn care service - after you've just sat down to dinner, of course. The rise of the fax machine brought with it printouts for everything under the sun, and then along came e-mail - is it really any surprise that your inbox is overloaded with so many "spectacular" offers?

Hate it as everyone may, junk e-mail - commonly referred to as spam, but also called unsolicited commercial e-mail (UCE) - isn't going away any time soon. Quite simply, it costs next to nothing to send a spam e-mail message to millions of users, and if all those messages result in even one or two sales, its mission is accomplished in the eyes of the sender (lovingly referred to as the spammer). You may have a hard time believing that anyone would consider purchasing something advertised in a spam message, but it happens all the time. One spammer, convicted in the United States, is purported to have made in excess of $24 million hawking various products during a six-year period. In other words, as long as there's money to be made from spam, spam will continue to find its way into your e-mail inbox.

Traditional spam messages that try to sell a product or service are really little more than an annoyance - certainly a big annoyance if you receive hundreds of these messages per day, but still relatively harmless. Unfortunately, the very nature of spam has undergone a marked shift in the past couple of years, to the point where junk mail can represent a real and serious threat to you and your computer. At the more harmless end of the spectrum, opening a spam e-mail message can alert the sender that your address is valid, resulting in even more spam. On the more dangerous end are messages that include viruses, those that try to fool you into giving away sensitive personal details, and even ones that attempt to scam you out of money. Ultimately, even a seemingly harmless e-mail message from someone you know can be very bad news.

In this chapter, you learn more about how spam finds its way into your e-mail inbox, and different techniques that you can use to minimize your exposure to these pesky messages. Let the battle begin!


Understanding Spam

Spam e-mail messages all start innocently enough, usually with a single message hawking some silly product or service. It doesn't take long, however, for that one message to be quickly followed by another 2, then 4, and then perhaps 10 or more per day. Within a few months, junk e-mail messages can literally overwhelm your inbox, to the point where you don't even want to check your e-mail anymore. To understand (and ultimately fight) spam, it's important to be familiar with the following concepts:

  • How spam finds you

  • Why spam can be a security threat

You learn more about these important concepts in the following sections.

How Spam Finds You

If junk e-mail messages are finding their way into your inbox, it's happening for one of two reasons. The first (and most common) is that someone has managed to obtain your e-mail address. The second is that the spammer has actually guessed your address, adding your name or a popular term to common domain names like @hotmail.com, for example.

Spammers typically acquire your e-mail address by one of the following methods:

  • Harvesting

  • Web site registrations

  • Viruses

The following sections explore each of these techniques in more detail.

HARVESTING

Harvesting is the process by which most e-mail addresses are acquired by spammers. In a nutshell, any time that you post your e-mail address online - be it to a public web site or Usenet newsgroup - it becomes susceptible to programs (known as e-mail address harvesters) designed to traverse the Internet, collecting addresses along the way.

To avoid having your e-mail address harvested and used as a destination for spam, never post your address online. For cases where you do need to post an address for others to contact you, never use your primary address. Instead, set up a secondary account (with a free web mail service, for example) to use as your public e-mail address, and submit this address as required.

Unfortunately, you can expect your secondary address to be a major target for spam, along with legitimate messages. However, that's still better than dealing with large numbers of junk mail messages in the account used to correspond with friends, family, and business associates.

Caution

Many people recommend alternate techniques of posting your e-mail address online to avoid spam. Common examples include replacing the @ symbol with (at), or including the term nospam within your address and reminding senders to remove this term to send you a message. Although these techniques may fool very primitive harvesting programs, don't expect them to keep you spam-free. Any harvesting program that can recognize an e-mail address can also be programmed to detect and collect addresses that are masked using these techniques.

WEB SITE REGISTRATIONS

Another popular way for spammers to obtain your e-mail address is by getting you to supply it through a web site registration form of some sort. Although most reputable web sites never resell or give away your e-mail address under any circumstances, there's really nothing stopping other sites from doing with your address as they please. As such, spammers commonly purchase lists of addresses from various sources online, including companies that buy valid lists of addresses from other sites.

As with posting your e-mail address online, avoid submitting your primary e-mail address when completing web-based registration forms. Instead, set up a secondary address for this purpose.

Note

Not every web site to which you submit your e-mail address is unscrupulous enough to sell your address and other personal information, but many do. Most sites spell out exactly what they do or do not do with your information as part of their terms of service disclaimer, making it well worth at least a quick glance - especially for phrases like third parties. In addition to disclaimers, many sites also include a dedicated privacy policy page that outlines how they use the information you submit, how it is stored, and so on. The World Wide Web Consortium has developed a standard that deals with the use of personal information by web sites. For more information on the standard known as the Platform for Privacy Preferences Project (P3P), visit http://www.w3.org/P3P.

VIRUSES

Over the past few years, viruses and other pests have become an exceedingly popular way for spammers to obtain e-mail addresses. Although the methodology varies from virus to virus, the general idea is that a virus infects a computer, and then scans that system for e-mail addresses. In most cases, the virus immediately begins searching the users' address books and contact lists, harvests all addresses into a file, and then sends the file on to an Internet server.

Ultimately, this means that your e-mail address can end up in the hands of spammers through no fault of your own. All it takes is for a harvesting virus to infect a computer where your e-mail address is in the user's address book or contact list. Although you obviously can't control what other people do with their own computers, it doesn't hurt to remind friends and family members about the importance of running antivirus software, keeping it up-to-date, and scanning for viruses frequently. Of course, in the same way that a virus on a friend's computer can lead to more spam for you, the reverse is also true - when a harvesting virus infects your PC, it may be people in your address book who end up on the wrong end of the spam town.

Why Spam Can Be a Security Threat

Normally seen as little more than an annoyance, spam messages are becoming more of a threat to security and privacy every day. Where once their objectives were relatively limited to profit motives, the spam messages of today not only try to sell to, but also infect, steal from, and even scam the recipient. Some of the primary security and privacy threats associated with spam include:

  • Viruses

  • Beacons

  • Phishing

  • Scams

Each of these threats is looked at in more detail in the following sections.

VIRUSES

Many viruses are designed to harvest e-mail addresses, but it's also not uncommon for spam e-mail messages to contain virus-laden attachments as well. In some cases, this is the result of a virus infecting one PC and then mailing itself out to all the addresses in the infected computer's contact list. In others, a spammer knowingly sends out an infected e-mail attachment to a list of users, hoping that at least a few users will open the attachment, become infected, and in turn propagate the virus even further.

Your best protection against e-mail–based viruses is to install anti-virus software that includes real-time scanning of all incoming and outgoing e-mail messages. These programs typically quarantine infected attachments automatically, but for them to be truly effective you must be diligent about keeping your virus definition files up-to-date.

BEACONS

The most common problems a spammer faces determining whether the e-mail addresses on his lists are valid. In the eyes of the spammer, a known good e-mail address is much more valuable than addresses where the validity of the address is suspect. Spammers rely on their messages reaching a functioning and in-use mailbox, and they take steps to confirm whether a given address is in use.

One of the most popular methods that spammers use to confirm an address is through beacons. In the world of e-mail, a beacon signals that your address is good, and that the spammer's message was at least opened. Although different beaconing methods exist, the most popular is to send e-mail messages in HTML format (messages with different fonts, colors, images, and so forth). When these messages are opened, a request is sent from your computer to download any images the message includes from a web server. The web server then tracks that the request came from the message sent to you, through a unique code in the specific message you received. Ultimately, the beacon tells the spammer not only that your address is valid, but also that you read (or briefly opened) the message.

Caution

If a spam e-mail message that you receive includes a link that you can click to remove yourself from the spammers list, never click it. Although a small percentage of spammers might actually remove you from their list, the vast majority simply use your click as yet another type of beacon signaling that your e-mail address is valid. In most cases, clicking these links and submitting your e-mail address for removal actually results in you receiving even more spam.

Windows Mail automatically prevents beacons from functioning by not allowing any requests to web sources to be processed when you open an e-mail message. Figure 11-1 provides an example of how a message that includes beacons may appear when opened with Windows Mail.

Image from book
Figure 11-1: Windows Mail automatically protects against message beacons and code embedded in HTML-based e-mail messages.

If you're using an e-mail client program other than Windows Mail, it may or may not include a specific feature for dealing with beacons. However, almost every e-mail client program includes an option to view all messages as plain text, which eliminates the possibility of the message attempting to contact the Internet. To determine how to view all e-mail messages you receive as plain text in your e-mail client, consult the program's Help system. You learn more about configuring Windows Mail to open messages as plain text later in this chapter.

Caution

Although opening a spam e-mail message can signal that your e-mail address is valid, spammers also rely on another technique in their quest to find valid addresses - the seemingly harmless out-of-office reply. Also referred to as an autoresponder, this is the message that you typically configure when you're away from e-mail for a few days. When enabled, every e-mail message that you receive from another user results in an automatic reply being sent back to the sender. Although legitimate senders usually appreciate out-of-office replies (because they'll know you're away and not ignoring them), they're also a boon to spammers who use the replies to determine that your address is valid. If you plan to use out-of-office replies, create a rule that only sends these messages to people already in your address book or contact list. You learn more about creating e-mail message rules later in this chapter.

PHISHING

The spelling may be different, but persons engaging in phishing are definitely looking to hook something - usually sensitive personal information like username and password information for online banking or auction web sites.

In its most common form, phishing involves a spammer sending you an e-mail message that looks as if it was sent from a bank or payment service or a popular online auction web site. The message usually states that the web site needs you to log on to confirm your username and password, and provides you with a link to submit your information. When you click the link (which may appear 100 percent legitimate), your web browser opens and displays a page that may look identical to the site suggested in the message. In reality, the site is a fake. If you submit your information, it's actually sent to the spammer/scammer who originally sent the message, giving him full and unrestricted access to your account. It's not uncommon for phishing victims to find that funds have been transferred from their accounts, or that high-priced auctions have been set up under their username. In the case of the auction, the scammer sets up the auction using your username, sells the item to the highest bidder, and then collects the winner's money. When the scam is complete, the scammer and the money are long gone, and you're left on the hook to deal with the aftermath.

Ultimately, the best way to ensure that you're never a phishing victim is to ignore and delete any e-mail messages stating that you need to supply information about your account. If you do receive such a message and believe it to be legitimate, contact the company who sent the message by phone, or by visiting its web site directly. Most legitimate companies (and especially those involved in financial transactions) never ask for your personal account details in an e-mail message. If you believe that you have been tricked into supplying your username and password as a result of a phishing scam, contact the company in question, or log on to your account and change your password immediately.

With the release of Windows Vista and IE7, Windows Mail (formerly Outlook Express) now includes built-in anti-phishing technology to help warn you against detected phishing attempts.

Note

For more details on phishing and phishing-related scams, visit http://www.antiphishing.org.

SCAMS

Although they've received a fair amount of press coverage over the past few years, many e-mail users continue to fall for a variety of scam messages received by e-mail. The most popular of these are the so-called 419 messages, named after a related section of the Nigerian criminal code (the country where the scam is purported to have originated). These particular messages ask you to help someone transfer money out of the sender's country for a portion of the proceeds, but a number of related scams exist - for example, some inform you that you've won the lottery or a certain prize. In all cases, you must pay a transfer fee or supply your banking details to claim your bounty, which is effectively the scam. As unbelievable as it sounds, some individuals are duped out of tens of thousands of dollars (and more) after falling for this trickery.

Although you might be tempted to reply to the sender of these messages, don't. If you do want to take action, visit the Spam Reporting Addresses web site at http://www.banspam.javawoman.com/report3/scam1.html for details on contacting the appropriate authorities in your locale.

Note

For some good reading on 419 and related Internet scams, visit the 419 Coalition web site at http://www.home.rica.net/alphae/419coal/index.htm.


Fighting Spam

When the spammers find you, it won't be long before your inbox is completely overwhelmed by junk e-mail. Although the fight against spam is definitely an uphill (and arguably impossible to win) battle, there are a number of different ways that you can work toward reducing your junk e-mail intake. Some of the primary methods and techniques that you can use to fight spam include:

  • Using the anti-spam and security capabilities of e-mail client software like Windows Mail

  • Installing anti-spam software

  • Using plain old common sense

Each of these concepts is explored in more detail in the following sections.

Fighting Spam with Windows Mail

Unlike its predecessor Outlook Express, Windows Mail includes anti-spam technologies similar to those in Microsoft's Hotmail service and its full-featured e-mail client, Microsoft Outlook. Techniques that fight spam in Windows Mail include:

  • Configuring junk e-mail options

  • Implementing safe and blocked sender lists

  • Designating that messages from certain international regions and those using foreign encoding are always treated as spam

  • Implementing anti-phishing settings

  • Configuring message security settings

  • Changing the way you view e-mail messages

These concepts and their configurations are looked at in more detail in the following sections.

CONFIGURING JUNK MAIL FILTERS

One of the most powerful features in Windows Mail is configuring junk e-mail options that are applied to all incoming messages. Junk e-mail options determine whether a message should be designated as spam based on its contents, the sender's address, the domain it was received form, and more.

By default, Windows Mail is configured to treat only those messages that are readily identified as spam as junk e-mail. When Windows Mail identifies these messages as spam, they are immediately moved from your inbox to the Junk E-mail folder. The Junk E-mail folder acts as a type of temporary holding location for all messages identified as spam. Before emptying or deleting the messages in this folder, you should always check to ensure that legitimate messages have not been falsely identified as spam. If you do find any legitimate messages in this folder, simply drag them to your inbox folder in Windows Mail.

Although its default junk e-mail settings are sufficient to trap the majority of common spam messages, you can also configure Windows Mail to scrutinize incoming messages more closely. Other junk e-mail options that you can configure in Windows Mail include:

  • No automatic filtering. When this option is selected, Windows Mail moves messages from blocked senders to your Junk E-mail folder, but no other anti-spam techniques are used to filter messages received.

  • Low. This default spam filtering method catches the most common spam messages and moves them to your Junk E-mail folder.

  • High. This option filters messages more aggressively in its search for spam, but may occasionally designate legitimate messages as junk e-mail.

  • Safe list only. When this option is selected, the only messages that end up in your inbox are those from senders on your Safe Senders List (which includes contacts in your address book).

  • Permanently delete suspected junk e-mail instead of moving it to the Junk E-mail folder. If you check this option, any message that your configured settings deems to be spam is deleted automatically - enable it with caution.

Follow these steps to configure junk e-mail options in Windows Mail:

  1. Select Start → Windows Mail.

  2. Select Tools → Junk E-mail Options.

  3. On the Options tab, select the level of junk e-mail protection that you want to implement, as shown in Figure 11-2.

    Image from book
    Figure 11-2: Configuring Junk E-mail Options in Windows Mail.

  4. If you want to permanently delete junk e-mail instead of having Windows Mail store it in the Junk E-mail folder, select the Permanently Delete Suspected Junk E-mail Instead Of Moving It To The Junk E-mail Folder check box.

  5. Click OK to implement your new junk e-mail option settings.

IMPLEMENTING SAFE AND BLOCKED SENDER LISTS

Although Windows Mail generally does a good job of identifying junk e-mail messages by default, you can implement stricter anti-spam measures by making use of the program's Safe Senders and Blocked Senders list. As the name suggests, the Safe Senders list consists of e-mail senders you know, such as friends, family, and business colleagues. When you add an e-mail address to your Safe Senders list, messages from that user are never treated as spam. For greater flexibility, you can also add domain names to this list - for example, entering a domain name like @company.com (instead of just one address) ensures that messages from any user with an e-mail address ending in @company.com is never treated as spam. The Windows Mail Safe Senders list is functionally the same as what is commonly referred to as a whitelist. You'll learn more about whitelists later in this chapter.

As you might have guessed, the Blocked Senders list accomplishes exactly the opposite of the Safe Senders list. Messages received from individual e-mail addresses or domain names added to the Blocked Senders list are automatically moved to your Junk E-mail folder.

Follow these steps to add e-mail addresses or domain names to your Safe Senders and Blocked Senders lists in Windows Mail:

  1. Select Tools → Junk E-mail Options.

  2. Select the Safe Senders tab.

  3. Click the Add button.

  4. To add an individual e-mail address to your Safe Senders list, type in the full address and click OK. You can also enter a domain name like @company.com to ensure that messages received from any e-mail user with an @company.com address is never treated as spam.

    Figure 11-3 shows a Safe Senders list with both individual e-mail addresses and entire domain names configured.

    Image from book
    Figure 11-3: The Safe Senders list.

  5. Select the Blocked Senders tab.

  6. Click the Add button to add individual e-mail addresses or entire domain names to the list. Messages from e-mail addresses or domain names that appear on this list are always treated as junk e-mail.

Tip

You can quickly add e-mail addresses to both your Safe Senders and Blocked Senders lists by right-clicking a message from a user, selecting Junk E-mail, and then choosing Add Sender To Safe Senders List or Add Sender To Blocked Senders List, as required.

While blocking spammers' e-mail addresses may seem like an effective way to combat spam, it's not always an appropriate solution. The main issue is that spammers seldom use the same address to send you messages, and rarely use a valid e-mail address. In other words, blocking an address that a spammer has used to send you a message is generally futile because the spammer is unlikely to use it again. However, this technique is helpful in cases where you've somehow managed to end up on an e-mail newsletter list and are receiving repeated messages from the same source. If you can't dig up the details of how to remove yourself from these (typically) opt-in lists, adding the sender's e-mail address to your Blocked Senders List can prove an appropriate solution.

CONFIGURING REGIONAL AND ENCODING JUNK E-MAIL SETTINGS

If you take the time to examine the junk e-mail that makes its way into your e-mail inbox, you're likely to notice that many arrive from countries worldwide, and sometimes include foreign characters. In most cases these messages are clearly spam. Windows Mail makes it easy to designate all such messages as junk e-mail via the International tab in its Junk E-mail Options window.

Windows Mail blocks international spam messages in two ways. The first is by analyzing the Top-Level Domain (TLD) from which the message was sent. For example, if a message is sent to you from a user with an e-mail address ending in. AF, the sender's domain name is associated with Afghanistan. Assuming that you don't know anyone in Afghanistan, you can probably safely block all messages from senders in that region.

Similarly, a message that uses the Simplified Chinese character set won't be of much use to you if you can't read Chinese. To deal with messages using encoding methods other than those associated with your native language, Windows Mail enables you to designate all such messages as spam. As with the regional example previously mentioned, Windows Mail automatically moves all messages that use encoding methods you choose to block to your Junk E-mail folder.

Follow these steps to configure Windows Mail to designate messages from certain TLDs - or those using foreign encoding - as junk e-mail.

  1. Select Tools → Junk E-mail Options.

  2. Select the International tab.

  3. To block messages from certain countries or regions, click the Blocked Top-Level Domain List button.

  4. In the Blocked Top-Level Domain List window, select the check boxes next to the countries or regions to treat messages from e-mail addresses in those locales as junk e-mail, as shown in Figure 11-4. When finished, click OK.

    Image from book
    Figure 11-4: Blocking e-mail messages by TLD.

  5. Click the Blocked Encoding List button.

  6. In the Blocked Encoding List window, select the messaging encoding types that you want to treat as spam and click OK.

CONFIGURING ANTI-PHISHING SETTINGS

Phishing threats have become very commonplace, and are addressed in Windows Mail through the anti-phishing filter built into its companion browser, Internet Explorer. Windows Mail helps to ensure that you don't fall prey to phishing scams by displaying a warning dialog box when phishing messages are downloaded and detected, as shown in Figure 11-5.

Image from book
Figure 11-5: The message that Windows Mail displays when junk or phishing messages are downloaded.

Follow these steps to configure settings related to how Windows Mail deals with phishing-related e-mail messages when they're detected:

  1. Select Tools → Junk E-mail Options.

  2. Select the Phishing tab. Although Phishing protection is enabled by default, you should also select the Move phishing E-mail To The Junk Mail Folder check box, as shown in Figure 11-6.

    Image from book
    Figure 11-6: Phishing settings in Junk E-mail Options.

  3. Click OK to close the Junk E-mail Options window.

Cross Reference

For more details on the anti-phishing filter built into IE7, see Chapter 5.

CONFIGURING MESSAGE SECURITY SETTINGS

Along with its junk e-mail options, Windows Mail also includes additional configurable security settings accessible through Tools → Options → Security, as shown in Figure 11-7.

Image from book
Figure 11-7: Windows Mail Security options.

The name of the Virus Protection section on this tab is somewhat misleading - it doesn't offer any virus protection in the traditional anti-virus sense, but does offer a degree of protection against common virus and spyware tactics.

First, the IE Security Zone settings enable you to configure how Windows Mail deals with HTML-based e-mail messages, using restrictions similar to those originally looked at in Chapter 5. The remaining settings in this section are enabled (selected) by default. The first check box alerts you when other programs (like viruses) try to send out messages via Windows Mail, whereas the second blocks you from opening or saving dangerous virus attachments. As a best practice, you should leave both of these check boxes selected.

Note

When the Do Not Allow Attachments To Be Saved Or Opened That Could Potentially Be A Virus option is selected in Windows Mail, potentially dangerous attachments are removed from messages by default. File types that are automatically removed from messages include those ending in .exe, .pif, and .scr.

The Security tab also includes a section called Download Images. When the Block Images And Other External Content In HTML E-mail check box is selected (as it is by default), Windows Mail protects you from the possibility that spammers will use these elements as beacons. As with the previous settings, keep this setting enabled as a security precaution and to help reduce the possibility that you'll receive more spam as a result of viewing a junk e-mail message.

Additionally, you can stave off some of the dangers associated with HTML e-mail messages by reading all messages in plain text format. To do this in Windows Mail, select Tools → Options → Read and select the Read All Messages In Plain Text check box as shown in Figure 11-8.

Image from book
Figure 11-8: Configuring Windows Mail to read all messages in plain text.

Filtering Spam with Anti-Spam Software

Although the anti-spam features of Windows Mail meet the needs of most Vista users, there's no shortage of powerful e-mail filtering programs available from a variety of companies. If you find that the features built into Windows Mail are not robust enough to meet your needs, you may want to consider using a dedicated anti-spam program for added protection.

Some of the more popular anti-spam software packages include:

  • K9. This free program works in conjunction with your regular e-mail client to automatically classify incoming messages as legitimate or spam. K9 only works POP3 e-mail accounts, and can be downloaded from http://www.keir.net/k9.html.

  • MailWasher Pro. This anti-spam program, shown in Figure 11-9, works with POP3, IMAP, and HTTP e-mail accounts, using a variety of different filtering methods to reduce your spam intake. It even includes a feature that enables you to delete spam e-mail messages from your mail server before downloading them to your computer. You can download a trial version of MailWasher Pro from http://www.mailwasher.net, and register it after 30 days for $37.

    Image from book
    Figure 11-9: MailWasher Pro is a popular commercial anti-spam program.

  • POPFile. You can train this free e-mail classification program to detect spam and automatically organize other incoming e-mail messages into different folders according to your preferences. You download POPFile from http://www.popfile.sourceforge.net.

  • SpamPal. This free e-mail classification program uses filtering techniques and RBL lists in an attempt to keep your inbox spam-free. SpamPal works with both POP3 and IMAP e-mail accounts, and you download it from http://www.spampal.org.

Note

The preceding list of anti-spam programs is only a small collection of some of the more popular products available. For a more comprehensive list of anti-spam programs and other spam-related resources, visit the Coalition Against Unsolicited Commercial E-mail web site's resource page at http://www.cauce.org/about/ resources.shtml.

The primary security and anti-spam features of these software packages include:

  • Bayesian filtering

  • Whitelists and blacklists

  • Realtime blackhole lists (RBLs)

Each of these security and anti-spam features are explored in more detail in the following sections.

BAYESIAN FILTERING

Using message rules to filter out spam is difficult, because spammers use variations in spelling and punctuation to avoid matching the keywords or phrases you configure. With this weakness in mind, most anti-spam programs employ a technique known as Bayesian filtering. Bayesian filtering is a technique that uses statistical methods in an attempt to determine whether an e-mail is or is not spam, based on its subject and message contents. Over time, the anti-spam program's Bayesian filters learn which messages are spam and which are not (based on the messages you flag as spam), and then use this information in its spam calculations.

Ultimately, Bayesian filtering is a great feature, but it can take a while for it to gather enough information to determine whether incoming messages are spam with a fair degree of accuracy. Additionally, this method suffers from a problem known as false positives, as outlined in the sidebar.

Image from book
Positively False?

One reason using anti-spam software can often be just as frustrating as not using it at all has to do with a situation known as false positives. A false positive is an occurrence where your anti-spam software deems that a legitimate e-mail message (such as one from a friend, family member, or business associate) is actually spam. This can happen for a variety of reasons, such as when the message's subject or body includes spam-like terms or phrases, or simply matches some pattern or set of characteristics commonly identified with spam.

If you do choose to go the anti-spam software route, be sure to take a quick peek into the folder where junk mail messages are stored every week or so (and especially before you empty the folder to delete messages). You'll likely find that at least a few legitimate messages have been mistakenly flagged as spam, so take the opportunity to move these messages to your inbox.

As a guard against false positives, most anti-spam programs include a feature whereby addresses that appear on your whitelist are never marked as spam, regardless of their contents.

Image from book

WHITELISTS AND BLACKLISTS

In addition to Bayesian filtering, most anti-spam programs also include the ability to define blacklists and whitelists. A blacklist is effectively the same as a blocked senders list, meaning that you will never receive messages from addresses (or domain names) on this list.

In contrast, a whitelist (akin to the Safe Senders list in Windows Mail) is a list of e-mail addresses from whom you should always receive messages and which should never discarded. For example, you can add all e-mail addresses belonging to friends, family members, and business associates to your whitelist to ensure that messages from these senders are never blocked as potential sources of spam. Many anti-spam programs even enable you to block all e-mail messages except those from users on your whitelist. If you only communicate with a small number of people via e-mail, whitelists provide a very effective way to keep your inbox spam-free.

REALTIME BLACKHOLE LISTS

It is very rare for spammers to set up their own e-mail servers for the purpose of sending their messages. Instead, spammers search the Internet looking for misconfigured servers that allow any user to send e-mail messages, and then use this server as their spam-sending gateway. When messages are sent through these misconfigured servers, the owner of the server is usually contacted to alert them to the situation - often through a barrage of angry messages from those who have received the spam. If the owner takes the steps necessary to properly secure his or her server, then all is generally well. If the owner ignores the messages and continues to allow his or her server to be used as a gateway for spam, however, any one of a number of organizations may add the server's name and IP address to what is known as a Realtime Blackhole List (RBL). In the world of e-mail, RBLs serve as a regularly updated source of information about e-mail servers that act as a gateway to spammers. Many anti-spam programs enable you to take advantage of the information that RBLs provide by allowing you to subscribe to the RBL and check all incoming messages against it. When the anti-spam software determines that a message was sent via a server that appears on an RBL list, the message (assumed to be spam) is automatically deleted.

Overall, enabling the RBL-checking feature of your anti-spam software is a good idea. A number of different RBL services exist, with ORDB (http://www.ordb.org) and Spamhaus (http://www.spamhaus.org) among the most popular. Although subscribing to an RBL won't cease the spam tide completely, it can help to significantly reduce your intake.

Defeating Spam with Good Ol' Common Sense

Sometimes the best defenses are also the most simple, and this is especially true when it comes to dealing with spam. Two of the key non-software solutions to defeating spam are:

  • Protecting your e-mail address

  • Knowing when to accept defeat

Each of these concepts is looked at in more detail in the following sections.

PROTECTING YOUR E-MAIL ADDRESS

The easiest way to protect your e-mail inbox against the scourge and security threats of spam is to always protect your primary e-mail address. Although the idea of keeping any and all of your e-mail addresses spam-free is a noble one, it's simply not practical. Over time, any address that you post online or submit in web registration forms is going to be hit by spam, one way or another.

Understanding that receiving spam e-mail messages is more or less a guaranteed eventuality, keep the following points in mind when it comes to minimizing your spam exposure:

  • Create a secondary e-mail address and use this address in all cases where submitting an e-mail address is required.

  • Never post your primary e-mail address on web pages, or when registered for access to password-protected web sites.

  • Never use your primary e-mail address in Usenet newsgroup postings.

  • Never submit your primary e-mail address as the address to which online newsletters should be sent, if possible.

Although none of these methods guarantees that your primary e-mail account will never receive spam messages, it helps to significantly minimize your intake. When managed correctly and not posted online, it's absolutely possible for your protected e-mail address to take in next to no spam at all.

KNOWING WHEN TO ACCEPT DEFEAT

Kenny Rogers probably never imagined that the lyrics to his song "The Gambler" would be used in an analogy in the fight against spam. However, you truly do need to understand the value of the line "you've got to know when to hold 'em, know when to fold 'em" when it comes to dealing with spam.

In a nutshell, any e-mail account that already receives tens (if not hundreds) of spam messages per day is in all likelihood a lost cause. Although you could invest a great deal of time and money into trying to fend off spam, things really can and do get to a point where the fight just isn't worth fighting any more. Whichever way you cut it, battling spam just isn't a good investment if things are already out of hand.

With that in mind, it may be best to cut your present "spamtastic" account goodbye, once and for all. A new e-mail address is literally a fresh (and spam-free) start, a chance to take what you now know about how spam finds you and not make the same mistakes again. Although there certainly isn't any such thing as an e-mail account that remains 100 percent spam-free over time, it is possible to have one that is close. Along with being much less annoying, your new account also ensures that you're less susceptible to the security threats that are increasingly creeping into Windows by way of spam - if you're serious about your online security and privacy, that alone is reason to consider making the switch.

Image from book
New Address = Fresh Start

Switching to a new e-mail address may seem like a drastic and unrealistic step in fighting the war on spam, but you must consider it as an option if your spam intake becomes overwhelming. Quite simply, you can't undo past mistakes, and if your e-mail address has found its way into spammer circles, there's nothing that you can really do to stem the tide. Certainly you can invest time and money into the battle, but at the end of the day, it's you versus hundreds - if not thousands - of spammers. In other words, the odds of you winning are just not very good.

Most people look at changing their e-mail address as a bad idea - what will happen to all those people who already have their e-mail current address, after all? Although the risk of someone (especially a business contact) not being able to get in touch may seem high, the risk is quite easy to mitigate with the right approach.

Let's say that you create a new e-mail address (more on that shortly). Start by sending a message to all of your friends, family members, and contacts from your current e-mail address, letting them know that you're switching to a new address. Outline the reason (too much spam!), and let them know your new e-mail address. Then, send them a second message from the new address, asking them to add the new address to their contact list or address book, and to use it for all future correspondence. While you're at it, let them know that you're going to keep an eye on your old address for a month or two. Then, every time that you receive a message at your old address, send back a reply and a reminder that your address has changed.

Of course there may also be people you cannot contact, and who will still try to e-mail you at your old address. For this purpose, consider setting up an out-of-office reply on your old address that informs people that the address they have sent the message to no longer valid. In this message, specify an alternate way to contact you, perhaps through a business phone number or alternate e-mail address (like a new and temporary free web mail address). Just don't provide your new official address in this automatic reply, lest it become a new target for spammers.

As far as obtaining a new address is concerned, just sign up for a new web mail address if that's the route you prefer, or contact your ISP about creating a new e-mail address on its service. Many ISPs provide you with up to five free e-mail addresses as part of using their service, so this shouldn't be a problem. If it is, contact their customer support line, explain the situation, and they should be more than willing to help - less spam sent to you means less useless work for their mail servers. If your ISP refuses to help, tell their customer care people that you are considering switching to a different service provider. You'd be amazed as how persuasive an argument that can be!

Image from book


Summary

Although new and innovative ways of fighting spam are being developed all the time, spammers have a vested interest in keeping up with (and working to circumvent) these techniques as well. Unfortunately, this cat-and-mouse game is more than just an annoyance - spam e-mail messages can (and often do) represent a real risk to system security and your personal privacy. Keep the following points in mind when it comes to minimizing your exposure to spam e-mail messages:

  • Never post your primary e-mail address online. When you must submit e-mail addresses on the Internet, dedicate a secondary address to this purpose.

  • Never open e-mail messages or attachments from unknown senders. These messages often include beacons and viruses.

  • If you must continue to use an e-mail account that is being overwhelmed by spam, take advantage of security features in your e-mail client program, or consider installing an anti-spam program.

  • If your current e-mail account is being deluged by spam, consider switching to a new primary e-mail address.


Chapter 12: Securing E-mail Messages Using Encryption and Digital Signatures

Overview

Over the course of the last decade or so, no single technology has had as much of an impact on the way people communicate as e-mail. Where once corresponding meant writing or typing out letters to be sent via the postal system, today electronic messages can be exchanged almost instantly - quite literally at the click of a button.

There's no denying that e-mail makes it amazingly simple to keep in touch with friends, family, and business contacts worldwide. However, this convenience comes at a price; e-mail is not a secure communication mechanism by default, and offers nothing in the way of true privacy or confidentiality. Every e-mail message that you send can potentially be intercepted, read, and modified by other users on its journey from the sender to the recipient. Compounding the issue, e-mail offers absolutely no guarantees that a message originated from the person listed as the sender. Others can send e-mail messages pretending to be you or anyone with whom you correspond.

Although the idea that someone else is reading or intercepting your e-mail is a little too "1984" for some people, the reality is that every single unsecured message you send or receive is at risk. Think of every normal e-mail message that you've ever sent or received. Then, ask yourself how comfortable you would feel if a third party was reading or collecting those messages, sending messages in your name, or pretending to be the person you're corresponding with. In the world of unsecured e-mail, each of these scenarios is not only possible, but also very easy to accomplish.

If you've ever used an e-mail client program like Microsoft Windows Mail, you've probably noticed a couple of buttons designed to encrypt and digitally sign messages. In this chapter you learn how secure e-mail systems work, how to configure your Windows Vista system to support secure e-mail, and ultimately how to make use of methods like encryption and digital signatures to secure the contents of e-mail messages and validate the identities of the people with whom you correspond.


The Need for E-mail Security

E-mail has existed as a communication mechanism for a long time. In fact, the first e-mail message was exchanged in 1971 on the ARPANET, the predecessor of today's Internet. Although much has changed since then, the majority of e-mail messages sent today still share one important trait with those from more than 30 years ago - they're not in any way secured by default.

Some of the key security issues associated with normal, unsecured e-mail communications include:

  • Eavesdropping. E-mail messages are sent over the Internet and other networks in plain text format by default. Any user on a network over which the message is traveling can potentially capture the message stream and read its contents. Similarly, any person with administrative privileges on either the sending or receiving mail servers (and desktop computers for that matter) can open and view the entire contents of any user's mailbox folders, and read through his messages. Unfortunately, there is no easy way to tell whether other people are reading messages that you send or receive. If you send any e-mail message without securing it, understand that its contents are never truly confidential.

  • Spoofing. Spoofing is a technique whereby messages are sent in a manner that makes them appear to be from a different user. For example, a malicious person could send e-mail messages to other users that appear to be coming from you, using your e-mail address. This technique is commonly used to propagate viruses and spam e-mail messages. Without implementing e-mail security techniques that prove a sender's identity, it is virtually impossible to prove that a message came from the sender listed in its From field.

  • Modification. In the same way that one can eavesdrop on unsecured e-mail messages, their contents can also be modified in transit between a sender and recipient. Any user who can gain access to an e-mail message (whether by capturing it or accessing it on a mail server or desktop computer) can modify its contents to display a different message, or even delete it completely. When e-mail security techniques are not implemented, messages can be modified at any point between the sender and recipient, without either party's knowledge.

  • Repudiation. Based on the various ways in which unsecured e-mail messages can be forged or manipulated, it is never truly possible to prove who sent a message. This can have serious repercussions in both legal and business matters.

Although using unsecured e-mail to communicate with friends and family may not appear to have any inherent security risks, most people send e-mail messages without giving privacy as much as a second thought. This is especially dangerous in cases where messages contain sensitive information, such as health, business, financial, and personal details.

This isn't to say that you must secure every e-mail message you send. Although that's certainly not a bad idea, properly securing e-mail is sometimes beyond the capabilities of less experienced users. With that in mind, using unsecured e-mail is typically fine if the security and privacy of a particular message is not a concern. However, in cases where sensitive information must be sent (or where verifying the identities of the sender and receiver is important), making use of encryption and sender identification techniques is not only suggested, but highly recommended.

Tip

An easy way to determine whether the e-mail message you're sending needs to be secured is to ask yourself whether you would announce its details to a room full of strangers. If the answer is yes, an unsecured message will probably do. If the answer is no, then take the necessary steps to ensure the message is properly secured.


Secure E-mail Components

E-mail communications can be secured using a number of different methods and techniques. The most popular and widely used of these methods, however, are those based on a scheme known as public key cryptography. In a public key cryptographic system, users are assigned a personal digital certificate that is used to both validate their identity and enable the secure exchange of information through the use of encryption.

Public key cryptography systems are typically comprised of the following primary elements:

  • Certificates

  • Certificate Authorities (CAs)

  • Public and private keys

Each of these elements is explored in more detail in the following sections.

Certificates

Certificates form one half of the foundation upon which public key cryptography systems are built. Although a certificate is technically nothing more than a file that can be stored on your computer, it acts as your personal digital identification - in fact, personal digital certificates are often referred to as digital IDs.

You've probably already come into contact with certificates in some form, perhaps without even knowing it. When you visit a secured web site (those starting with an https:// address, such as http://www.paypal.com or http://www.verisign.com), the server presents its identification in the form of a web site certificate. The certificate allows both you and your web browser to validate the site's true identity, and ultimately enables all traffic passed between your computer and the web site to be securely encrypted. In cases where a web site does not have a certificate installed, secure HTTP communications cannot occur.

In the world of e-mail, personal certificates are usually issued by entities known as Certificate Authorities (CAs). You complete a certificate request process with a CA as part of registering for a certificate, and ultimately obtain your personal certificate from the CA if the request is approved. A number of different public certificate authorities exist, including companies like Thawte and VeriSign. Some CAs deal with the general public, whereas others issue certificates for larger corporations only.

After you have a personal certificate installed, you can digitally sign e-mail messages you send, as well as decrypt messages that other users send to you.

Note

Some public key cryptographic systems, like PGP, do not rely on CAs to issue certificates. PGP is explored in more detail later in this chapter.

Certificate Authorities

Certificate Authorities (CAs) are the entities responsible for issuing digital certificates, and represent the other half of the foundation upon which public key cryptographic systems are built. Public CAs not only generate certificate files (in a format known as X.509), but also digitally sign the certificates they issue. In this way, a CA acts a kind of trusted third party responsible for identifying the organizations or individuals to whom it issues certificates. When a CA signs your certificate, it's effectively saying that it vouches for your identity.

Note

The certificates issued by CAs work with e-mail programs that support the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol. Both Microsoft Outlook and Windows Mail support S/MIME, as do most third-party e-mail client software packages.

Consider completing a credit card purchase online. When you reach the payment portion of the process (where you submit your personal details and credit card number), an encrypted connection is used. Your web browser typically notifies you of this by displaying a lock icon toward the bottom-right corner of its window. However, your browser does more than just ensure a secure connection alone - it also verifies that a trusted CA has signed the web site's certificate, thus confirming its identity. In cases where a trusted CA's signature is not found on the certificate, your web browser typically displays a warning message alerting you to the fact that this site may not actually be who it's claiming to be.

CAs exist to help create a hierarchy of trust upon which a secure identification and encryption infrastructure can be built. Windows Vista systems (more specifically, programs like Internet Explorer and Windows Mail) implicitly trust certificates issued and signed by public CAs like Thawte and VeriSign. In other words, if you send your personal certificate to another user, her e-mail program verifies that a trusted CA (in this case, Thawte) signed it. Because the other user's e-mail program "trusts" certificates signed by Thawte, it inherently trusts you. CAs are trusted by way of having their root or top-level certificates included with Windows Vista by default. In cases where a user attempts to communicate with you using a certificate that wasn't issued by a trusted CA, a warning message usually displays, alerting you to the fact.

Public and Private Keys

In a public key cryptographic system, every person issued a certificate is also issued a pair of keys. One key in this pair is known as the public key, and the other as the private key. Only the private key can decrypt a message encrypted by its associated public key, and vice versa.

This two-key methodology is also referred to as asymmetric encryption. The fundamental idea behind this scheme is that you can freely distribute your public key to anyone, but your private key is for your use only.

Many people find this idea confusing, but it's actually quite simple. Your public key has only two real purposes: it enables others to verify your digital signature, and it encrypts messages they're sending to you. In other words, if another user encrypts a message with your public key, only your private key can decrypt and open that message. As long as nobody else has access to your private key, messages encrypted by your public key remain for your eyes only. Similarly, when you sign a message with your private key, only your public key can verify your signature. As such, when users receive a signed message from you, they know that only your private key could have been used to sign the message, and that it is indeed from you.

As you might expect, this scheme requires that your private key remain properly secured. Operating systems like Windows Vista store your private key in a protected storage area that is inaccessible to other users.

Caution

If you ever suspect that your private key has been stolen or compromised by a hacker or another user, stop using it immediately. If another user does have access to your private key, he can read your encrypted e-mail messages and sign messages with your digital signature. The process of invalidating a key pair is known as certificate revocation, and is explained in a sidebar later in this chapter.


How Secure E-mail Works

The following sections explain how digital signatures and encryption work in the context of verifying a sender's identity and securing the contents of e-mail messages. A step-by-step example of the processes involved is also provided for illustrative purposes.

Digital Signatures

Digital signatures exist to verify the identity of the person who sends an e-mail message. In basic terms, a user with a personal certificate installed composes an e-mail as she normally would, and then selects an option (in her e-mail client program, for example Windows Mail) to digitally sign the message. When the recipient receives the message, he verifies this digital signature, proving that the message both came from the sender, and was not in any way modified in transit.

Note

In cryptographic terms, proving that a message came from the actual sender is commonly referred to as non-repudiation or authentication. An e-mail that was not modified in transit is said to have message integrity.”

Digital signatures do nothing to encrypt the contents of a message - the process of signing a message is designed to prove the sender's identity, and to ensure that the contents of the message haven't been altered since the message was sent.

In a public key cryptographic system, messages are signed via a process whereby the contents of a message are run through an algorithm that always produces a fixed-length output known as a hash value. The hash value is signed with the sender's private key, and sent along with the message.

When the signed message reaches its destination, the recipient uses the sender's public key to decrypt this signed hash value (the client e-mail program actually does this on the user's behalf). This process succeeds only if the real sender's private key was used to sign the hash. If the process fails and the hash value cannot be decrypted, the recipient knows that the message is not from the sender specified.

Assuming that the public key can decrypt the hash value, the sender's system runs the message through the same algorithm to produce its own hash of the message. If the results are the same as those included with the original message, the recipient knows that the message has not been altered in any way since it was originally signed. If so much as a single character in the message was changed in transit, the hash value calculated by the recipient's computer would produce a different result, and the recipient would know that the message had been tampered with.

Note

Public key cryptography is both slow and computationally taxing due to the long key lengths used by the RSA encryption scheme (typically 1024 bits in length). For that reason, most public key systems make use of what is known as a session key to encrypt or digitally sign messages. In the case of digitally signing a message, a one-time session key (usually 128 bits long) is used to sign the hash value attached to the message. Then, the session key is encrypted by the sender's private key and included with the message as well. When the recipient receives the message, he uses the sender's public key to decrypt the session key, and then uses the session key to decrypt the hash value. This method makes public key cryptography more efficient because it takes much less time to encrypt or decrypt a session key than it does to perform the process on an entire e-mail message, attachments, and so forth. For the sake of clarity, use of session keys is assumed throughout this chapter when not explicitly mentioned.

Encryption

In the context of e-mail security, encryption exists for the purpose of protecting the contents of messages, including attachments. When an e-mail message is encrypted, its contents are scrambled so that they cannot be read until the correct decryption key is applied.

To send an encrypted e-mail message, the sender must have a copy of the recipient's public key on her computer. If the recipient's public key is present, the sender simply composes the e-mail message as she normally would, and then selects an option in her e-mail client program to encrypt the message. The message (including any attachments) is then securely encrypted and forwarded to the intended recipient.

When the recipient receives the message and tries to open it, her own private key is applied to the message in an attempt to decrypt it. Assuming that the correct private key is present on her computer, the message is decrypted and displayed in the same manner as any other unsecured e-mail message.

It's important to remember that you can only send an encrypted message to another user if you have a copy of the person's public key. On Windows Vista e-mail client software packages like Windows Mail, your personal e-mail certificate is automatically attached to all e-mail messages that you digitally sign, and your public key is included in the certificate. So, if you want another user to be able to send encrypted messages to you, send them a digitally signed message - this effectively provides them with the required copy of your public key. If you want to send other users encrypted messages, have them send a digitally signed message to you.

Tip

If you're interested in the finer details of how different cryptographic systems work, check out the excellent multi-part Cryptography FAQ at http://www.faqs.org/faqs/cryptography-faq/.

Digital Signatures and Encryption in Action

The processes by which e-mail messages are digitally signed and encrypted is best illustrated with an example. The following steps outline a situation where two users - Dan and Jessica - want to engage in secure e-mail exchanges using encryption and digital signatures:

  1. Both Dan and Jessica register for and install personal e-mail certificates from the CA of their choice.

  2. Dan wants Jessica to encrypt all e-mail messages that she sends him. Dan knows that Jessica needs his public key to do this, so he sends her a digitally signed e-mail message.

  3. Jessica receives the digitally signed e-mail message, which includes an attached copy of Dan's personal certificate and public key. Her e-mail program uses Dan's public key to decrypt the hashed signature included with the message, and verify that the message was not altered in transit.

  4. Jessica then composes a new e-mail message to Dan, and attaches pictures from her last vacation. Before sending the message, she selects the option to encrypt it. Her e-mail program uses Dan's public key to encrypt the message (including attachments), and then sends it off.

  5. Dan receives the encrypted e-mail message from Jessica. His e-mail program applies his private key to the message to decrypt its contents. The message is decrypted, and Dan can now read its contents and open the pictures attached to the message.

In this example, Jessica can send Dan encrypted e-mail messages because she has a copy of his public key. If Dan wanted to send encrypted e-mail messages back to Jessica, he would need a copy of her public key first. The easiest way for Jessica to provide Dan with her public key would be for her to send him a digitally signed e-mail message.

Tip

For secure e-mail to be truly effective, both parties engaged in a communication process must have their own personal e-mail certificates installed. Although you can't force anyone into obtaining a certificate, you can get the ball rolling by installing one of your own. If you begin digitally signing your e-mail messages and asking others to encrypt all messages they send to you, there's a better chance that they'll take an interest and obtain a personal e-mail certificate also.


Obtaining, Installing, and Managing Digital Certificates

Before you can take advantage of e-mail security features, you need to obtain and install a personal e-mail certificate. In this section you'll learn more about the registration process associated with requesting a certificate, how certificates are installed, and how certificate-related management tasks are accomplished with the Windows Vista Certificates MMC snap-in.

Obtaining and Installing a Personal Digital Certificate

The first step in obtaining your own personal e-mail certificate is to register for one with a CA. Although some CAs charge a yearly fee for this service, it is possible to obtain a certificate for free from a number of different sources.

Thawte is an example of a CA that offers free personal e-mail certificates. These free certificates identify you as a Thawte Freemail Member (rather than by your real name), and include your e-mail address as identification. In other worlds, no real process is undertaken to verify your true identity. Thawte simply verifies that your e-mail address is valid, and then lists this address in the certificate's Subject field.

Although a free personal certificate will not include your actual name, it does provide the same digital signing and encryption capabilities as paid certificates. In other words, you won't find functionality lacking as a result of going the free route.

The following CAs offer free digital IDs for the purpose of securing e-mail communications:

  • Thawte (http://www.thawte.com/secure-e-mail/personal-e-mail-certificates/index.html)

  • Comodo (http://www.comodogroup.com/products/certificate_services/e-mail_certificate.html)

  • ipsCA (http://www.certs.ipsca.com/Products/SMIME.asp)

  • TC TrustCenter (http://www.trustcenter.de/en/produkte/my_certificate_express.htm)

  • CAcert (http://www.cacert.org)

After you've completed the certificate registration process it can take anywhere from a few minutes to a few days before your certificate is issued and ready to install. This time period depends upon how busy the CA is (obviously issuing free certificates is a somewhat lower priority for a commercial organization), but also relates the CA's processes for verifying your identity. In the case of free personal certificates, the validation process is usually completed quite quickly. In the case of paid certificates being issued to military or bank personnel, for example, the validation process might take considerably longer.

The steps associated with obtaining and installing your personal digital certificate will vary from CA to CA. Simply follow the steps outlined on the CA's web site or in the e-mail messages it sends you to complete the process. When installed, use the details provided in the following sections to manage your certificate and send encrypted/digitally signed e-mail messages.

Managing a Personal Digital Certificate

On a Windows Vista system, certificates are managed using the Certificates MMC. This snap-in enables you to import, export, view, and delete certificates as necessary.

Follow these steps to review your new personal e-mail certificate in the Certificates MMC:

  1. Click Start. Type certmgr.msc in the Search box and press Enter.

  2. When the User Account Control dialog box appears, click Continue.

  3. In the MMC window, expand Certificates → Personal → Certificates, as shown in Figure 12-1.

    Image from book
    Figure 12-1: Viewing the contents of your personal certificate store.

  4. Double-click your certificate to view it, as shown in Figure 12-2.

    Image from book
    Figure 12-2: Viewing your personal e-mail certificate.

  5. Click the Details tab to view the settings associated with the certificate (Figure 12-3).

    Image from book
    Figure 12-3: The Details tab for a personal e-mail certificate.

  6. Click OK to close the certificate.

Most users will have very limited interaction with the Certificates MMC. However, this tool is the primary interface via which existing certificates can be imported and exported. If you plan on sending and receiving secured e-mail messages from multiple computers, or if you're planning to upgrade to a new PC, your personal e-mail certificate should come for the ride. If this certificate (and especially its private key) is not moved to your new system, you will not be able to open existing encrypted files, nor digitally sign new messages.

Even in cases where you do not need to move your personal certificate to a different computer, you should still take the time to export it (along with your private key) for backup purposes.

Follow these steps to export your personal certificate, including your private key:

  1. If necessary, open the Certificates MMC snap-in as outlined previously.

  2. Expand Certificates → Personal → Certificates.

  3. Right-click your certificate, and select All Tasks → Export.

  4. When the Certificate Export Wizard welcome screen appears, click Next.

  5. At the Export Private Key screen, click Yes, export the private key, and click Next.

  6. At the Export File Format screen, ensure that the Export All Extended Properties option is selected as shown in Figure 12-4. Click Next.

    Image from book
    Figure 12-4: Exporting your certificate, including your private key.

  7. At the Password screen, enter and confirm a strong password that will be used to protect your private key. Click Next.

  8. At the File To Export screen, enter an appropriate and recognizable name and folder location to store your certificate, as shown in Figure 12-5. Click Next.

    Image from book
    Figure 12-5: Select a storage location and file name for your exported certificate.

  9. Click Finish. When the Exporting Your Private Exchange Key window appears, click OK.

  10. At the Certificate Export Wizard dialog box, click OK.

  11. As a final step, burn your exported certificate to a CD or removable disk, and store it in a safe place.

Note

To import your certificate on another computer, open the Certificates MMC on that system, expand Certificates → Personal, right-click the Certificates folder, and select All Tasks → Import. The Certificate Import Wizard walks you through the process of adding your existing personal certificate to the new computer.
Image from book
Revoking Certificates

Because it is possible for certificates and their private keys to be compromised, lost, or stolen, public key systems include a process to revoke certificates. When an e-mail certificate is revoked, it is no longer considered to be valid for the purpose of digitally signing or encrypting messages.

To revoke a certificate, you typically need to contact the issuing CA to have it added to what is known as a certificate revocation list (CRL). All CAs maintain a list of revoked certificates that can be checked by client e-mail programs to determine a certificate's validity.

To revoke your certificate, log on to the CA's web site using the account you created during the original certificate request process. Find the option that enables you to revoke your certificate, and then follow the instruction to complete the process.

It's important to note that after a certificate is revoked, it is no longer valid and cannot be revived. As such, you would need to request and install a replacement certificate, and then send a copy of this new certificate to all users with whom you engage in secure e-mail correspondence.

Image from book


Signing and Encrypting E-mail Messages

When your personal certificate is installed, it's time to get down to the business of securing your e-mail messages by using encryption and digital signatures. In this section you'll learn more about sending and receiving digital signed and encrypted e-mail message using the Windows Vista native e-mail software, Windows Mail.

Note

The steps to digitally sign and encrypt e-mail messages outlined in this section assume that you're using Windows Mail as your e-mail client. For details on completing these tasks with Microsoft Outlook or other e-mail clients, consult that program's Help file.

Sending and Receiving Signed E-mail Messages

As you now know, digitally signing e-mail messages both verifies the sender's identity and helps to ensure message integrity. Thankfully, after your personal e-mail certificate is installed, sending signed e-mail messages and verifying the signatures on messages you receive is exceptionally simple.

Follow these steps to read and verify the signature associated with a signed e-mail message received from another user:

  1. Open Windows Mail and look for a digitally signed e-mail message. The icon for signed messages in Windows Mail looks like an envelope with a seal attached.

  2. Open the signed e-mail message. The Security Help screen appears by default when you open a signed message, as shown in Figure 12-6.

    Image from book
    Figure 12-6: The Security Help screen appears when you open a digitally signed message in Windows Mail.

  3. Click the Continue button. The contents of the message now appear like any unsigned e-mail message.

  4. Click the seal icon in the top right-hand corner of the message. This opens the Security tab for the message, as shown in Figure 12-7. Notice that the e-mail address associated with the signature is displayed, along with messages stating that the contents of the message are unaltered, and that the signature is trusted.

    Image from book
    Figure 12-7: The Security tab displays details associated with a digitally signed message.

  5. Click View Certificates.

  6. In the View Certificates window (see Figure 12-8), you can view the certificate used to sign this message (the sender's certificate), as well as add the sender's certificate to their entry in your Contacts list. Click Add To Contacts.

    Image from book
    Figure 12-8: Use the View Certificates window to view the certificate used to digitally sign a message, or add the user's certificate to your Contacts list.

  7. When the Windows Mail dialog box appears, confirming that the certificate was added to the user's Contacts entry, click OK.

  8. Click OK to close the View Certificates and message detail windows.

  9. In the main Windows Mail program window, select Tools → Windows Contacts.

  10. Double-click on the entry for the user whose certificate you added in Step 6.

  11. Click the IDs tab, shown in Figure 12-9. With the recipient's digital certificate stored on your system, you can now send this user encrypted e-mail messages.

    Image from book
    Figure 12-9: The Digital IDs tab in a user's address book entry displays certificates associated with that user.

Caution

Most web-based e-mail services (such as those offered by MSN Hotmail, Yahoo! Mail, and Google's Gmail) are not capable of sending and receiving digitally signed and encrypted e-mail messages due to a lack of support for the S/MIME protocol. As such, you shouldn't expect web mail users to be able to read signed or encrypted messages you send them. When in doubt, send them a digitally signed test message, and have them respond if they can open and read the message correctly. Alternatively, ask them to use an S/MIME-compliant e-mail client like Windows Mail for the purpose of engaging in secure message exchanges.

Follow these steps to digitally sign an e-mail message you are sending to another user:

  1. Open Windows Mail and click Create Mail.

  2. Compose the e-mail message as you normally would, complete with the recipient's e-mail address and a suitable subject line.

  3. In the message window, select Tools → Digitally Sign, as shown in Figure 12-10. The seal icon is added to the upper-right corner of the message window.

    Image from book
    Figure 12-10: A digitally signed message.

  4. Click the Send button.

  5. When the Signing data with your private exchange key window appears (Figure 12-11), click OK. The signed message is sent to the recipient, including a copy of your certificate and public key.

    Image from book
    Figure 12-11: This dialog box is displayed when your private key is being accessed.

Sending and Receiving Encrypted E-mail Messages

In a manner similar to working with digital signatures, it's easy to decrypt encrypted messages that you receive, or send encrypted messages to other users. Remember that to send encrypted messages to others, you need to have a copy of their public keys (included in their personal certificate) available on the computer from which you're sending the message.

Follow these steps to read an encrypted message received from another user:

  1. Open Windows Mail and look for an encrypted e-mail message. The icon for encrypted messages in Windows Mail looks like an envelope with a blue lock attached.

  2. When the Using Your Private Key To Decrypt Message dialog box appears, click OK.

  3. Open the encrypted e-mail message. The Security Help screen appears by default when you open an encrypted message, as shown in Figure 12-12.

    Image from book
    Figure 12-12: This Security Help message appears when you open an encrypted message.

  4. Click the Continue button. The contents of the message now appear like any unencrypted e-mail message.

  5. Click the lock icon in the top right corner of the message to open the Security tab for the message, shown in Figure 12-13. Notice that the Encryption section lists the message as having been encrypted.

    Image from book
    Figure 12-13: The Security tab for an encrypted message.

  6. Click the View Certificates button.

  7. In the View Certificates window, click the Encryption Certificate button.

  8. At the bottom of the General tab is a message stating that you have a private key that corresponds to this message (see Figure 12-14). Ultimately, this means that your public key was used to encrypt the message.

    Image from book
    Figure 12-14: Viewing the certificate that was used to encrypt a message.

Image from book
Windows Mail Security Options

If you don't want to go through the hassles of manually encrypting and signing every e-mail message that you send, Windows Mail makes it possible to have all messages digitally signed and/or encrypted by default.

To enable these settings, open Windows Mail and select Tools → Options → Security. At the bottom of the Security tab you'll find check boxes marked Encrypt Contents And Attachments For All Outgoing Messages and Digitally Sign All Outgoing Messages, as shown in the following figure.

Image from book

As a general rule, select the option to Digitally Sign All Outgoing Messages Only. If you select the option to Encrypt All Messages, you'll receive error messages every time you attempt to send a message to a user whose public key is not present on your system. Based on that, it's better to encrypt e-mail messages on a case-by-case basis.

In addition to these settings, the Security tab in Windows Mail includes an Advanced button that opens the Advanced Security Settings window, as shown in the following figure.

Image from book

Options on the Advanced Security Screen include:

  • Warn on encrypting messages with less than this strength. This drop-down menu lets you specify the minimum strength level associated with encrypted messages you send. When a sender's public key specifies a less strength, Windows Mail will prompt you with a warning message.

  • Always encrypt to myself when sending encrypted mail. When this option is selected, messages that you send to others are also encrypted with your public key, ensuring that you can open and read your stored copies of the message, for example those in your Sent Items folder. If deselected, you will not be able to read encrypted messages that you've sent to other users, since only their public key was used to encrypt the message.

  • Include my digital ID when sending signed messages. As its name suggests, this option automatically adds your certificate (and public key) to all signed messages you send.

  • Encode message before signing (opaque signing). If this option is selected, a recipient will only be able to read your message if they're using an S/MIME-compliant e-mail system that can verify your signature. If you select this option and the user is using a non-S/MIME e-mail client, they will not be able to read the message, even though it is not encrypted.

  • Add senders' certificates to my Windows Contacts. When this option is selected, Windows Mail will automatically add the certificates associated with signed messages you receive to your address book.

  • Check for revoked Digital IDs. When this option is set to Only When Online, Windows Mail automatically checks to ensure that all certificates being used are valid, and have not been revoked.

For users working with Microsoft Outlook, similar advanced message security settings can be found under Tools → Options → Security → Settings.

Image from book

Follow these steps to encrypt an e-mail message you are sending to another user:

  1. Open Windows Mail and click Create Mail.

  2. Compose the e-mail message as you normally would, complete with the recipient's e-mail address and a suitable subject line.

  3. In the message window, select Tools → Encrypt, as shown in Figure 12-15. The blue lock icon is added to the upper right corner of the message window.

    Image from book
    Figure 12-15: An encrypted e-mail message.

  4. Click the Send button. The message is encrypted with the recipient's public key, and then sent like any other e-mail message.

Digitally signing and encrypting messages are separate and distinct processes that use different keys. However, there's nothing stopping you from digitally signing and encrypting the same message - in fact, it's a great idea. By encrypting a message with the recipient's public key, you ensure that its contents are securely protected and inaccessible by everyone except the recipient. By digitally signing the same message with your private key, the recipient can verify that the message actually came from you, and was not altered in transit.


Secure E-mail Alternatives

As noted at the beginning of the chapter, a number of different e-mail techniques exist for the purpose of purpose of securing e-mail messages. Most of the popular methods rely on public key cryptography, which has proven to be a very secure and effective method when used correctly. Unfortunately, public key systems also suffer from two fundamental problems. First, a user needs to have at least a basic understanding of the purpose of certificates and public/private keys, as well as why encryption and digital signatures are important. Second, the same user needs to figure out how to get the whole system up and running correctly, including the processes by which certificates are obtained, installed, and ultimately used. In a nutshell, using public key cryptography to secure e-mail communications is a great idea, but understanding its underlying theories and processes is often too much to ask of inexperienced users.

With the complexity of traditional public key systems in mind, a number of different e-mail security products and services have been developed as alternatives. Some of the more popular methods include the following:

  • Pretty Good Privacy (PGP), a public key system that functions in a manner similar to S/MIME, but relies on user-created certificates and key pairs rather than those created by a CA. PGP is a very popular secure e-mail alternative that uses a web-of-trust model to verify user identities - in effect, users sign each other's keys as a way to promote and generate trust in the system. The ideas behind PGP have spawned work on a proposed Internet standard known as OpenPGP. Unfortunately, while both S/MIME-and PGP-based public key systems offer fundamentally similar levels of e-mail security, the two methods are not interoperable. For more information on PGP, visit http://www.pgp.com. For details on OpenPGP, visit http://www.openpgp.org.

  • Secure e-mail services, a broad group of e-mail providers that offer secure messaging services. Some secure e-mail providers offer a webmail-style product, while others protect messages using different security plug-ins for e-mail clients like Outlook and Windows Mail. The encryption and authentication techniques used by these providers vary widely, ranging from certificate-based systems to password-based encryption and signing. Some of the more popular secure e-mail service providers include Hushmail (http://www.hushmail.com), S-Mail (http://www.s-mail.com), and Stealth Message (http://www.stealthmessage.com).

  • Secure e-mail programs, another broad group of dedicated security programs designed to help users easily secure their e-mail messages. An example of one such program is Steganos E-mail Encryption, part of the Steganos Security Suite. This tool creates encrypted e-mail messages that can be added to normal e-mail messages as a password-protected ZIP or CAB file. In this case, the recipient must know the password used to decrypt the message and read its contents. To learn more about Steganos Security Suite, visit http://www.steganos.com.


Summary

E-mail-based communications are not secure by default. When not properly secured by way of techniques like public key cryptography, messages can potentially be read, deleted, and modified by other users, and the identity of senders can easily be falsified. As such, e-mail security techniques like encryption and digital signatures should always be used to protect message contents and verify the identities of message senders. Keep the following points in mind when it comes to e-mail security:

  • Obtain and install a personal e-mail certificate.

  • Encrypt all sensitive messages using the recipient's public key.

  • Digitally sign all e-mail messages you send to prove your identity (and distribute your certificate and public key) to users you correspond with.

  • Always ensure that your private key is suitably protected.

  • Create and securely store a backup of your personal certificate and private key.

  • In cases where using a CA-based public key cryptographic system isn't viable, consider using alternative methods (like PGP) to protect your e-mail correspondence.


Part V: Protecting Your Files

Chapter List

Chapter 13: Controlling Access to Your Personal Files
Chapter 14: Improving File Security Using Encryption
Chapter 15: Erasing Files and Hard Drives Securely


Chapter 13: Controlling Access to Your Personal Files

Windows Vista is absolutely loaded with features, but its capability to function as a true multi-user operating system is among the most useful. As the Windows Vista system's owner, you can configure critical security settings in a centralized manner, while individual users can customize their working environment in a way not unlike having their own PCs. Perhaps the best part is that you can share resources like files, printers, and even Internet access with all users.

For all the benefits that sharing resources provides, however, individual users still value their privacy, especially when it comes to their personal files. Nobody likes the idea of having others root through his belongings, be they the contents of a closet or his Documents folder.

Thankfully, implementing some security privacy for your personal files and folders isn't terribly difficult. Windows Vista includes support for a file system that's all about privacy, allowing you to control whether certain users and groups can open, edit, and even delete your files and folders. Its name is NTFS, and if you're serious about security and privacy, then it's the file system that you want to use. Quite simply, if you opt to use any other file system, you're opting for no file system security at all.

In this chapter, you learn more about the NTFS file system, including how to configure permission settings to control access to your personal files and folders. The chapter explores two different techniques; the first is best suited to general users, although the second puts more power into the hands of those with a need for greater flexibility and control over the security of their Windows Vista system. Regardless of the method you choose to work with, configuring NTFS permissions is all about ensuring that you're in control of your personal files, and that you call the shots when it comes to how (or even if) other users are allowed to interact with your files.

Understanding File System Security

To store files on a computer's hard disk, the disk must first be divided into one or more formatted drives (often referred to as volumes or partitions), such as the familiar Drive C. As part of formatting a drive to store data you need to choose a file system, and Windows Vista supports three different file system options - FAT, FAT32, and NTFS.

Differences between FAT, FAT32, and NTFS

Both FAT and FAT32 are considered legacy file systems, born in the days of older operating systems like DOS and Windows 95. With the release of its Windows NT operating system, many years ago, Microsoft introduced a new file system into the mix - NTFS. The NTFS file system brought with it many advancements, including support for larger drive sizes and more efficient use of disk space. The most important feature included with NTFS, however, was its support for configuring files and folders with different security permissions, giving users a greater degree of control over who could access their files, and to what extent. For example, you could use NTFS permissions to allow all users to read your personal files, but not change them. Alternatively, you could grant some users full control over the files within a certain folder while denying all other users access the folder completely.

Ultimately, if you want to ensure that you secure your Windows Vista system to the greatest extent possible, you're well advised to make sure that you format any and all drives on your hard disk with the NTFS file system. The good news is that NTFS is the primary option for formatting drives on a Windows Vista system, and is selected by default (unless otherwise specified) during the operating system installation process. In other words, your Windows Vista system's drives are likely already formatted with the NTFS file system.

Follow these steps to determine which file systems are in use by drives on your Windows Vista system:

  1. Select Start → Computer.

  2. Right-click a drive letter (such as C:) and then select Properties. The General tab in the Properties window displays the file system that the drive uses, as shown in Figure 13-1.

    Image from book
    Figure 13-1: Reviewing a drive's file system.

If your Windows Vista system's drives are already using the NTFS file system, then you're good to go on the file system front. If you find drives formatted with the FAT or FAT32 file systems, however, it's important to understand that these drives offer nothing in the way of file security capabilities.

Thankfully, Windows Vista offers a way to convert existing drives from the FAT or FAT32 file systems to NTFS without the need to format (and thus delete all files stored on) the drives. You can use a command-line utility known as CONVERT.EXE to change a FAT or FAT32 drive to NTFS, enabling you to take advantage of security permissions on existing files and folders per your needs.

Caution

Converting a drive from the FAT or FAT32 file system to NTFS is a one-way process. You cannot convert an NTFS-formatted drive to the FAT or FAT32 file systems for security reasons (because any previously-configured permissions would be unsupported, and thus lost). The only way to switch an NTFS drive to FAT or FAT32 is to reformat the drive, in which case all files stored on the drive are deleted.

Converting FAT or FAT32 to NTFS

Follow these steps to convert a drive using the FAT or FAT32 file system to NTFS:

  1. Select Start → All Programs → Accessories. Right-click Command Prompt and select Run As Administrator.

  2. At the command line, type convert i: /fs:ntfs. In this example, drive I: is converted from the FAT or FAT32 file system to NTFS. Specify the letter for the drive you want to convert, and then press Enter. When prompted, enter the volume label for the drive (typically NEW VOLUME or Local Disk by default) and press Enter.

  3. If you are asked whether you want to force a dismount of the volume, press Y (for Yes) and then press Enter. The conversion process may take anywhere from a few seconds to a few minutes to complete, depending upon the size of the drive and number of files it contains.

  4. In some cases, you're prompted to restart Windows Vista to complete the conversion process. When finished, the Conversion Complete message appears, as shown in Figure 13-2.

    Image from book
    Figure 13-2: Converting a drive to NTFS.

Caution

As a precaution, always back up any and all critical personal files prior to attempting to convert a drive from FAT or FAT32 to NTFS. If something goes awry during the conversion process, there is a slim possibility that you could lose access to portions (or all) of the drive you are converting.

When your Windows Vista system includes one or more drives formatted with the NTFS file system, you can get down to the business of securing individual files and folders with permissions. On a Windows Vista Home Basic or Home Premium system, each user's personal Documents folder hierarchy is protected by default, with special folders provided for the purpose of sharing files between users. On Windows Vista Business, Enterprise, and Ultimate systems, you can also configure permissions manually to provide a greater (and more granular) level of control over which users can access files and folders, and to what extent. Both methods of securing (and sharing) files and folders are explored in the following sections.


Using Personal and Public Folders

In the interest of making the implementation of NTFS security permissions as easy as possible for most users, Windows Vista includes a new feature known as Public folders. Public folders act as a folder hierarchy designed to facilitate file sharing between users on a multi-user Windows Vista system. The basic idea is that when users want to keep files personal and private, they should store those files within the Documents folder associated with their user account. You should store files that you want to share between users in Public folders. That's really all there is to it - by default, users only have access to their own Documents folder, and not those belonging to other users. When the NTFS file system is in use and one user tries to open the Documents folder belonging to another user, the result is an access denied message. This simplified method of ensuring that personal files remain private is generally the best choice for any multi-user Windows Vista system, especially in home and small office environments.

If every person who uses your Windows Vista system has their own user account, logging on with it will provide access to his or her own personal Documents folder hierarchy. Windows Vista protects this folder - and all folders and files it contains - by granting the user full control over its entire contents. In this way, the user can add, remove, delete, and edit any files stored in his personal space. If a user attempts to open another's Documents folder, access is denied. For all intents and purposes, a user's Documents folder is a personal storage location for his use only.

Note

Although the Documents folder associated with your user account is secured for your use only, any user with an Administrator account can access it. For added security and privacy, you may want to consider using file encryption to make sensitive personal files private, as explained in Chapter 14.

Of course, you may have times when users on the same Windows Vista system want to share files with one another. Perhaps everyone wants to access the family MP3 collection, or digital photos from a recent vacation. If these files are stored in one user's Documents folder, they become inaccessible to other users by default. Instead of requiring you to wrestle with permission settings to grant other users access to the files you want to share, Windows Vista solves the problem through the use of Public folders. Anyone with a user account on the computer can gain access files you save into the Public folder (or any of its sub-folders) without issue.

For added convenience, Windows Vista pre-creates a number of sub-folders within the Public folder. On a Windows Vista Ultimate system, these include Public Documents, Public Downloads, Public Music, Public Pictures, Public Videos, and Recorded TV. The Public folders available on your edition of Windows Vista may differ, but you can create additional folders in this hierarchy as your needs dictate.

Using the Public folder couldn't be easier. Instead of saving files to your own Documents folder, you just save them to the Public folder. By default, the Public folder hierarchy is only accessible to local users with a user account on your Windows Vista system. You can share the Public folder with network users as well, but doing so requires configuration changes as outlined in Chapter 16. If you want to ensure that a file remains private, save it in your own Documents folder rather than in the Public folder hierarchy.

To make files accessible to all users, move shared files into the Public folder hierarchy (using techniques like cut-and-paste), or save files into the Public folder or one of its subfolders. To access the Public folder hierarchy, select Start → Computer, click the Folders shortcut in the lower-left corner, and then click Public. The Public folder hierarchy on a Windows Vista Ultimate system is shown in Figure 13-3.

Image from book
Figure 13-3: The Public folder hierarchy.


Configuring File and Folder Security Settings Manually

If you need or want more flexibility in how NTFS security permissions are applied, you need to be running Windows Vista Business, Enterprise, or Ultimate edition. Only these editions enable you to configure NTFS permissions in a more granular and manual fashion - literally by specifying exactly which users or groups should have access to a particular folder, and to what degree. Windows Vista Home Basic and Home Premium editions don't allow you to configure NTFS security permissions in this way.

If you are running a non-Home version of Windows Vista, two broad categories of NTFS permissions exist - those that are allowed, and those that are denied. When a particular permission is allowed, a user or group can perform the actions associated with the permission. When a specific permission is denied, the user or group cannot perform its associated actions. So, if the Administrators group is allowed Full Control over a file, and one specific user (who is also an Administrator) is explicitly denied access to the same file, all Administrators would have full control over the file, with the exception of the one user who was denied - denied permissions always trump allowed permissions.

When you open the Security tab in the properties of a file stored on an NTFS drive, you can allow or deny a number of different permissions. The following list outlines (and explains capabilities associated with) the NTFS permissions that you can assign to users and groups for a file.

  • Read. The Read permission allows users to open and view files, as well as the permissions, attributes, and ownership information associated with a file.

  • Write. The Write permission allows a user to change the contents of a file and its attributes.

  • Read & Execute. The Read & Execute permission allows users to run executable files (such as programs) and perform actions allowed by the Read permission.

  • Modify. The Modify permission allows user to modify the contents of a file or even delete it, as well as perform the actions allowed by the Read, Read & Execute, and Write permissions.

  • Full Control. The Full Control permission gives users complete control over a file including the ability to change its attributes, permissions, and even ownership details.

Note

In addition to the standard NTFS file permissions in the preceding list, you can apply a number of special NTFS permissions that provide for an even more granular level of control over what users can and cannot do to a file stored on an NTFS drive. For example, the Read Permissions special permission allows a user to view the permissions configured for a file or folder, but nothing more. As a general rule, you'll seldom (if ever) need to configure special NTFS permissions. If you're curious about these permissions, however, you can view them by clicking the Advanced button on the Security tab, selecting a permission entry on the list, and then clicking Edit. As with files, special permissions can also be configured for folders.

Follow these steps to configure NTFS permission settings:

  1. Select Start → Computer.

  2. Browse to the file for which you want to configure NTFS security permissions. Right-click the file and select Properties.

  3. Click the Security tab. A list of the permissions currently assigned to different users and groups displays, as shown in Figure 13-4.

    Image from book
    Figure 13-4: Reviewing the NTFS permissions associated with a file.

    Note

    When the permission entries associated with a file or folder are grayed out and cannot be changed, it means that they have been inherited from a parent object. For example, if you find the permission entries grayed out on the Security tab in the properties of a file, it means that permissions have actually been configured at a higher folder level.

  4. Click the Edit button, and then click the Add button. In the Select Users Or Groups window, type the name of the user or group for which you want to configure NTFS security permissions for the file, and then click OK.

  5. On the Security tab, ensure that the user or group added in the previous step is selected, and then select the check box next to the NTFS security permission that you want to grant.

  6. Click OK to apply the new permissions.

Caution

Never change the NTFS permissions associated with system-related files or folders because doing so may render your system unstable or unable to boot. Never make changes to include the root of drives (for example changing permissions on the Security tab for your C: drive), or the Windows, Documents And Settings, and Program Files folders. As a general rule, you should only change NTFS permissions on files or folders that you create.

The ability to configure NTFS permissions on individual files is handy, but if you ever need to change the permissions assigned to more than a few files, the process can be cumbersome. Thankfully, a quicker method of assigning permissions exists - when you assign NTFS permissions on the Security tab of a folder, those same permissions apply to any files and sub-folders it contains by default.

The NTFS permissions that you can apply to folders are slightly different than those associated with files, simply because files and folders are fundamentally different. The following list outlines (and explains capabilities associated with) the NTFS permissions that you can assign to users and groups for a folder.

  • Read. Allows users to view files and subfolders stored within a folder, as well as details like the folder's attributes, permissions, and ownership information.

  • Write. Enables users to add files or subfolders to a folder, change folder attributes, and view permission and ownership information.

  • List Folder Contents. Allows users to view the contents of folders and subfolders.

  • Read & Execute. Enables users to browse through a folder, even if they don't have other permissions for the folder. Additionally, it allows users to perform actions allowed by the Read and List Folder Contents permissions.

  • Modify. Allows users to delete a folder, as well as perform actions allowed by the Read, Write, and Read & Execute permissions.

  • Full Control. Gives users complete control over a folder including changing its attributes, permissions, and even ownership details.

Follow these steps to configure permission settings on a folder:

  1. Select Start → Computer.

  2. Browse to the folder for which you want to configure NTFS security permissions. Right-click the folder and select Properties.

  3. Click the Security tab. A list of the permissions currently assigned to different users and groups displays, as shown in Figure 13-5.

    Image from book
    Figure 13-5: Reviewing the NTFS permissions associated with a folder.

  4. Click the Edit button, and then click the Add button. In the Select Users Or Groups window, type the name of the user or group for which you want to configure NTFS security permissions for the folder, and then click OK.

  5. On the Security tab, ensure that the user or group added in the previous step is selected, and then select the check box next to the NTFS security permission that you want to grant.

  6. Click OK to apply the new permissions.

As a general rule, follow the principle of least privilege when assigning users or groups NTFS permissions on files or folders. That principle dictates that you only grant users the absolute minimum level of access that they require, and nothing more. So, if you want a user to view, but not change a file, grant them the NTFS Allow Read permission, rather than something less restrictive like Modify or Full Control. From a security perspective, less is always more when assigning NTFS permissions.

Note

When you configure NTFS security permissions on a folder, all files within that folder (and any subfolders) inherit the new permission settings automatically. You can change the behavior of permission inheritance by clicking the Advanced button on the Security tab in the properties of a folder, double-clicking a permission entry, and then selecting a different option from the Apply Onto drop-down menu.


Summary

Selecting the right file system and then configuring the drives on your Windows Vista system with the necessary permission settings is an important part of keeping your personal files safe, secure, and private. Keep the following points in mind when configuring security settings to control access to your personal files and folders:

  • NTFS is the most secure file system choice for Windows Vista systems. If your system's drives are formatted with the FAT or FAT32 file systems, consider converting them to NTFS.

  • Keep personal files more secure and private by storing them in your personal Documents folder. You should store files you want to share with all other users in the Public folder hierarchy.

  • Always follow the principle of least privilege when assigning NTFS permissions - never grant any user or group a greater degree of control over files and folders than they require.

  • NTFS permissions are not infallible - although they can help to secure and protect your personal files, Administrators can always take ownership of folders and change their NTFS permissions to grant themselves access. For complete file and folder protection, encryption is always the best option.


Chapter 14: Improving File Security Using Encryption

Dealing with the aftermath of a lost or stolen computer is never a pleasant experience. Although the initial sting may relate to the financial costs associated with losing your expensive hardware, the real pain sets in when you consider the loss of your personal files. Even if you've been diligent about doing backups, it's now possible that somebody else has access to everything stored on your computer, from customer lists to sensitive personal correspondence.

It would be nice to think that your strong user account password and clever use of NTFS permissions will keep your data safe, but that's only the case if your computer is now in the hands of someone who is only interested in the hardware. Typically, these people format the computer's hard drive, and couldn't care less about your files. When it comes to dealing with a stolen or lost computer, this is the best-case scenario. Unfortunately, if an unscrupulous person now has access to your PC, there's a good chance that they're going to at least try mining through your data looking for information of interest. From credit card details to business information, most computers are a veritable treasure trove of useful information.

A good password and correctly applied NTFS permissions helps in the event that your computer falls into the wrong hands, but only a little. If the person in possession of your computer knows even a little about Windows Vista, they can easily remove its hard drive, install it in a computer on which they have an Administrator account, and then take ownership of all of your files - effectively giving themselves access to everything stored on the disk.

Whether you're looking for a way to securely protect your files in the event your computer is stolen, or just looking for a way to keep other users (including Administrators on the computer you use) away from your files, encryption is the answer. In this chapter, you learn more about Windows Vista's native encryption facilities, as well as third-party encryption programs.

Encryption Options

As you discovered in Chapter 12, encryption is a security feature whereby a file or e-mail message is effectively scrambled to prevent others from opening or viewing its contents. Standards like the Data Encryption Standard (DES), Triple DES (3DES), and the Advanced Encryption Standard (AES) are examples of some of the popular algorithms that securely encrypt data. Users who do not have the correct password or key cannot decrypt these protected items, ensuring that they remain for your eyes only.

When it comes to encrypting sensitive or important files on a Windows Vista system, two primary options exist. These include:

  • The Windows Vista native Encrypting File System (EFS)

  • Third-party encryption programs

The following sections explore these methods and techniques in more detail.

Encrypting File System

The Encrypting File System (EFS) feature acts as the Windows Vista native file encryption facility. Although its name makes it sound like a traditional file system in the manner of FAT, FAT32, or NTFS, EFS is not a file system that formats drives and disk partitions. Instead, it protects files stored on drives that use the NTFS file system, with encryption settings configured as file and folder attributes.

Available on computers running Windows Vista Business, Enterprise, and Ultimate Editions only, EFS encryption provides a higher level of file protection than techniques like NTFS security permissions. When you encrypt a file with EFS, only the user who encrypted the file has the ability to decrypt and view its contents by default. However, EFS in Windows Vista does allow you to share encrypted files with other users if necessary, and designate what is known as a Data Recovery Agent for cases where the user who encrypted a file cannot decrypt it, but needs to restore it.

Along with offering the highest levels of native file security on a Windows Vista system, EFS also makes the process of encrypting and decrypting files almost completely seamless. When a file is protected with EFS, encrypting and decrypting it is as simple as opening or saving any other Windows file.

Third-Party Encryption Programs

Windows Vista Home Basic and Home Premium Edition don't include the ability to securely encrypt files using EFS, but all is not lost. A variety of third-party encryption programs exist for the purpose of securing files, folders, and drives on any Windows Vista system. If you are running Windows Vista Home Basic or Home Premium Edition and want to take advantage of the high levels of file security provided by encryption, see the section on third-party encryption solutions later in this chapter.

Image from book
Traveling Lightly

Using file encryption techniques to protect files is especially useful in cases where you're worried about the possibility of your computer (especially a laptop) being lost or stolen. If you encrypt the sensitive information stored on your computer, at least your sensitive files will remain protected, even if the hardware itself is lost.

Although file encryption may seem like the ultimate file security answer, it's actually trumped by an even simpler method - not storing sensitive files on your computer at all. In cases where you don't require regular access to your important files, or can do without them on a business trip, it's much safer to simply remove them from your PC. Use external hard drives, USB flash drives, writable CD/DVDs, or other offline methods to store critical files rather than tote them with you when they're not required. When it comes to protecting your data, it's always better to be safe than sorry.

Image from book


Protecting Files with EFS

There's no denying that strong file encryption offers some of the highest levels of file security possible. However, using different encryption techniques without understanding how they work (and the precaution you need to take) can be dangerous. Begin randomly encrypting data without understanding the risks, and you can easily find yourself unable to access your own files. Encryption techniques may be designed with an eye toward keeping others from opening and viewing your files, but if used incorrectly (or flippantly), it's just as easy to lock yourself out - for good.

To use the Windows Vista EFS encryption capabilities effectively (and safely), it's important to be familiar with the following:

  • How EFS works

  • How to designate a Data Recovery Agent (DRA)

  • How to encrypt files and folders

  • How to manage EFS encryption keys

Each of these concepts and tasks are explored in more detail in the following sections.

How EFS Works

EFS works in a way that is fundamentally similar to any public key cryptographic system. When a user encrypts a file or folder for the first time, an EFS certificate is automatically created (and stored) for the person's user account, along with a public/private key pair. Although the encryption and decryption processes associated with EFS are completely transparent to users, a number of functions take place in the background.

Imagine that you create a folder under Documents called Encrypted Files. If you save a file to this location and then select the option to encrypt it, the following processes take place:

  1. Windows Vista generates a unique key to encrypt the file, known as a File Encryption Key (FEK). The FEK is fundamentally similar to the unique session key used to encrypt an e-mail message or the transfer or information between your web browser and a secure web site.

  2. After creating the unique FEK and using it to encrypt the file, Windows Vista encrypts the FEK with your public key. Once the FEK is encrypted, it is stored in the headers of the encrypted file.

When you attempt to open (decrypt) a file that was encrypted with your EFS public key, the following processes take place:

  1. Windows Vista notes that the file you are trying to open is encrypted and attempts to use your private key to decrypt the FEK.

  2. If the FEK is successfully decrypted, it is then used to decrypt and open the file.

In cases where another user has encrypted a file that you attempt to open, your private key cannot decrypt the FEK, which in turn cannot decrypt the file. Only the user who encrypted a file can decrypt and view it by default.

Caution

The encryption capabilities that EFS provides stops other users from opening and reading your protected files. However, don't overlook the importance of configuring correct NTFS permissions on encrypted files or the folders that store them. For example, if you place an EFS encrypted file in a folder where all users have the NTFS Allow Full Control permission, other users cannot decrypt and read the contents of the file, but that won't prevent them from deleting it. In cases where you need your encrypted files to be accessible to you alone, save them to a folder location that only you have access to, for example, within the hierarchy of your Documents folder. For more details on making your Documents folder private, refer to Chapter 13.

Designating a Data Recovery Agent

When you encrypt a file using EFS, you can only use your user account's private key to decrypt the FEK stored with the file by default. If you ever lose or change the private key, you will not be able to decrypt the FEK, and therefore will not be able to decrypt and open the file.

Although backing up your EFS certificate and private key is a great way to help ensure that you can access EFS encrypted files should a problem occur, also consider assigning to at least one user the role of Data Recovery Agent (DRA).

In simple terms, a DRA is a user account (usually an Administrator) who can decrypt and restore EFS encrypted files, should the need arise. When a DRA exists, this user account's private key is also used to encrypt a copy of each file's FEK. Ultimately, this means that both the user who encrypts a file and the DRA can decrypt the file if necessary. For example, if you encrypt a file and your private key is subsequently lost or destroyed, the user designated as the DRA can always log on and decrypt the file, ensuring that access to it is not lost for good.

Designating a user account as the DRA for your Windows Vista system is always a good idea and considered a best practice. Although the chances of you losing or destroying your private key may be small, other problems can occur when you use EFS encryption. For example, if an Administrator were to reset or change your password, you would automatically lose access to all of your EFS encrypted files. This is a security feature that helps to ensure that an Administrator cannot change your password and log on with your account to open and view your encrypted files. If this was to happen and a DRA were not designated, you would lose access to your encrypted files. If a DRA were designated, however, this user account would be able to log on and restore your encrypted files.

Windows Vista does not designate a DRA by default, so it's up to you to select a user account for this purpose. Instead of using an existing user account as a DRA, you may want to consider creating an Administrator account dedicated to the task, and then log on with this account only when you need to decrypt and restore an EFS encrypted file. As always, the DRA user account should be assigned a strong password.

Cross Reference

For details on creating strong passwords, refer to Chapter 3.

Designating a DRA is a two-step process. First, you need to log on with the user account that acts as the DRA and generates a recovery certificate. When complete, you use the Local Security Policy MMC to add the DRA certificate to your Windows Vista system's public key policy.

Follow these steps to create an EFS certificate to designate the user account as the Data Recovery Agent:

  1. Log on to Windows Vista using the user account that will act as your EFS Data Recovery Agent.

  2. Select Start → All Programs → Accessories → Command Prompt.

  3. Type cipher /R:recoverycert and press Enter.

  4. When prompted, type a strong password to protect the Data Recovery Agent's private key and press Enter.

  5. Type the password again to confirm it, and press Enter. The certificate for the Data Recovery Agent is generated, as shown in Figure 14-1. Close the Command Prompt window.

    Image from book
    Figure 14-1: Creating a certificate for a Data Recovery Agent with the Cipher command.

Follow these steps to add the DRA certificate to your Windows Vista system's public key policy:

  1. Select Start → Control Panel → Administrative Tools → Local Security Policy.

  2. Expand Public Key Policies.

  3. Right-click the Encrypting File System folder and select Add Data Recovery Agent.

  4. On the Add Recovery Agent Wizard welcome screen, click Next.

  5. On the Select Recovery Agents screen, click Browse Folders. Browse to the recoverycert.pfx file created in the previous exercise, and then click Open. At the Add Recovery Agent window, click Yes. Your Data Recovery Agent user account is now listed as shown in Figure 14-2. Click Next.

    Image from book
    Figure 14-2: Selecting a Data Recovery Agent.

  6. Click Finish to complete the process. The certificate of this user account is now listed in the Encrypting File System folder, as shown in Figure 14-3. This user will now be able to open and recover all EFS encrypted files, including those encrypted by other users.

    Image from book
    Figure 14-3: Viewing Data Recovery Agents in EFS Public Key Policy.

Encrypting Files and Folders

EFS encrypts and decrypts files in a completely transparent manner. When your user account encrypts a file, decrypting it is as simple as opening the file. Similarly, you can re-encrypt an open file that you've changed by saving it as you would any file.

Windows Vista enables you to encrypt files stored on drives that use the NTFS file system, with the exception of operating system files. Although you can encrypt files individually, an easier way to work with EFS is to set the encryption attribute on a folder instead. When you set the encryption attribute on a folder, the folder itself is not encrypted. However, every file that you save to that folder is automatically encrypted without the need to make changes to the attributes of each individual file.

Note

Encrypted files and folders are easy to spot - Windows Vista displays their names in green text when you use tools like Windows Explorer.

Follow these steps to encrypt a folder using Windows Explorer:

  1. Log on to Windows Vista with your everyday user account.

  2. Select Start → Computer.

  3. Browse to drive C: and create a new folder named Encrypted Files.

  4. Right-click the Encrypted Files folder and select Properties.

  5. In the Attributes section of the General tab, click the Advanced button.

  6. In the Compress Or Encrypt attributes section, select Encrypt Contents To Secure Data, as shown in Figure 14-4. Click OK.

    Image from book
    Figure 14-4: Encrypting a folder.

  7. Click OK to close the properties of the Encrypted Files folder. The name of this folder now appears in green text, alerting you to the fact that the encryption attribute is configured.

  8. Select Start → All Programs → Accessories → Notepad.

  9. In the Notepad window, type This is my encrypted file and then select File → Save As.

  10. Browse to the Encrypted Files folder, name the file Test.txt, and then click Save. Because you saved the file to a folder with its encryption attribute set, this new file is encrypted automatically.

  11. Right-click the Test.txt file and select Properties.

  12. Click the Advanced button in the Attributes section. The file is encrypted - the Encrypt Contents To Secure Data check box is selected.

  13. Click the Details button to open the Encryption Details window, as shown in Figure 14-5. Notice that your user account name is listed in the section Users Who Can Access This File, and that the Data Recovery Agent user account configured earlier is listed in the Recovery Certificates For This File As Defined By Recovery Policy section.

    Image from book
    Figure 14-5: Reviewing the details associated with an encrypted file.

Note

Although the Advanced Attributes window makes it appear possible, you cannot enable both the compression and encryption attributes on a file or folder simultaneously.

After you've encrypted a file, it is only accessible to your user account and the DRA, assuming that you've designated one. When another user attempts to access a file that you've encrypted, he cannot decrypt the file, and therefore cannot view its contents.

Follow these steps to test the security of an encrypted file:

  1. Log on to Windows Vista with a user account other than the one you used to encrypt the folder in the previous exercise and your defined DRA.

  2. Select Start → Computer and browse to the Encrypted Files folder on your C: drive.

  3. Double-click the encrypted Test.txt file. Because this user account does not have access to the encrypted file, the Notepad window opens but an Access is Denied message appears, as shown in Figure 14-6.

    Image from book
    Figure 14-6: This message displays when you try to open an encrypted file belonging to another user.

In most cases, you encrypt files to keep them secure and inaccessible to other users. However, there may be times when you want the security benefits that encryption provides, but also want one or more other users to be able to access these protected files. Windows Vista's EFS feature makes it possible to share encrypted files, if necessary.

When you encrypt a file for multi-user access, you not only need to encrypt the file, but also specify the other user accounts that can decrypt it. When you grant other user accounts access to an encrypted file, their private keys are also used to encrypt the file's FEK, thus allowing them to decrypt the FEK and the file it protects. You can only share EFS encrypted files on a file-by-file basis - you cannot configure EFS encryption on a folder for multi-user access.

Tip

If you plan to share encrypted files with another user, make sure that you store these files in a folder location that the other user will have access to. For example, if you've stored the encrypted file in your Documents folder, other users will not be able to gain access to the file due to NTFS permission restrictions.

Follow these steps to share an EFS encrypted file with another user:

  1. Log on to Windows Vista with your everyday user account.

  2. Select Start → Computer and browse to the Encrypted Files folder on your C: drive.

  3. Right-click the Test.txt file and select Properties.

  4. In the Attributes section, click the Advanced button. In the Advanced Attributes window, click Details.

  5. Click the Add button, and then select the user with whom you want to share access to the file, as shown in Figure 14-7. Click OK three times. This user will now have access to the encrypted file.

    Image from book
    Figure 14-7: EFS enables you to share access to encrypted files with other users.

Note

If you want to share an encrypted file with another user but cannot find the person's username listed when you click the Add button on the Encryption Details window for the file, the user probably does not yet have an EFS certificate. To generate a certificate for the user, have him log on and encrypt a file. Windows Vista then automatically creates and assigns the necessary EFS encryption certificate for his account.

Managing EFS Encryption Keys

If you do decide to use EFS to securely encrypt important files, then it's absolutely essential to ensure that your EFS certificate (including your private key) is properly backed up. If you do not back up your certificate and lose access to your private key for any reason (as a result of a system crash, for example), you will not be able to decrypt and restore your files. While designating a DRA helps you to gain access to these files in the event of a problem specific to your user account, a system crash can also mean that the DRA certificate and private key will become inaccessible. For this reason, you should immediately export and securely store a copy of your EFS certificate and private key when you begin using EFS to encrypt files.

Follow these steps to export your EFS certificate and private key:

  1. Select Start → All Programs → Accessories → Run.

  2. In the Open text box, type certmgr.msc and click OK.

  3. Expand Certificates → Current User → Personal → Certificates. Your EFS certificate is listed, as shown in Figure 14-8.

    Image from book
    Figure 14-8: Use the Certificates MMC to manage your EFS certificate.

  4. Right-click your EFS certificate and select All Tasks → Export.

  5. When you see the Certificate Export Wizard Welcome Screen, click Next.

  6. On the Export Private Key screen, click Yes, export the private key, and click Next.

  7. On the Export File Format screen, click Next.

  8. On the Password screen, enter and then confirm a strong password to protect your certificate and private key, and then click Next.

  9. On the File To Export screen, click the Browse button and then browse to the folder in which you want to store the exported Certificate. Enter a name for the certificate in the File Name text box, and then click Save.

  10. Click Next, and then click Finish.

  11. Save the exported certificate to a floppy disk or CD, and then save it in a safe place in case you ever need to import it in the future to gain access to an EFS encrypted file.

Tip

In addition to your own EFS certificate, you should also export and safely store a copy of your designated Data Recovery Agent's certificate and private key. This ensures that files encrypted by all users can also be recovered in the future, if necessary.

If you do lose access to your EFS certificate and private key, you can restore it from your backed up version by opening the Certificates MMC, expanding Certificates → Current User → Personal → Certificates, and then right-clicking the Certificates folder and selecting All Tasks → Import. Follow the steps of the Certificate Import Wizard to restore the backed up copy of your certificate and regain access to your EFS encrypted files.


Using a Third-Party Encryption Solution

Although EFS is a great encryption solution for Windows Vista Professional users, this feature is not included with Windows Vista Home Edition. Thankfully, you can use a number of third-party programs to fill this void, making the security benefits of file encryption accessible to users whose systems lack EFS capabilities.

Every third-party file encryption program uses slightly different techniques to securely encrypt files, folders, and even entire disks. Some rely on public key cryptographic systems to encrypt and decrypt files, while others make use of password protection schemes. In most cases, these programs use the Advanced Encryption Standard (AES) algorithm to offer anywhere from 128- to 256-bit encryption protection. As an encryption standard, AES is robust enough to meet the needs of just about any user - even the U.S. government uses AES to protect files deemed classified to top-secret levels.

Although there's no shortage of personal encryption programs available for Windows Vista, this section focuses on two in particular - Dekart Private Disk and Dekart Private Disk Lite. Both of these products are explored in more detail in the following sections.

Dekart Private Disk Light

Dekart Private Disk Light is the free (for personal use) version of the Dekart Private Disk program. Although not as feature rich as the full version, this program offers excellent file security that easily meets the needs of most users. You can download it from http://www.dekart.com/free_download/?prod_name=private_disk_light.

Dekart Private Disk Light enables you to define one or more private disks on your system. These disks are actually individual files (stored on, for example, your C: drives) that act as encrypted storage locations for other files. For example, you might opt to create one private disk with a storage capacity of 100MB to securely protect important documents. As part of creating this private disk, the program asks you to assign it a drive letter and password. Then, when you need to open your encrypted files or save new files to your private disk, all you need to do is open Dekart Private Disk Light, select the option to connect to your private disk, and enter the correct password. When finished, your private disk is mounted, and accessible like any other drive letter in Windows Explorer. When disconnected, all files stored on the disk remain securely encrypted, and your private disk drive letter is not accessible.

Caution

If you forget the password you used to encrypt a private disk, you effectively lose access to all files stored on the encrypted drive for good.

Dekart Private Disk Light requires Administrator privileges to function correctly. Follow these steps to ensure that Private Disk Light can run with the elevate privilege level it requires:

  1. Select Start → All Programs → Dekart → Private Disk Light.

  2. Right-click the shortcut to Private_Disk_Light and select Properties.

  3. Click the Shortcut tab, and then click the Advanced button.

  4. Select the Run As Administrator check box. Click OK to exit the Advanced Properties window, and click OK again to save the changes to the shortcut that launches Dekart Private Disk Light.

Follow these steps to create a new private disk with Dekart Private Disk Light:

  1. Select Start → All Programs → Dekart → Private Disk Light → Private_Disk_Light.

  2. When the Dekart Private Disk Light window opens (see Figure 14-9), click Create.

    Image from book
    Figure 14-9: Dekart Private Disk Light allows you to create virtual encrypted drives.

  3. On the New Private Disk window, click Browse. Browse to the folder location where you want to save your private disk file, enter a file name, and then click Open.

  4. Use the Disk letter drop-down box to specify a drive letter for your private disk (for example, Z:), and then specify a size for the disk, as shown in Figure 14-10. Click Create.

    Image from book
    Figure 14-10: Creating a new private disk.

  5. On the Encryption Password window, enter and confirm a strong password to protect your private disk, and then click OK.

  6. When the new private disk is successfully created, the Dekart Private Disk Light window prompts you to format the disk. Click OK.

  7. When the Format window is displayed, configure settings for your drive including its file system and volume label, and then click Start.

  8. When the Format dialog box appears, click OK.

  9. When the format process is complete, click OK, and then close the Format setting window.

  10. When created and formatted, you new private disk is automatically connected. If you open Computer, the drive letter assigned to your private disk should now be visible and accessible in the Devices with Removal Storage section, as shown in Figure 14-11.

    Image from book
    Figure 14-11: A connected private disk is displayed as a removable disk in Windows Explorer.

  11. Click the Disconnect button to disconnect your private disk.

Follow these steps to connect to and save files to your private disk.

  1. Select Start → All Programs → Dekart → Private Disk Light → Private_Disk_Light.

  2. Click Connect.

  3. When the Connect Private Disk window appears, browse to the file that you originally specified as your private disk storage location. Select the file, and then click Open.

  4. When the Password dialog box appears, type your password and click OK.

  5. Select Start → All Programs → Accessories → Notepad.

  6. In the Notepad window, type Testing Dekart Private Disk Light.

  7. Select File → Save As. Browse to your private disk's drive letter, enter a file name, and then click Save. The file is encrypted automatically and stored on your private disk.

After your private disk is created, cut existing sensitive files from folders like Documents and paste them into a folder on your private disk to ensure they're securely encrypted.

Cross Reference

After moving sensitive files to your encrypted private disk, erase all remnants of the original unencrypted versions. You learn more about securely erasing files from drives in Chapter 15.

Dekart Private Disk

Although Private Disk Light meets the file encryption needs of most users, the full version of the program - Dekart Private Disk - offers a number of additional features and capabilities that may represent a worthwhile investment for some users.

In addition to the capabilities offered by Dekart Private Disk Light, Dekart Private Disk includes the capability to:

  • Connect to private disks from Windows Explorer

  • Hide a private disk's storage file

  • Connect to private disks in read-only mode

  • Restore NTFS permissions and shared folder settings upon connecting

  • Create password-protected backup disks

  • Back up disk encryption keys

  • Disconnect private disks automatically after a timeout period

  • Encrypt files stored on USB, CD, DVD, and other removable drives

For a complete overview of the differences between Dekart Private Disk and Dekart Private Disk Light, see the product comparison table at http://www.dekart.com/products/file&disk_encryption/private_disk_light. To download a trial version of Dekart Private Disk, visit http://www.dekart.com/free_download/?prod_name=private_disk.


Summary

Encryption offers the highest possible levels of protection for your personal files. While its security benefits are great, it's vital that you treat encryption with respect - in the same way that encryption serves its purpose in keeping others from accessing your personal files, it also has the potential to lock you out of your own files, if you're not careful. Keep the following points in mind when it comes to securely encrypting files:

  • Always designate a DRA if you plan to encrypt files using EFS.

  • Always export and securely store a copy of your EFS certificate and private key, along with those belonging to the DRA. Have other users do the same for their user accounts.

  • Set the EFS encryption attribute on folders rather than individual files when possible.

  • If you choose to share EFS encrypted files, ensure that they're stored in a folder location that is accessible to other users.

  • If you are using EFS to encrypt files for personal access only, store them in a folder that other users do not have access to.

  • If you're running Windows Vista Home Basic or Home Premium Edition, use a third-party file encryption program like Dekart Private Disk Light to protect your files.

  • When using a third-party encryption program to protect your files, take steps to ensure that you do not forget the password(s) used to decrypt and access your files.


Chapter 15: Erasing Files and Hard Drives Securely

When is a deleted file not a deleted file? When you use Windows Vista to delete the file, of course! Although it may seem strange, the built-in processes by which Windows Vista normally deletes files and folders don't actually remove the items from your hard drive in a permanent manner. In fact, many of the files that you believe to have been deleted for all eternity can actually be recovered quite easily with the right software tools in hand. That's good news if you've accidentally deleted a file and now want to attempt to recover it, but very bad news if you have some expectation that deleted items are actually permanently erased for good.

From a security perspective, the ability to permanently erase files so that they cannot be recovered is a necessary feature. Unfortunately, Windows Vista does not include any built-in tools or utilities that are capable of deleting files in such a manner. In fact, if you rely on features like the Recycle Bin to delete files, then you need to be aware that there's always the potential for a user with the right tools and expertise to reclaim all or some portion of every file you've deleted. In a nutshell, Windows Vista offers nothing in the way of tools capable of securely erasing data.

Thankfully, a number of third-party tools can help to bridge this security lapse. In this chapter you learn how to use Eraser, a free tool designed to erase securely files, folders, and even free disk space to levels that meet or exceed even U.S. government standards. Furthermore, you learn how to cover your Internet and program activity trails, stopping others from learning which files you've been working with or which web site you've been visiting. Finally, for cases where you've purchased a new PC and are getting ready to donate or hand down your old one, you learn how to securely erase your old hard drive to ensure that your personal data is erased, once and for all.

Traditional Ways of Deleting Files

In the world of Windows Vista, files and folders are typically deleted by sending them to (and then emptying) the Recycle Bin. On a larger scale, you can delete entire disks using techniques like formatting drives, or even deleting them completely. In the following sections you learn more about these methods, including why they are not considered secure alternatives in cases where you need to erase files, folders, or even the contents of a hard drive permanently.

Using the Recycle Bin

Windows Vista is an operating system rife with second chances, and perhaps no feature illustrates this as clearly as the aptly named Recycle Bin. When you select the option to delete a file or folder in Windows Explorer, Windows Vista automatically moves the item to the Recycle Bin, where it sits until you make the decision to get rid of it for good. In other words, files that you delete aren't actually deleted until you give the word that the Recycle Bin should be emptied.

Note

Although Windows Vista moves most files deleted with Windows Explorer to the Recycle Bin, not all deleted files are dealt with in this manner. In cases where you delete a very large file or folder, Windows Vista may deem it too large for the Recycle Bin and let you know that it intends to bypass this step and delete the file for good. Additionally, when you delete files from the command line using the DEL command, they are deleted immediately, rather than being sent to the Recycle Bin.

In many ways, this is a good thing. If you accidentally choose the option to delete a file and then realize that you've made a mistake, you can open the Recycle Bin, click the file in question, and select Restore to undo the error and return the file to its original location (see Figure 15-1). When you empty the Recycle Bin, however, Windows Vista considers the file to be gone for good.

Image from book
Figure 15-1: You can restore files sent to the Recycle Bin if you delete a file in error.

Although a file you empty from the Recycle Bin may appear to be deleted for good, in actual fact, it may still exist. That's because of the way that Windows Vista deletes files - instead of physically deleting or erasing the areas of disk space in which the file resided, the space is simply marked as available or not currently in use. Other programs (and Windows Vista) now look at that space as they would any other area of uninhabited disk space, and can use it for storage if necessary.

This methodology is the primary reason why you can often recover deleted files with specialized undelete software. Instead of relying on the information that Windows Vista provides, these tools scan parts of the hard disk marked as available, looking for accessible files. In cases where the disk space that a file once occupied is not used to store other data, these programs can typically access the deleted file for recovery purposes.

Formatting and Deleting Partitions

In much the same way that Windows Vista doesn't go to the trouble of ensuring that files emptied from the Recycle Bin are actually permanently deleted for good, formatting or deleting a partition offers no guarantees that the files stored on a drive are permanently inaccessible. In the case of formatting an existing drive (see Figure 15-2), Windows Vista simply deletes the contents of the drive's partition table, marking all areas of the drive as empty and accessible. As with deleting a file, the contents of the drive are still present, and potentially recoverable with undelete tools.

Image from book
Figure 15-2: Formatting a disk makes the disk appear to be empty, but files may still be recoverable even after the fact.

The same is true when a partition is actually deleted using a tool like Disk Management or FDISK. Here again, Windows Vista doesn't erase or destroy the contents of the partition. Instead, it fools programs (and even itself) into believing that the partition no longer exists, allowing you to use the newly freed space for the purpose of creating new partitions or extended existing ones.

Image from book
Recovering Deleted Files

Whether you see the way that Windows Vista deletes files as a good thing or a bad thing is largely a function of where you're standing. If you've accidentally deleted a file and want the best chance of recovery, then the method offers promise. If you want to permanently erase files, then the Windows Vista methodology isn't a suitable solution.

Assuming that you have deleted files (using the Recycle Bin or other methods outlined in the previous sections) that you now want to restore, your best chance of recovery is using specialized undelete software. These programs scan your hard disk looking for deleted files, providing lists of those you can potentially recover. An example of one such program is File Scavenger (http://www.quetek.com), as shown in the following figure.

Image from book

As part of its scanning process, File Scavenger lists all deleted files that it finds, and assigns each a status that outlines the relative probability that you can recover the file. For example, the chances of recovering a file marked good are high, whereas you have little chance of restoring a file marked poor.

Whether you can actually restore a file is largely a function of whether any portion of the disk space it inhabited is now being used to store another file. If the disk space has been reused, the chances of a successful recovery are quite low. This is one of the reasons why you need to be careful to keep disk activity to a minimum after you accidentally delete a file. If you don't, the likelihood that the disk space will be reused is much higher.

For this reason, make a point of installing undelete programs like File Scavenger before you need them. If you try and install these programs after accidentally deleting a file, it's possible that the disk space used to install the program might end up being the same disk space inhabited by your deleted file, making recovery next to impossible.

Image from book


Erasing Files Securely

When security and privacy are not concerns, there's really nothing wrong with using the built-in Windows Vista methods to delete files and folders. However, there's also a good chance that your computer stores all sorts of sensitive information that you would rather have erased permanently. From old business records to personal financial statements, there's no question that some files are just more sensitive than others. Any time that you want to securely erase data once and for all, you need to move beyond the native capabilities that Windows Vista offers.

Thankfully, a number of programs exist for the purpose of securely erasing files. One of the most popular options on this front also happens to be free - Eraser, available from http://www.heidi.ie. When you install Eraser and select the option to erase a file or folder, this tool doesn't just delete the item's partition table entry. Instead, it overwrites the physical disk space that the files occupy a number of times, to the point where recovering the original data is extremely difficult, if not impossible.

Setting Eraser Defaults

In its default configuration, Eraser offers four different methods to overwrite disk space and thus erase files:

  • Gutmann. This default file erasing method overwrites the disk space that the file used a whopping 35 times.

  • US DoD 5220.22-M (8-306. / E, C and E). This method, named after a U.S. Department of Defense standard, overwrites the disk space used by a file seven times.

  • US DoD 5220.22-M (8-306. / E). This method, also named after a U.S. DoD standard, overwrites the disk space used by a file three times.

  • Pseudorandom Data. This method overwrites the disk space that the files used only once.

In addition to the Eraser default options, you can also define custom erasing settings to meet your own personal needs or preferences.

Tip

If you're interested in the deep, dark, and very technical details behind securely deleting data from disk drives, read Peter Gutmann's Secure Deletion of Data from Magnetic and Solid-State Memory paper at http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html.

Follow these steps to configure erasing preferences with Eraser:

  1. Select Start → All Programs → Eraser → Eraser.

  2. Select Edit → Preferences → Erasing. The Preferences: Erasing window opens, as shown in Figure 15-3.

    Image from book
    Figure 15-3: Eraser includes four predefined erasing methods, but you can also define your own.

  3. On the Files tab, select the erasing method you want to use, such as the US-DoD 5220.22-M method that overwrites data using seven passes.

  4. Click the Unused Disk Space tab.

  5. Click the erasing method that you want to use to overwrite free disk space, as shown in Figure 15-4.

    Image from book
    Figure 15-4: Eraser overwrites unused disk space in a single pass by default.

  6. Click OK to save your changes.

Erasing a File with Eraser

Follow these steps to securely erase a file with Eraser:

  1. Select Start → Computer.

  2. Browse the folder that contains the file you want to securely erase.

  3. Right-click the file and select the Erase option, as shown in Figure 15-5.

    Image from book
    Figure 15-5: To erase a file permanently, select Erase from the shortcut menu in Windows Explorer.

  4. When the Confirm Erasing dialog box appears (see Figure 15-6), click Options. This opens the Preferences: Erasing window, allowing you to configure (if necessary) specific erase settings for the file that you are currently erasing.

    Image from book
    Figure 15-6: The Confirm Erasing dialog box allows you to configure specific erasing settings and confirm that you want to permanently erase a file.

  5. Select your preferred erasing method for this file, and click OK.

  6. On the Confirm Erasing dialog box, click Yes. The Eraser dialog box shows the progress of the overwriting process, as shown in Figure 15-7.

    Image from book
    Figure 15-7: Eraser overwrites files with 35 passes by default.

  7. When the erasing process has finished, the Eraser Report window outlines information about the process, as well as the details of any errors, as shown in Figure 15-8. If necessary, click Save As to save details of the report to a text file. Otherwise, click Close.

Image from book
Figure 15-8: The Erasing Report window lets you know whether the erasing process was successful.

If you want to continue to use the Recycle Bin as a temporary storage location for deleted files, by all means do. With Eraser installed, you can right-click the Recycle Bin icon on your desktop at any time and select Erase Recycle Bin (rather than Empty Recycle Bin) to securely delete its contents, once and for all.

Image from book
Erasing Unused Disk Space?

It may not seem necessary, but allowing Eraser to overwrite your system's unused disk space is a good idea from a security perspective. Even though a particular area of free space on a partition may not currently hold any data, that doesn't mean that it never did. In fact, it's more than likely that areas of the disk that Windows Vista currently considers to be empty hold at least portions of the files that were once stored there.

To help ensure that all of these bits and pieces of old files are completely removed, Eraser is configured to overwrite free disk space in a single pass. Although using a single pass is not the most secure option, it is used by default in the interest of speed. However, you can select any of the built-in erasing methods as alternatives. You can even specify your own custom settings (like overwriting data nine times using a particular set of patterns) if that's what you prefer.

When installed, Eraser automatically creates and schedules a new job that erases free space on drive C: every day at 12 A.M. To view or change the details of this job, click the Scheduler button in the Eraser window and then right-click the job and select Properties, as shown in the following figure.

Image from book

From the Task Properties window, you can change what is erased on the Data tab, the time and frequency of the job on the Schedule tab, and review details pertaining to each time the job has run on the Statistics tab.

If your hard disk includes more than one partition on which you want to erase free space from all drives as part of this scheduled job, select the Local Hard Drives option from the Unused Disk Space On Drive menu on the Data tab. When the Local Hard Drives option is selected, the unused disk space on all partitions is overwritten, instead of free space on drive C: alone.

Alternatively, you can create new scheduled tasks for Eraser by selecting File → New Task and then configuring settings to meet your needs. You can run a scheduled task at any time by right-clicking its entry on the Scheduler tab and selecting the Run option.

Image from book


Covering Your Internet Tracks

As part of trying to make your computing experience as fast and painless as possible, Windows Vista automatically stores all sorts of information relating to where you've been online, and the files you've recently opened. For example, when you visit a web page, Internet Explorer automatically adds its address (URL) to your browsing history list, making it easier to reach the same site in the future. Similarly, parts of sites (such as images) are temporarily stored on your hard drive to eliminate the need to download them again on subsequent visits.

Windows Vista uses similar techniques to store lists of files you've recently used. If you click the Start button and select Recent Files, a list of files that you've opened recently appears, as shown in Figure 15-9.

Image from book
Figure 15-9: The Recent Files Start menu item displays lists of files that you've recently opened.

Ultimately, it's up to you to decide whether you're comfortable with other users potentially knowing which files you've opened, and which web sites you've been visiting. If you're fine with the idea of leaving your tracks in plain view, then there's nothing left to do. However, if you'd rather have a little more privacy, clear the information that Windows Vista and other programs track, at least periodically.

Some of the personal history items that are commonly stored on Windows Vista systems include:

  • Temporary Internet files. This folder contains cached copies of web pages, images, and other files downloaded as part of surfing the Internet with Internet Explorer.

  • Cookies. Web browsers store cookie files set by web sites that you visit for future reference.

  • URL history. By default, most web browsers store lists of web site addresses that you visit in their Address bar, allowing you to use the drop-down menu feature to quickly select the site's address for subsequent visits.

  • Chat history. Instant messaging programs (like ICQ) save the details of your online chats for future reference.

  • Recently used files. Windows Vista and many third-party programs save lists of recently used files, which act as shortcuts to open those files more quickly the next time you use a program.

  • Temporary files. Almost all programs store temporary working copies of files that you have opened. Some programs delete these files automatically once a file is saved, while others leave the temporary version intact and stored on your hard disk for longer periods.

Both Windows Vista and individual programs typically include ways to delete tracks like history lists or temporary files. For example, if you open Internet Explorer and select Tools → Internet Options, the Temporary Internet files section on the General tab includes buttons to delete both cookies and files, as shown in Figure 15-10.

Image from book
Figure 15-10: Internet Explorer includes the ability to delete Temporary Internet files, cookies, and your browsing history.
Tip

You can quickly delete your web surfing history and temporary Internet files in Internet Explorer 7 by selecting Delete Browsing History from the Tools menu. If you use Firefox, you can delete these items at any time by pressing Ctrl+Shift+Del or by selecting Tools → Clear Private Data.

Unfortunately, different programs and tools store history items in different ways, meaning that covering your tracks manually can be a time-consuming and frustrating undertaking. Many different third-party tools exist for the purpose of deleting Internet and file tracks with a single click. CCleaner is one such program, available as a free download from http://www.ccleaner.com. When you launch CCleaner it provides options that delete traces of your Internet wanderings, files you've recently opened within different programs, and more. Simply check the items that you want to delete and then click Run Cleaner, as shown in Figure 15-11.

Image from book
Figure 15-11: CCleaner is a popular free tool that enables you to delete your web browsing history, temporary files, and recently used file lists from a variety of different programs.


Erasing Hard Drives Securely

Purchasing a newer and faster computer is always exciting, but always raises the issue of what to do with your old PC. Although many people hand their old system down to a friend or family member, donating or recycling these machines has become an increasingly popular option.

There's no denying that donating and recycling old systems are both more socially responsible options than throwing a computer away; however, it's critically important to ensure that you completely and securely erase the system's hard drive prior to going this route. In fact, you should securely erase the hard drive of any PC that you don't plan to use any more, regardless of where it ends up. Put simply, it's not worth taking the risk that someone will find or purchase the computer, and then have the capability to sift through your old personal files and settings. Even if you format the drive and delete its partitions, chances are good that any user can restore at least some of your old files by using an undelete utility.

Note

If you're looking for some insight into the types of information that are commonly recovered from old hard disks and discarded PCs, visit http://www.pcmag.com/article2/0,1759,919827,00.asp and http://www.computing.co.uk/computing/news/2071523/confidential-left-old-pcs.

For both security and practical reasons, you cannot securely delete the contents of any hard drive while Windows Vista is running. In order to get this job done, you need to create and use a special bootable floppy disk or CD that includes a tool designed to securely erase drives. Eraser includes just the tool, known as Darik's Boot and Nuke.

In a nutshell, Darik's Boot and Nuke creates a bootable CD or floppy disk that enables you to boot into a command line environment and specify settings for erasing your computer's hard disk. This program enables you to specify how many times the disk should be overwritten, using settings similar to those that Eraser uses. Once the process is complete, recovering any data from the CD is next to impossible.

Caution

Darik's Boot and Nuke is an exceptionally dangerous tool that can erase the contents of any hard drive permanently. Once you create this disk, be sure to label it appropriately and never leave it lying around or in your computer's disk drive. Because the disk can function without requiring Windows Vista to run, ensure that your computer is not configured to boot from a floppy disk or CD drive in your BIOS settings (as originally outlined in Chapter 2). If your computer can boot from these devices, any user can insert a nuke disk on your system and use it to securely erase the entire contents of your drive.

Follow these steps to create a bootable floppy disk containing Darik's Boot and Nuke:

  1. Select Start → All Programs → Eraser → Create Nuke Boot Disk.

  2. When the WinImage Self Extractor window opens, select the drive letter for your floppy drive from the Floppy drop-down menu. Insert a blank floppy disk into the drive, and then click OK.

Follow these steps to securely erase the entire contents of your computer's hard drive using Darik's Boot and Nuke:

  1. Insert the boot floppy disk created in the previous activity in your floppy disk drive.

  2. Restart your computer to boot from the floppy disk. You may need to change the drive boot order in your BIOS settings first in order for this step to work.

  3. On the Darik's Boot and Nuke Warning Screen, type autonuke and press Enter. Alternatively, press just the Enter key to walk through the process step-by-step.

Note

In cases where you need the entire contents of a hard drive to be 100 percent unrecoverable, the only effective option is to first securely erase the drive, and then literally destroy it via methods such as incinerating or pulverizing the physical drive. Although it may sound extreme, physical destruction is still the method that governments use to sanitize disks that contain classified information deemed top secret.


Summary

When you delete files, folders, or even entire disk partitions using Windows Vista tools, the methods you use make it possible for items to be recovered using a variety of tools. For cases where the data you delete must be erased and unrecoverable, you need to turn to third-party tools like Eraser and Darik's Boot and Nuke. Keep the following points in mind when it comes to deleting files, folders, settings, and drives:

  • Erase sensitive files using a program like Eraser to ensure they cannot be recovered.

  • Use the highest number of passes possible when choosing a secure file deletion method. At 35 passes, the Gutmann method offers excellent protection.

  • Periodically erase your Internet and file activity trails using a program like CCleaner to improve personal privacy.

  • Prior to donating or giving away an old PC, take the time to securely erase its hard drive using a tool like Darik's Boot and Nuke.


Part VI: Securing Your Home Network

Chapter List

Chapter 16: Securing Shared Folders and Printers
Chapter 17: Securing Windows Vista on Wireless Networks


Chapter 16: Securing Shared Folders and Printers

Overview

One of the first human interaction skills that we're all taught is the importance of sharing. Children are encouraged to share toys during playtime, and adults borrow things from neighbors all the time. Although there's little question that sharing has benefits, it can also have a downside - remember the hedge trimmer that you lent out six months ago and haven't seen heads or tails of since? How about the corner of your garage stacked full of items borrowed from your neighbor? When not managed properly, the whole business of sharing things can turn into one big ugly mess (often quite literally!).

Although slightly different than the world of tools, household items, or even the proverbial cup of sugar, sharing resources is perhaps the most important concept behind setting up a computer network. When you have a network at home or at the office users can share resources like printers and files almost seamlessly. A user sitting at one PC can send documents to a printer connected to another computer, or share a certain folder on her PC such that all other users can view, store, and manage the files it contains from across the network. From making better use of resources to making access to information more convenient, networks and sharing go hand in hand.

Unfortunately, in much the same way that your neighbor may not have gotten around to returning your extension ladder, sharing on a computer network doesn't always run as smoothly as it should. For example, if you grant all others on your network access to an expensive color laser printer, you might find the kids using it to print every color photo they can find. Or, you may have shared a folder on your computer to enable your spouse to open an important document, only to learn that he or she deleted all of the files in the folder by accident. Any time that you share anything, you're taking at least a small risk.

When you want to take advantage of the benefits of sharing resources on a computer network but reduce your risk exposure at the same time, you need to explore ways in which you can secure things to an appropriate degree. For example, you might choose not to allow some users to access a certain printer, or deny a user the ability to do anything more than open and read the files in a shared folder. In this chapter you learn about the File and Printer Sharing features of Windows Vista, and specifically how to implement restrictions on how other network users can make use of shared resources.


Sharing Network Resources

Sharing network resources is a core feature of Vista. A Windows Vista system is capable of acting as a network client for the purpose of connecting to resources shared from other computers, or as a basic network server that hosts the shared resources that other client computers connect to.

The specific feature that allows a Windows Vista system to share resources over a network is called File And Printer Sharing. Enabled by default, File And Printer Sharing enables other computers to connect to a Windows Vista system for the purpose of accessing:

  • Shared folders. A shared folder is much like any other folder stored on the hard drive of a Windows Vista system. The primary difference between a regular folder and one that you share is that the contents of a shared folder are accessible to other computers on your network. For example, you might decide to create a new folder called SharedFiles, and then share this folder. When shared, other computers on the network can connect to the folder using a variety of techniques described later in this chapter.

  • Shared printers. A shared printer is similar to any other printer installed on a Windows Vista system. The major difference between a regular printer and a shared printer is that a shared printer is accessible to other client computers on the same network. When a printer is installed but not shared, only the people using the computer it is connected to can print to it. When shared, other users can connect to the printer over the network, and then send print jobs to it in the same manner as they would with a locally attached printer.

You learn more about how to share and secure both folders and printers in the following sections.


Sharing and Securing Folders

Windows Vista enables you to share folders with other users on a network in three ways:

  • Sharing existing folders on your hard drive using the Windows Vista Sharing Wizard to make folder contents available to other users on your network.

  • Using a Windows Vista feature known as Public Folder Sharing to provide an easy (but less flexible) way to simplify the folder sharing process.

  • Disabling the Sharing Wizard and configuring shared folders and permissions using a more advanced method similar to the one used by Windows Server systems like Windows 2000 Server and Windows Server 2003.

You'll learn more about each of these sharing methods in the following sections.

Note

Administrator privileges are required to share folders and printers on a Windows Vista system.

Sharing and Securing the Public Folder

As you learned in Chapter 13, Public folders provide a simple and effective method for users of the same PC to exchange and share files with one another. By saving, moving, or copying files into folders within the Public folder hierarchy, all shared files are accessible to all users.

By default, the Public folder is only shared among users of the same PC. For network users to gain access to the contents of the Public folder on another PC, it must be shared. Unlike folder sharing, you cannot apply different levels of access to the individual users who connect to the Public folder when it is shared. In other words, the permission level you configure on the Public folder applies to all users who access the folder across the network.

When preparing to share your Public folder, you need to choose appropriate sharing settings to ensure you properly secure the folder. The process begins by selecting one of the two available password-protected sharing settings described here:

  • Password protected sharing is enabled. If this option is selected, network users need a username and password configured on the Windows Vista system where the shared Public folder resides to connect to the folder.

  • Password protected sharing is disabled. If you select this option, any user who can gain access to your network can access the contents of the shared Public folder. Although this option makes sharing easier, it is much less secure and allows outside users to gain access to files stored in your shared Public folder.

Next, you need to select one of the three Public folder sharing settings for the folder:

  • Turn on sharing so anyone with network access can open files. Network users can open and read files stored in the Public folder, but they cannot change, delete, or add files to the folder.

  • Turn on sharing so anyone with network access can open, change, and create files. Network users can read, open, change, and delete files stored in the public folder as well as save, copy, and move new files into the folder.

  • Turn off sharing (people logged on to this computer can still access this folder). This setting is enabled by default, and stops all network users from accessing the contents of the Public folder. In effect, this setting disables network sharing of the Public folder completely.

Follow these steps to share your Public folder hierarchy with other network users:

  1. Select Start → Control Panel → Network And Sharing Center.

  2. Click the arrow next to Password Protected Sharing.

  3. Ensure that Password Protected Sharing is enabled.

  4. In the Public Folder section (see Figure 16-1), select either Turn On Sharing So Anyone With Network Access Can Open Files, or Turn On Sharing So Anyone With Network Access Can Open, Change, And Create Files, As Per Your Specific Requirements. Click Apply.

    Image from book
    Figure 16-1: Sharing Public folders over the network.

  5. To make files accessible to network users through the shared Public folder, save, move, or copy files into its folder hierarchy.

When the Public folder is shared, other users can connect to it over the network. You learn more about connecting to shared folders later in this chapter.

Securing and Sharing Any Folder

Although sharing the Public folder provides the easiest option for making files you want to share available to other users on your network, it suffers from one major limitation - all users are granted the same level of permission for the folder contents. If you want a greater degree of control over which users can access a folder you share, and to what extent, then sharing other folders (rather than the Public folder) can provide the flexibility you need. Using this method you could share a folder called Vacation and grant Bill only the capability to read and open the files within the folder, while giving Sarah the power to read and open existing files, or change, add, and delete files if necessary.

Windows Vista simplifies the sharing of any folder on your hard drive through its Sharing Wizard feature. In effect, sharing a folder using the wizard walks you through the steps necessary to grant different users different levels of network access to the folder you want to share. The Sharing Wizard enables you to grant individual users one of three different permission levels to a shared folder:

  • Reader. This option restricts a user to viewing files in the shared folder.

  • Contributor. This option enables a user to view all files, add files, and change or delete any files that they add.

  • Co-owner. This option enables a user to view, change, add, and delete any files in the shared folder.

Follow these steps to share any folder using the Windows Vista Sharing Wizard:

  1. Select Start → Computer.

  2. Browse to the folder that you want to share with other users on your network. Right-click that folder and select Share.

  3. In the File Sharing window, type the username of the person you want to share files with, and click Add. Alternatively, you can also click the drop-down arrow to the right of the text box, select the username in the list, and then click Add as shown in Figure 16-2. If the user you want to share files with isn't listed in the drop-down box select the Create A New User option and follow the steps to create a user account for him.

    Image from book
    Figure 16-2: Choosing which users should have access to a shared folder.

  4. Under Permission Level, click the drop-down arrow next to the permission level you want to assign for that user, as shown in Figure 16-3.

    Image from book
    Figure 16-3: Configuring user permissions for a shared folder.

  5. When you have finish assigning shared folder permissions for all applicable user accounts, click the Share button. When the User Account Control dialog box appears, click Continue. When the Your Folder Is Shared screen appears (see Figure 16-4), click Done.

Image from book
Figure 16-4: A successfully shared folder.

Advanced Sharing and Security

If you're looking for the highest degree of flexibility when sharing folders and assigning permissions on a Windows Vista system, you need to disable the Sharing Wizard feature. You can disable the Sharing Wizard in favor of using what are sometimes referred to as standard shared folder permissions. The standard shared folder permissions available on a Windows Vista system when the Sharing Wizard is disabled include:

  • Read. Read permission enables network users to open and read files, but not modify their contents or delete them outright.

  • Change. Change permission enables network users to open, read, and modify existing files, as well as add or delete files within the folder.

  • Full Control. Full Control permission enables network users to perform any function on items within the shared folder.

When you disable the Sharing Wizard, the default permission assigned to a shared folder is Allow Read to the Everyone group. The permissions that you should assign to a shared folder depend on how you want to use that folder. For example, if you only want network users to open and read (but not change) the contents of a folder, assign the Allow Read permission to the Users group (which includes only users with valid user accounts, rather than everyone). If you want to allow users to change files, grant the Change permission to the Users group. From a security perspective, you're better off granting permissions to the Users group rather than everyone. Everyone is literally anyone that may be able to connect to the shared folder, including hackers, other wireless users within range, and so forth.

Note

Shared folder permissions only apply to users who connect to the folder over the network.

Follow these steps to disable the Sharing Wizard and configure shared folder security settings on a Windows Vista system:

  1. Select Start → Computer.

  2. Press the Alt key, and select Tools → Folder Options.

  3. Click the View tab, scroll down, and clear the Use Sharing Wizard (Recommended) check box as shown in Figure 16-5.

    Image from book
    Figure 16-5: Disabling the Sharing Wizard.

  4. Click OK.

  5. Browse to the folder you want to share. Right-click it and select Share. The Properties of the folder open to the Sharing tab, as shown in Figure 16-6.

    Image from book
    Figure 16-6: The Sharing tab in the Properties of a folder.

  6. Click the Advanced Sharing button. When the User Account Control dialog box appears, click Continue.

  7. When the Sharing window opens, select Share This Folder as shown in Figure 16-7.

    Image from book
    Figure 16-7: Configuring shared folder settings.

  8. Change the Share name to something more descriptive and add comments that describe the contents of the folder if necessary.

  9. Click the Permissions button. By default, the Everyone group is granted the Allow Read permission, as shown in Figure 16-8. Use the Add and Remove buttons to change the users that will have access to the shared folder, and then use the check boxes in the Allow and Deny columns of the Permissions section to change the permissions associated with those users. When finished, click OK to exit the Permissions For Folder screen.

    Image from book
    Figure 16-8: Configuring advanced shared folder permissions.

  10. Click OK to exit the Advanced Sharing window. Note that the Sharing tab on the Properties window has now changed to include the Network Path of the shared folder, as shown in Figure 16-9.

Image from book
Figure 16-9: Reviewing shared folder settings.
Tip

You can hide a shared folder by appending the $ symbol to the end of its share name. If you do this, it is invisible when users browse for shared folders using tools like Network. To access it, users need to know and enter the complete path to the folder (for example \\computername\sharedfolder$\) when mapping a network drive or using the Search text box to access it.

In most cases, the default shared folder permission (Allow Read to the Everyone group) works just fine, but only if users don't need to change files stored in the shared folder (if they do, Allow Change is a better option). In instances where a folder is configured with both shared folder and NTFS permissions (as explored in Chapter 14), the more restrictive of the permissions apply to network users. In other words, if the NTFS permissions on a folder are set to Allow Read for a user, and the shared folder permissions that apply to the same user is Allow Full Control, then the user's effective permission when accessing the folder over the network is the more restrictive option - Allow Read.

Additionally, shared folder permissions combine in a manner similar to NTFS permissions. For example, if a user account is granted the Allow Read shared folder permission, and that user is also a member of the Administrators group that is granted the Allow Full Control permission, the user's effective shared folder permission becomes Allow Full Control. The only exception to this rule is when permissions are explicitly denied - a denied permission always takes precedence over an allowed permission.

Cross Reference

Ensuring that shared folders are properly secured is especially important on wireless networks. If your wire less network isn't properly secured, other wireless users within range of your network can connect to it, and potentially gain access to your shared folders and printers. You'll learn more about wireless networks and some of their associated security risks in Chapter 17.


Connecting to Shared Folders

When you share a folder, other users can connect to it from their computers over the network. Although you can use a variety of different methods to connect to a shared folder, two of the most common are by browsing for the folder using Network, and what is known as mapping a network drive. When a user opts to connect to a shared folder by mapping a network drive, they assign the shared folder a drive letter (like Z:), and then can connect to the folder by browsing to drive Z: in Computer.

For a user sitting at another computer to connect to a shared folder successfully, some additional configuration is almost always necessary.

Connecting to a Shared Folder Using Network

The safest way to ensure that network users can gain access to a shared folder is to set up Standard user accounts for them on the computer where the shared folder resides. For example, if you want a user named Mark to access the shared folder over the network, create a user account named Mark on the computer where the shared folder resides, and assign the account a password. Then, when Mark attempts to access the shared folder, he can provide his username and password when prompted.

To connect to a shared folder using Network, complete the following steps:

  1. Select Start → Network.

  2. Double-click the name of the PC where the shared folder resides.

  3. Double-click the name of shared folder you want to access to view its contents.

Mapping a Network Drive

To map a drive letter to a shared folder and then access it using Computer, complete the following steps:

  1. Select Start → Computer.

  2. Press the Alt key and then select Tools → Map Network Drive.

  3. Select an available drive letter from the Drive drop-down box, as shown in Figure 16-10.

    Image from book
    Figure 16-10: Assigning a drive letter for a mapped network drive.

  4. Click the Browse button.

  5. In the Browse For Folder window, select the name of a shared folder on your network as shown in Figure 16-11 and click OK.

    Image from book
    Figure 16-11: Selecting the shared folder to map the drive to.

  6. Click Finish to complete the mapping process. The newly mapped network drive is now accessible in the Network Location section of Computer, as shown in Figure 16-12.

Image from book
Figure 16-12: Viewing a mapped drive in Computer.

Browsing for the Folder Using the Network

You can also connect to shared network folders directly from the Start menu. To do this, click the Start button and type \\ computername \ into the Search box, where computername is the name of the computer where the shared folder resides. A list of all available shared folders on that computer appears as shown in Figure 16-13. To connect to and view the contents of a shared folder, simply click its name on the list.

Image from book
Figure 16-13: Browsing for shared folders from the Start menu.


Sharing and Securing Printers

Like folders, you can also share printers over a network. When shared, other users on the network can connect to the printer and send their print job to it, in much the same way they would with a printer directly connected to their local PC. Sharing printers makes a great deal of sense on networks that have many client computers. Rather than installing a dedicated printer on each and every PC (or moving files to a computer with a printer using a floppy disk or CD), all network users can use a single shared printer, which helps to reduce costs significantly. Any printer connected to a Windows Vista system (or directly to the network, as is the case with printers that include their own network adapter card) can be shared to allow multi-user network access.

Sharing Existing Printers

Follow these steps to share an installed printer and configure security permissions:

  1. Select Start → Control Panel → Printers.

  2. Right-click the printer you want to share and then select Sharing.

  3. Click the Change Sharing Options button. When the User Account Control dialog box appears, click Continue.

  4. On the Sharing tab, select the check box Share This Printer, and then give the printer a descriptive shared name, as shown in Figure 16-14.

    Image from book
    Figure 16-14: Sharing a printer.

  5. Click Apply and then click OK.

Connecting to Shared Printers

When a printer is shared, network users who want to print to it first need to connect to it to properly install the device's drivers. Windows Vista provides a number of different ways to find and connect to shared printers, but two of the most common methods are browsing for the printer in Network and using the Add Printer Wizard.

To connect to a shared printer using Network, complete the following steps:

  1. Select Start → Network.

  2. Double-click the name of the network PC to which the printer is attached.

  3. Right-click the network printer you want to install and select Connect as shown in Figure 16-15.

Image from book
Figure 16-15: Connecting to a shared printer.

Another easy way to connect to a network printer is by opening the Printers applet in Control Panel and clicking the Add A Printer button. Select the option Add A Network, Wireless or Bluetooth Printer, and then follow the wizard's steps to complete the installation process.

Regardless of the method you use to connect to a network printer, it is always accessible through any program's Print dialog box and the Printers applet in Control Panel.

Securing Shared Printers

It may not really seem necessary, but there may come a time when you want to better secure a shared printer. By default, any user can print to any printer shared from a Windows Vista system.

Perhaps the best example of needing to secure a printer is in the case of an expensive color laser or ink jet model. The "consumables" (ink or toner cartridges) for these printers can be very expensive, and it often only takes printing a few large or color-intensive jobs before refills or new cartridges are required. You probably don't want someone bleeding your new cartridges dry printing their vacation photos if they're not supposed to be using the printer for that purpose. Similarly, some printers are installed for dedicated purposes like printing invoices, reports, or checks. If this is the case, you can use shared printer permissions to prevent others from sending their own jobs to the printer completely.

Beyond simply allowing or denying the ability to print to a given device, printer permissions also allow you to define the level of control that a user should have over a given printer. For example, you can allow some users to print, but not delete or change the order of other users' jobs that may already be in the print queue. Or, you may want a particular user to be able to manage all users' documents, or even change a printer's configuration settings if necessary. Printer permissions make all of these scenarios possible.

Windows Vista enables you to configure three primary printer permissions. These include:

  • Print. The Print permission enables users to send print jobs to a printer, and manage their own jobs. For example, a user with the Print permission can delete a print job that he has sent to the printer in error, if necessary. By default, the Print permission is assigned to the Everyone group.

  • Manage Printers. The Manage Printers permission gives a user complete control over a given printer. This includes the ability to print to the printer, and manage both his or her own and other users' print jobs. For example, a user with the Manage Printers permission can delete or pause another user's print job, if necessary. Additionally, users with the Manage Printers permission can change any and all of a printer's configuration settings. By default, Administrator users have the Manage Printers permission for all installed printers.

  • Manage Documents. The Manage Documents permission gives a user the ability to print to a printer, as well as manage print jobs belonging to other users. Effectively, this permission gives the user more power than the Print permission, but does not grant the ability to change printer settings.

Follow these steps to configure printer security settings on a Windows Vista system:

  1. Select Start → Computer

  2. Press the Alt key, and then select Tools → Folder Options.

  3. Click the View tab, scroll down and then uncheck the option marked Use Sharing Wizard (Recommended). Click OK.

  4. Select Start → Control Panel → Printers.

  5. Right-click the printer that you want to assign permissions to and select Properties.

  6. Click the Security tab (see Figure 16-16). Use the Add and Remove buttons to configure the list of users and groups that you want to grant access to the printer. Select each name to configure permissions that you want to allow or deny, and then click OK twice to exit.

Image from book
Figure 16-16: Reviewing printer permissions.

Printer permissions combine in much the same way as shared folder permissions. For example, if a user is granted the Allow Print permission, but is also a member of a group granted the Allow Manage Printers permission, that user's effective permission becomes Allow Manage Printers. Similarly, a printer permission that is denied always takes precedence over any permissions that are allowed.


Summary

Sharing resources like folders and printers on a network is one of the primary reasons for implementing a network in the first place. However, it's important to ensure that shared resources are properly secured in a manner that meets your needs and requirements. Failing to properly implement security settings puts your shared resources at risk, and may lead to them being accidentally deleted, modified, or otherwise misused. Keep the following points in mind when securing shared folders and printers:

  • Share folders and printers that you want other network users to access.

  • Configure shared folder and printer security settings so that users only have the level of access to the resource that they actually require.

  • Never give any user a greater degree of access to a shared resource than they require. For example, if you only want users to open and read files in a shared folder, grant them the Allow Read permission, rather than Allow Full Control.

  • If you want to stop all users from accessing a particular resource that is currently shared, disable its sharing setting.


Chapter 17: Securing Windows Vista on Wireless Networks

If ever there was a blessing bestowed upon home and small office users thinking about installing a network, it presented itself in the form of the wireless network. Gone are the days where running unsightly blue cables across floors, through walls, and into an overflowing closet was the only option for computer users with a penchant for sharing. Today, wireless networking makes it possible to share everything from printers to Internet access over nothing more than thin air.

Although there's no question that the latest and greatest wireless technologies make setting up a network easier than ever before, this is one path fraught with peril and security risks. Where wired network users seldom worried about anything more than having a good firewall in place to protect their Internet connection, wireless networks face threats from anyone within range of its signals. Compounding the issue is the fact that in their default configuration, wireless network devices offer no real security at all - any suitably equipped user within range can connect to the network and effectively do as they please.

With this in mind, taking the time to properly secure a wireless network and the Windows Vista systems connecting to it is absolutely critical. In this chapter you learn about wireless networking support in Windows Vista, along with the risks associated with leaving a wireless network unse-cured. Most importantly, you learn about the specific methods and wireless networking features that you can use to secure wireless devices, up to and including using strong encryption to protect all wireless communications on your network.

Windows Vista and Wireless Networking

Windows XP was the first Microsoft operating system to include built-in support for wireless networking, and this native support is continued (and improved) in Windows Vista. When equipped with a wireless network adapter card, a Windows Vista system needs no additional client software installed to connect to wireless networks. As long as the wireless network cards support it, a Windows Vista feature known as Automatic wireless configuration handles all the details of discovering and connecting to available wireless networks within range.

The name associated with this feature is somewhat misleading. Windows Vista automatically detects and prompts you to connect to unsecured wireless networks within range, but in cases where advanced security features like encryption protect a wireless network, at least a small amount of configuration is always required.

Image from book
Wireless A-B-G's

Wireless devices come in three main flavors - 802.11a, 802.11b, and 802.11g. Based on standards developed by the Institute of Electronics and Electrical Engineers (IEEE) and equipment manufactured by a variety of different companies, all wireless networking devices are not created equal. The letter that trails the 802.11 designation serves an important role in describing how a given wireless device communicates and interoperates with other wireless equipment:

  • 802.11a. These devices use the 5GHz frequency range to communicate at speeds up to 54Mbps, but cannot interoperate with 802.11b or 802.11g equipment.

  • 802.11b. The original wireless networking standard, these devices use the 2.4GHz frequency range to communicate at speeds up to 11Mbps, and can interoperate with newer 802.11g equipment.

  • 802.11g. These devices also use the 2.4GHz frequency range to communicate at speeds up to 54Mbps, and can interoperate with older 802.11b equipment.

802.11b and 802.11g wireless networking devices are much more popular than their 802.11a counterparts, and often considerably less expensive. However, these devices work in the same frequency range as a number of other wireless consumer electronics products (including cordless phones and speakers), making them more prone to interference issues.

Some manufacturers produce multimode wireless networking equipment that adheres to all three 802.11 wireless standards, a great option for users who move between different wireless networks frequently. For most home and small office users, however, choosing 802.11g devices represents the best long-term value in terms of speed, interoperability, and price.

Image from book

Although Windows Vista makes it easy to detect and connect to wireless networks, this capability is almost equal parts friend and foe. If you're configuring your own wireless network, you'll be happy when Windows Vista automatically discovers it. However, you probably won't be quite as thrilled when your neighbor's computer detects your wireless access point, allowing him to connect to your network, root through your shared files, and "borrow" on your high-speed Internet connection.

Although wireless networks implement little in the way of security or privacy features by default, all is not lost. You can fully secure a wireless network that includes Windows Vista systems to a level that rivals a traditional wired network. To properly secure a wireless network, however, you need to be familiar with the following:

  • How Windows Vista discovers and attempts to connect to wireless networks

  • Windows Vista wireless tools and configuration settings

  • The security risks associated with leaving wireless networks unsecured

  • How you configure security settings on wireless access points and Windows Vista wireless clients

The following sections outline Windows Vista's wireless networking processes and tools (as well as the security risks associated with unsecured wireless networks) in more detail. The techniques and steps necessary to secure wireless access points and their communications with Windows Vista systems are explored later in this chapter.

Windows Vista Wireless Settings

Windows Vista's wireless tools and configuration settings are effectively hidden from view until you install a wireless network adapter card in your computer. When your wireless network card is detected and installed, an icon for it is available through the Network Center tool in Control Panel and the Automatic wireless configuration service gets down to the business of scanning for wireless networks.

NOTIFICATIONS

Assuming that your wireless network card is installed correctly and that your wireless access point is powered on, Windows Vista almost instantly displays a notification message in your system tray stating that one or more wireless networks have been detected (see Figure 17-1).

Image from book
Figure 17-1: Notification about detected wireless networks

When you click the network icon below this message, the Network Center window opens. In the Network Details section, click the Connect To link and available wireless networks within range are displayed. Depending on your proximity to other wireless networks, it is possible that more than one wireless network will appear in the window shown in Figure 17-2.

Image from book
Figure 17-2: The Connect to a network window

To connect to your wireless network, select the appropriate network name from this screen, and then click Connect. When prompted with the message stating that this is an unsecured network, click Connect Anyway.

As part of the default connection process, Windows Vista acquires an IP address from your access point, and then displays the screen shown in Figure 17-3.

Image from book
Figure 17-3: A connected wireless network

WIRELESS NETWORK CONNECTION PROPERTIES

The majority of the Windows Vista wireless network settings are configured using Network And Sharing Center in Control Panel. To view these settings select Start → Network and click the Network And Sharing Center button. The Network And Sharing Center screen is shown in Figure 17-4.

Image from book
Figure 17-4: The Control Panel Network and Sharing Center tool

Some key wireless-related areas that you should be familiar with in the Network and Sharing Center window include:

  • Connect to a network. As the name suggests, click this link to view (and connect to) available wireless networks within range.

  • Manage wireless networks. Click this link to manage the order in which Windows Vista will connect to available wireless networks, and change settings associated with different wireless networks manually.

  • Set up a connection or network. This link, in the left sidebar, creates different types of network connections manually. Examples include setting up ad-hoc wireless networks, normal wireless network connections, Internet connections, VPN connections, and more.

  • Manage network connections. Use this link to manage settings associated with both wired and wireless network adapter cards installed on your Windows Vista system.

  • Diagnose and repair. If you're having trouble getting a network connection to function correctly, click this link to have Windows Vista attempt to diagnose and correct the problem.

Note

There are two main types of wireless networks that you need to be familiar with. A wireless network that does not include an access point is known as a computer-to-computer or ad-hoc network. Ad-hoc networks make wireless networking more flexible, in that they enable you to create a network between two or more computers without the need for an access point acting as an intermediary. Networks that include a wireless access point through which all wireless communications occur are known as infrastructure mode networks.

Configuration settings associated with specific wireless networks are explored later in this chapter.

Tip

If your Windows Vista system has a wireless network card installed that you're not using, disable it as a security precaution. To do this, select Control Panel → Network And Sharing Center → Manage Network Connections, right-click your wireless network card, and select Disable.

Security Risks on Wireless Networks

In the same way that you should never leave any computer or network connected to the Internet without the protection of a firewall, you should never leave any wireless network improperly secured. Although there's no question that the Internet - and its millions of users who can potentially connect to any computer anywhere worldwide - presents a bigger security risk overall, it's equally important to think locally. When a wireless user within range connects to your unsecured network, the firewall protecting your network has no say in the matter; the front door may be locked, but the back door is wide open.

Of course, you won't have an entire Internet's worth of users within physical range of your wireless network. In fact, there may only be one or two other wireless users close enough to connect. However, the fact that these users can potentially gain access to your private network by doing nothing more than clicking a button marked Connect presents a very real risk.

Tip

In reality, experienced users and hackers do not typically rely on the built-in wireless networking capabilities of Windows Vista to discover wireless networks within range. More commonly, they employ dedicated wireless network discovery tools that can track, map, and save details about networks as they're encountered. One great example of such a tool is Network Stumbler, available from http://www.netstumbler.com. In addition to being the network discovery tool of choice for those seeking out wireless networks, Network Stumbler is an excellent auditing tool that can help you determine what information your wireless network exposes under different security configurations.

Users within range who can connect to your unsecured wireless network can potentially:

  • Use or hijack your high-speed Internet connection

  • Gain access to your personal files and other resources on your private network

  • Make changes to the configuration of your wireless access point and its security settings

  • Capture all of your wireless network traffic, and track your communications

Not all users within range of your network are unscrupulous enough to connect to it without your permission, but temptation and curiosity get the best of many people. So, rather than gamble that others aren't using your wireless network, take the time to be sure they're not. After implementing the necessary security settings on your access point and wireless clients, other users within range should never be able to connect to your network.

Image from book
War Driving

It may sound very spy-versus-spy, but in well-populated areas a pastime known as war drivinghas become popular among those with a passion for wireless networking. With a name derived from an old-school hacking technique known as war dialing- where hackers use software and modems to automatically dial phone numbers in the hope that a computer answers on the other end - war driving (or walking for that matter) is becoming more popular.

A war driveris a wireless user who roams around, looking for wireless networks to connect to. Some look for a high-speed Internet connection to temporarily borrow, while others have more malicious motives aimed at accessing files and information stored on the network's computers. It's been estimated that more than half of all wireless networks are improperly secured, so there's no shortage of networks for these users to stumble upon and through.

Unfortunately, the potential security issues associated with techniques like war driving don't end with the user who just happens upon your network. Quite to the contrary, many of the people engaged in this hobby are well equipped, using laptops, external antennas, and even portable GPS (Global Positioning System) devices to map the precise locations of unsecured wireless networks - information that often ends up being posted (complete with detailed maps) on the Internet.

This isn't to say that everyone engaged in war driving has bad intentions. However, leaving any wireless network improperly secured poses real risks, of which access by war drivers is just another to consider. For more information on the wacky world of war driving, check out http://www.wardriving.com.

Image from book


Securing Wireless Access Points

Like most computing devices, wireless access points are pre-configured with factory default settings. Designed in a very plug-and-play fashion, you can usually take a brand new access point out of its box, plug everything in, and have your wireless network up and running in minutes.

Although this makes it exceptionally easy for any user to set up a wireless network, leaving default access point settings intact represents a serious security risk. At issue is the fact that wireless access points broadcast their network name automatically, making themselves visible to all wireless users within range. Unfortunately, these default network names are almost always the same, and identify the access point's manufacturer. Armed with this information, any user can easily obtain the device's default configuration settings online, including its administrative password.

As a best practice, always change the following settings on a wireless access point:

  • The password used to access the administrative interface

  • The wireless network name

The configuration of these settings is explained in more detail in the following sections.

Note

Wireless access points are manufactured by a variety of companies, each with their own lineup of different makes and models. Although most of these devices include similar features and capabilities, the steps that configure them can vary from one model to another. For precise details on configuring the security settings outlined in this chapter on your wireless access point, consult its user manual, Help file, or manufacturer's web site.

Changing the Default Administrator Access Password

Almost all wireless access points include an integrated web-based administrative interface for the purpose of making configuration changes. You gain access to this interface by opening your preferred web browser and entering the access point's management IP address, usually 192.168.1.1 or similar. Assuming that you've entered the address specified for your model, the access point's logon screen will appear.

To log on to the access point for the first time, you need to supply the default administrative password assigned to your model, and then click the Logon button.

Unfortunately, the passwords assigned to access points by default are inherently insecure due to the fact that they're so well documented. For example, the default password associated with some access points is the manufacturer's name, whereas in other cases it's blank or password. Just about anyone can find the default password associated with an access point in minutes - if not seconds - on the Internet.

Because wireless networks are not secure by default, changing your access point's administrative password is imperative. If you don't change this password, other wireless users may be able to connect to your access point's administrative interface and change its settings.

Follow these steps to change the password used to access the administrative interface of your wireless access point:

  1. Select Start → Internet Explorer, or open your preferred web browser.

  2. In the address box, type 192.168.1.1, or the correct address for your access point make and model. Press Enter.

  3. On the logon screen, type the default password specified in your access point's user manual. Click the Login button.

  4. When logged in, look for a section marked System or Passwords. On the SMC access point used in this example, passwords are changed from System → Password Settings, as shown in Figure 17-5.

    Image from book
    Figure 17-5: The password setting configuration screen

  5. Type the access point's current password, and then type your new password and confirm it. Be sure to protect the device with a strong password, according to the password best practices outlined in Chapter 3.

  6. Some access points include the capability to configure a setting called Idle Time Out. This setting controls how long a logged-in user session can remain idle before it is logged off automatically. Configure an appropriate setting (shorter time periods offer better security), and then click Save Settings.

Tip

Although all wireless access points include the capability to change the default administrative password to a new value, some also enable you to change the username used to log on. If your access point includes this capability, change both the username and password to unique values for added security.

Changing the Default Wireless Network Name

Along with a default administrative password, all wireless access points are configured with a default wireless network name. Known as a Service Set Identifier (SSID), this name distinguishes between wireless networks, and is typically configured with the access point manufacturer's name by default. For example, the default SSID name on most Linksys access points is usually linksys; the SMC access points typically use the SSID smc.

Access points broadcast their SSID name so that wireless clients can discover them. However, using the default SSID makes it easy for other users within range to identify the access point's manufacturer, and by extension, its default password. As a security precaution, always change the SSID of your wireless network to a unique (and less easily identified) value.

Follow these steps to change the SSID name on your wireless network:

  1. Select Start → Internet Explorer, or open your preferred web browser.

  2. In the address box, type 192.168.1.1, or the correct address for your access point make and model. Press Enter.

  3. On the logon screen, type your administrative access password. Click the Login button.

  4. When logged in, look for a section marked Wireless, Wireless Settings, or similar. On the SMC access point used in this example, the wireless network SSID is changed from Wireless → Channel And SSID, as shown in Figure 17-6.

    Image from book
    Figure 17-6: Configuring an SSID name for a wireless network

  5. In the box marked SSID (ESSID on some access points), type a unique name to identify your wireless network. As a general rule, don't choose a name that makes it easy to identify you personally, but do choose a word or name that you'll remember. When complete, click Save Settings.

Tip

Many wireless access points include built-in Ethernet switch ports for the purpose of connecting wired computers and other non-wireless components to your network. These models often include the ability to deny administrative interface access to wireless computers. If enabled, this setting provides an additional layer of security by restricting configuration of the access point to wired computers only. If your wireless access point includes this feature, enable it. Although it requires you to make configuration changes from a wired computer, it prevents other wireless users from tampering with your access point's settings.


Limiting Access to Wireless Networks

Changing the default SSID name and administrative password for your wireless access point are both important steps in helping to secure your wireless network. However, neither does anything to prevent other wireless users within range from forming an association with your access point, and effectively connecting to your network at will.

In this section, you learn more about two techniques that you can use to limit the exposure and accessibility of your wireless network. While neither offers complete protection from an experienced hacker, both are an important part of the defense-in-depth approach to network security, and should be implemented on all wireless networks.

These wireless security techniques explored in this section include:

  • Disabling broadcast of the wireless network name (SSID)

  • Implementing MAC address security

The following sections explore both of these wireless security procedures in more detail.

Disabling SSID Broadcast

By default, access points broadcast their SSID name as a way to announce their presence to wireless client systems. These broadcasts are heard by Windows Vista and used to display its list of available wireless networks within range.

Changing the SSID name is important insomuch as it stops the access point model (and its associated default password) from being easily discovered. However, this does nothing to stop the existence and availability of the network from being broadcast to all wireless clients within its range. If you want to stop your wireless network from being announced in this way, then you need to make it disappear.

To complete this magical act, you need to disable the SSID broadcast feature on your wireless access point. When SSID broadcast is disabled, Windows Vista and other wireless clients systems will not discover your network automatically, nor display it as an available wireless network for their users to connect to.

Follow these steps to disable SSID broadcast on your wireless router:

  1. Select Start → Internet Explorer, or open your preferred web browser.

  2. In the address box, type 192.168.1.1, or the correct address for your access point make and model. Press Enter.

  3. On the logon screen, type your administrative access password. Click the Login button.

  4. In the administrative interface, look for a section marked Wireless, Wireless Settings, or similar. On the SMC access point used in this example, the SSID broadcast setting is changed from Wireless → Channel And SSID.

  5. Select the option to disable SSID broadcast (see Figure 17-7), and then click Save Settings.

Image from book
Figure 17-7: Disable SSID broadcast to improve wireless network security

Disabling SSID broadcast stops your wireless network from announcing itself as "available" to Windows Vista systems and other wireless clients in range of your access point. However, without additional layers of security (such as encryption), users within range can still use a range of wireless network discovery tools to find your network. These tools do not rely on these SSID announcements to find wireless networks. Instead, they listen for wireless network traffic, extracting captured information to determine the details associated with networks within range. While disabling SSID broadcast offers a great way to "hide" your network from casual and less experienced wireless users, it does not make your wireless network completely invisible. Nonetheless, you should always disable SSID broadcast as a wireless security precaution and best practice.

There is a small downside to disabling SSID broadcast, namely that your own wireless client systems can no longer discover your wireless network automatically. Thankfully, it's easy to help your Windows Vista systems find these hidden wireless networks - all you need to do is manually configure them with the same SSID name used by your network.

Follow these steps to configure Windows Vista to connect to a wireless network that has SSID broadcast disabled:

  1. Select Start → Control Panel → Network And Sharing Center.

  2. Click Set Up A Connection Or Network.

  3. On the Connect To A Network window, click Set Up A Connection Or Network.

  4. On the Select A Connection Option screen, click Manually Connect To A Wireless Network and click Next.

  5. On the Enter Information For The Wireless Network You Want To Add screen, enter the SSID name of your wireless network. If you want Windows Vista to connect to the network automatically when it's in range, check the Start This Connection Automatically box. Additionally, select the Connect Even If The Network Is Not Broadcasting check box as shown in Figure 17-8. Click Next.

    Image from book
    Figure 17-8: Manually configuring the SSID name for a wireless network with SSID broadcast disabled

  6. Click Connect To; this establishes a connection to the network you've added.

Image from book
USB Flash Drive Easy Does It

In addition to the steps outlined in this chapter, it is also possible to configure wireless network settings easily using the Set Up A Network Wizard that is included with Windows Vista. This tool can automate the configuration of wireless network devices (including access points) through the use of a USB flash drive. If your access point includes a USB port and supports Windows Connect Now (generally mentioned on the product packaging), you may want to consider using the wizard and a USB flash drive to automate the configuration of your entire wireless network, including advanced settings like WEP or WPA security.

To make use of this Windows Vista feature, follow these steps:

  1. Select Start → Control Panel → Network And Sharing Center.

  2. Click Set Up A Connection Or Network.

  3. On the Select A Connection Option Screen, click Set Up A Network and click Next.

  4. On the Set Up A Home or Small Business Network screen, click Next.

  5. When the Wizard Detects Network Hardware But cannot Configure It Automatically screen appears, click Create Wireless Network Settings And Save To USB Flash Drive as shown in the following figure.

    Image from book

  6. 6. Complete the remaining steps in the wizard to save your settings to your USB flash drive. To use these saved settings to set up other Windows Vista computers on your wireless network, insert the USB flash drive, select Wireless Network Setup Wizard in the AutoPlay dialog box, and then complete the steps in the wizard.

Image from book

Implementing MAC Address Security

Hiding your wireless network is one way to limit its accessibility to outside users within range, but it doesn't stop more advanced users who can find the network from forming an association with your access point. Thankfully, almost all wireless access points include a feature to control exactly which systems can connect, in the form of Media Access Control (MAC) address security settings.

In the world of networking, MAC addresses (also known as physical or hardware addresses) are the individually unique identifiers that a manufacturer assigns to each and every network card. Although other addresses assigned to a network card may change (as is the case with IP addresses), a network card's MAC address belongs to it and it alone.

Knowing this, almost all access point manufacturers include a security feature in their products that enables you to configure a list of MAC addresses with which the access point is allowed to communicate. In other words, you configure the access point with a list of the MAC addresses assigned to wireless network cards in use on your network, and the access point denies communication attempts coming from network cards with MAC addresses that are not on this list.

MAC address security is not enabled on wireless access points by default, so it's up to you to find and then configure the correct addresses for the wireless computers on your network. MAC addresses are made up of 12 hexadecimal digits, usually displayed in a format similar to 00-90-4B-24-B9-10.

Follow these steps to determine the MAC address associated with your wireless network card:

  1. Select Start → All Programs → Accessories → Command Prompt.

  2. At the command line, type ipconfig /all and press Enter.

  3. In the Windows IP Configuration results, look for the section pertaining to your wireless network adapter card, as shown in Figure 17-9. Note the Physical Address value, which is the MAC address of your wireless network adapter card.

Image from book
Figure 17-9: Use the ipconfig /all command to find the MAC address associated with your wireless network card

When you acquire the MAC addresses for all of your wireless network cards, it's time to enable MAC address security settings on your access point.

Follow these steps to implement MAC address security on your wireless access point:

  1. Select Start → Internet Explorer, or open your preferred web browser.

  2. In the Address box, type 192.168.1.1, or the correct address for your access point make and model. Press Enter.

  3. On the logon screen, type your administrative access password. Click the Login button.

  4. In the administrative interface, look for a section marked MAC Address Security, Wireless MAC Filter, or similar. On the SMC access point used in this example, MAC address security settings are enabled and configured from Firewall → MAC Filter, as shown in Figure 17-10.

    Image from book
    Figure 17-10: You use the MAC filtering table to restrict access to a wireless network

  5. Select the option to enable MAC address control.

  6. In the MAC filtering table section, enter the MAC addresses of the wireless network cards used by clients on your network. Be careful to type these addresses correctly (case typically doesn't matter), because client addresses that do not appear in this list cannot connect to the access point. When finished, click Save Settings.

Implementing MAC address security helps to keep casual and inexperienced users from connecting to and making use of your wireless access point. As such, you should always use this technique to add another layer of protection to your wireless network.

However, it's also important to understand that MAC addresses can be spoofed, a technique whereby the burned-in MAC address assigned to a network card is replaced by another (some network cards allow you to change their MAC address to any value, while others require the use of spoofing utilities to do the trick). On wireless networks that do not use encryption, an experienced user can capture unsecured traffic, and then reconfigure their MAC address to one in use on the wireless network. Ultimately, this allows them to bypass MAC address security completely.


Securing Wireless Network Traffic with Encryption

Although you can use a variety of different methods to improve the overall security of a wireless network, you cannot truly consider a wireless network secure until you implement encryption settings. In the wireless world, two primary methods are used to encrypt network communications:

  • Wired Equivalent Privacy (WEP)

  • Wi-Fi Protected Access (WPA)

Both of these wireless encryption techniques are explored in more detail in the following sections.

Wired Equivalent Privacy

As part of developing the original 802.11b wireless networking standard, the need for a way to protect and secure wireless networks was already well understood. The solution developed to address the problem is called Wired Equivalent Privacy (WEP). As its name suggests, the idea behind this security scheme is to implement protective measures that would make a wireless network just as secure as the wired alternatives.

WEP functions by individually encrypting each and every packet sent between devices across a wireless network. It does this using a 64- or 128-bit encryption key stored on all WEP-enabled wireless devices. In some cases, the access point generates the key value, but you can also configure it manually. Ultimately, each device on the WEP-enabled wireless network must have the same encryption key value configured to securely encrypt and decrypt packets sent and received.

Unfortunately, the technique used to secure WEP encryption keys has proven to be flawed. With the right tools (and enough time), hackers can use a number of popular utilities to capture wireless traffic protected by WEP, crack its encryption key (the same key is used to encrypt all traffic), and ultimately gain access to these secured wireless networks.

Note

If you're interested in learning more about the vulnerabilities associated with WEP, an excellent analysis is available online at http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html.

Assuming that WEP is the only encryption option for your wireless devices, use the steps outlined in the following section to configure it on your access point and Windows Vista system.

Implementing WEP Security

To implement WEP on your wireless network, start by configuring the required settings on your wireless access point, as outlined in the following steps:

  1. Select Start → Internet Explorer, or open your preferred web browser.

  2. In the Address box, type 192.168.1.1, or the correct address for your access point make and model. Press Enter.

  3. On the logon screen, type your administrative access password. Click the Login button.

  4. In the administrative interface, look for a section marked Wireless, Wireless Security, WPA, or similar. On the SMC access point used in this example, the WEP encryption settings are configured by selecting Wireless → WEP, as shown in Figure 17-11.

    Image from book
    Figure 17-11: Configure WEP security settings on an access point

  5. In the WEP Mode section, select 128-bit.

  6. In the Key 1 section, type a 26-character key value, using hexadecimal digits only. Valid hexadecimal characters include letters A through F and the numbers 0 to 9. Write this number down for reference purposes, because you'll need it to configure WEP settings on Windows Vista.

  7. Click Save Settings.

  8. As you configure WEP settings, look for a setting in the administrative interface that enables you to specify which types of wireless clients should be allowed to connect to the access point. On the SMC access point used in this example, wireless client types are specified from Wireless → Security, as shown in Figure 17-12.

    Image from book
    Figure 17-12: Configuring allowed client types on an access point

  9. In the Allowed Client type list, select WEP Only, or WEP/WPA.

  10. Click Save Settings. If you're using a wireless connection to configure your access point, you will probably lose wireless connectivity until you configure the necessary WEP settings on your Windows Vista system.

Follow these steps to configure Windows Vista to connect to a network that uses WEP encryption:

  1. Select Start → Control Panel → Network Center.

  2. Click Connect to

  3. On the Connect To A Network window, select the name of your wireless network. A network protected by WEP is listed as a security-enabled network, as shown in Figure 17-13. Click Connect.

    Image from book
    Figure 17-13: Connecting to a wireless network that uses WEP security

  4. On the Type The Network Security Key Or Passphrase screen, enter the WEP key that you configured on your access point and click Connect.

  5. When the Successfully connected window appears, click Close.

Wi-Fi Protected Access

Based on WEP's shortcomings, the Wi-Fi Alliance (the wireless manufacturer's industry group) developed an alternative solution to secure wireless network traffic known as Wi-Fi Protected Access (WPA). Designed as an interim solution while the IEEE's 802.11 working group developed a new wireless security standard, WPA became the de facto standard for securely encrypting traffic on wireless networks.

One of the main benefits of WPA is that it was designed with existing wireless users in mind. Manufacturers of wireless networking equipment could add WPA support to existing devices by supplying new driver files for wireless network cards, and firmware upgrades for access points. As such, you can update almost any wireless device that lacks WPA support to include it, without the need for users to purchase new hardware. For details on upgrading wireless devices to include WPA support, see the sidebar later in this chapter.

Ultimately, the new protocols and security enhancements implemented by WPA make it the best option for securely encrypting traffic sent over a wireless network. For more details on the exact processes that WPA uses to perform its encryption process, see http://www.microsoft.com/technet/community/columns/cableguy/cg1104.mspx.

Note

In cases where wireless networking devices support both encryption methods, always use WPA or WPA2 as the secure alternative. You can upgrade most WEP-only devices to support WPA. However, in cases where WEP is your only encryption option, you should still use it - the protection that WEP offers is still better than using no encryption at all.

Use the steps outlined in the following section to configure WPA security on your access point and Windows Vista system.

Image from book
Gearing Up for WPA

Implementing WPA encryption on a wireless network isn't terribly difficult, but you must meet a few prerequisites to take advantage of the security it provides:

  • The wireless access point must include WPA support.

  • The wireless network cards in your Windows Vista systems must use drivers that include WPA support.

To check whether your wireless access point includes WPA support, log on to its administrative interface and review the settings in its wireless security configuration area. If WPA is listed, support is built-in. If WEP is the only wireless security option displayed, you need to download and install a firmware update for your access point, as outlined in the next sidebar.

Although most wireless network card manufacturers now ship their products with driver installation packages that already include WPA support, you often need to update existing drivers. If you find that WPA configuration options do not appear on your Windows Vista system, then you almost certainly need to update the drivers for your wireless network card.

Begin by determining the exact make and model of your wireless network card. You can find this information in Device Manager, accessible from the Computer Management MMC. To open Computer Management, click Start, right-click Computer, and then select Manage. Expand Device Manager → Network adapters, and then right-click your wireless network card and select Properties. If you click the Driver tab, the make and model of your wireless network card is listed, along with its current driver version as shown in the following figure.

Image from book

With the necessary information in hand, visit the manufacturer's web site and search for an updated driver for your model that includes WPA support. Download the file, and then follow the instructions for installing it as outlined by the manufacturer.

Image from book

Implementing WPA Security

To implement WPA on your wireless network, start by configuring the required settings on your wireless access point, as outlined in the steps below:

  1. Select Start → Internet Explorer, or open your preferred web browser.

  2. In the Address box, type 192.168.1.1, or the correct address for your access point make and model. Press Enter.

  3. On the logon screen, type your administrative access password and click the Login button.

  4. In the administrative interface, look for a section marked Wireless, Wireless Security, WPA, or similar. On the SMC access point used in this example, the WPA encryption settings are configured from Wireless → WPA, as shown in Figure 17-14.

    Image from book
    Figure 17-14: Configuring WPA security settings on an access point

  5. In the Cipher suite or protocol drop-down menu, select TKIP.

  6. In the Authentication section, select Pre-shared Key.

  7. In the Pre-shared Key Type section, select Passphase.

  8. In the Pre-shared Key text box, type your passphrase. Follow the same best practices as you would when configuring any strong password. You can find out more about what constitutes a strong password in Chapter 3.

  9. Click Save Settings.

  10. As you configure the WPA settings, look for a setting in the administrative interface that allows you to specify which types of wireless clients should be allowed to connection to the access point. On the SMC access point used in this example, wireless client types are specified from Wireless → Security.

  11. In the Allowed client types list, select WPA Only.

  12. Click Save Settings. If you're using a wireless connection to configure your access point, you will probably lose wireless connectivity until you configure the necessary WPA settings on your Windows Vista system.

Tip

If you make a mistake when configuring WPA settings and find yourself locked out of your access point, consult the manual supplied with the device. Most access points include a reset button that you can press to restore the device to its original factory settings.
Image from book
Upgrading Router Firmware

If your wireless access point doesn't currently include WPA support, chances are that you can add it at no cost via a firmware upgrade. Firmware is the code (similar to an operating system) stored on a router that determines its features and capabilities. Manufacturers regularly post updated firmware files on their web sites for their various access point models.

In some cases, you must download a dedicated utility to perform the upgrade. However, many access points include a built-in tool for updating to the latest firmware version. For example, the SMC access point used in this chapter includes such a tool under Tools → Firmware Upgrade, as shown in the following figure.

Image from book

In this case, you would download the latest firmware version from the manufacturer's web site, and then use this tool to upload it to your access point.

Prior to upgrading your access point's firmware, it's important to ensure that you have its correct make and model number handy, as well as details about its current firmware version. You can usually find this information in the access point's administrative interface in a section named System.

Beyond adding new features, firmware updates are also released for the purpose of addressing known security issues. As a general rule, you should check for firmware updates to your wireless access point at least once every 2–3 months.

Image from book

Follow these steps to configure Windows Vista to connect to your WPA-protected wireless network:

  1. Select Start → Control Panel → Network Center.

  2. Click Connect To.

  3. On the Connect To A Network window, select the name of your wireless network. A network protected by WPA is listed as a Security-enabled Network. Click Connect.

  4. On the Type The Network Security Key Or Passphrase screen, enter the WPA passphrase that you configured on your access point as shown in Figure 17-15 and click Connect.

    Image from book
    Figure 17-15: Connecting to a wireless network using WPA security

  5. When the Successfully Connected window appears, click Close.

Note

The next generation of WPA, known as WPA2 or 802.11i, has recently been standardized and is already being implemented in newer wireless networking devices. WPA2 uses the Advanced Encryption Standard (AES) for data encryption, and the necessary support for this new version is built into Windows Vista. Where many older wireless access points could be upgraded to support WPA via nothing more than a simple firmware update, the same is not necessarily true for WPA2. You may be able to add WPA2 support to newer access points by installing new firmware, but many older devices do not have the necessary hardware capabilities to handle AES encryption and you will need to replace them. If you're in the market for a new wireless access point, consider a model that includes WPA2 support, or one that you can update to include it. As the new wireless encryption standard, WPA2 represents an excellent long-term investment in the continued security of your wireless network.


Summary

Wireless LANs offer an unparalleled level of convenience when setting up a home or small office network, but their default configuration settings are inherently insecure and represent a serious security threat. If these settings are left as-is, other users within range can connect to your private network, use your Internet connection, and even change the configuration of your wireless router. Keep the following points in mind when implementing a wireless network:

  • Always change the default SSID and administrative passwords used on your wireless access point.

  • Disable SSID broadcast on your access point to stop your wireless network from being announced to wireless clients within range.

  • Enable MAC address security to control which wireless clients can form an association with your access point.

  • Implement WPA security on your wireless network for the highest level of protection possible. If WPA security is not available, use WEP encryption.


Part VII: Appendixes

Appendix List

Appendix A: Reinstalling Windows Vista
Appendix B: Helpful Windows Vista Security Web Sites


Appendix A: Reinstalling Windows Vista

In the vast majority of instances a Windows Vista system that's been riddled by viruses and mal-ware can be cleaned up and then re-secured using the tools and techniques outlined in this book. In the case of a severe infestation, however, you may be left with little choice but to reinstall Windows Vista and start from scratch. Although reinstalling Windows Vista is often considered to be an extreme measure, it's all a matter of perspective - would you rather spend three hours desperately trying to reclaim your existing system (with no guarantees of success), or spend that same time reinstalling your operating system, programs, and then restoring your personal files? The first option may end up being a more interesting journey, but the second gets rid of outstanding issues for good and gives you a chance to start all over again with a clean and (this time) properly secured system.

This appendix walks you through the tasks involved with reinstalling a Windows Vista system from scratch. The step-by-step instructions outline the standard Windows Vista installation process, but important pre-and post-installation tasks are also outlined for reference purposes.

Pre-Installation Tasks

If you jump straight into the process of reinstalling Windows Vista without giving anything else a thought, you'll almost certainly be sorry. When you reinstall Windows Vista from scratch, the end result is a sparkling, like-new system - one in which all of your installed programs and personal files are missing, however. Therefore, it's critically important that you consider the points listed in this section. If you don't, you're bound to lose access to important documents, images, e-mail messages, and even encrypted files along the way.

Prior to performing a clean installation of Windows Vista, complete the following tasks:

  • Back up all personal files to another computer, external hard drive, or writeable CD or DVD. In most cases, include the contents of your My Documents folder, and other folders you may have used to store documents, images, videos, music files, e-mail messages, address books, and so forth. If multiple users share access to the computer, ensure that their files are backed up as well. For details on backing up personal files see the article "Backup and You" at http://www.pcmag.com/article2/0,1759,1883696,00.asp.

  • Back up any program installation files or hardware drivers that you will require after Windows Vista is reinstalled.

  • Back up all of your personal certificates (such as those used by EFS or encryption programs), including private keys. If you fail to back up these certificates and private keys, you won't be able to open existing encrypted files or e-mail messages.

  • Make note of serial numbers for installed programs if you don't have them written down already.

  • Make note of information such as ISP connection details (phone numbers, network settings, and so on) and any other miscellaneous pieces of information that you might require after the Windows Vista installation process is complete.

  • Gather all necessary CD and DVD discs that you'll require during the installation process before you get started.


Installing Windows Vista

As daunting as the process of reinstalling your entire system may seem, the actual Windows Vista installation process is probably the easiest part. If you can insert a CD and answer the basic questions posed by the wizard-style installation interface, you'll be just fine. It depends on the speed of your computer, but you can generally expect that it will take anywhere from 45 minutes to 2 hours to reinstall Windows Vista start to finish.

Caution

Be sure to complete the tasks outlined in the pre-installation tasks section prior to reinstalling Windows Vista. The following steps will perform a clean installation of Windows Vista, meaning that all personal files, programs, and other existing settings stored on your hard drive will be lost.
Note

The following instructions assume that you are performing a clean installation of Windows Vista using the full (not upgrade) version of the product. If you are performing the installation with a Windows Vista upgrade disc, you will be prompted to supply the CD relating to your previous operating system's full version during the process.

Follow these steps to perform a clean installation of Windows Vista:

  1. Power on your computer and insert your Windows Vista installation CD.

  2. Restart your computer with the Windows Vista CD inserted. When the Press Any Key To Boot From CD Or DVD message appears, press the spacebar (or, well, any other key).

  3. At the initial Windows Vista installation screen, select your installation language, time and currency format, and input language. Click Next.

  4. Click the Install Now button.

  5. At the Type Your Product Key For Installation screen, enter the 25-digit product key provided with your Windows Vista DVD and click Next.

  6. On the license agreement screen, select I Accept The License Terms and click Next.

  7. At the Which Type Of Installation Do You Want? screen, click Custom (advanced).

  8. On the Where Do You Want To Install Windows? screen, click the partition on which Windows Vista should be installed and click Next.

  9. After all files have been copied and installed, your PC will restart and the Windows Vista installation process will continue. Select your country or region and keyboard layout, and then click Next.

  10. At the Choose A Username And Picture screen, enter a username and password, and then click Next.

  11. On the Type A Computer Name And Choose A Desktop Background screen, enter a name for your computer, pick a desktop background image, and click Next.

  12. At the Help Protect Windows Automatically screen, click Use Recommended Settings.

  13. At the Review Your Time And Date Settings screen, pick the correct time and date settings for your location and click Next.

  14. On the You're Ready To Start screen, click Start.

Congratulations - you've successfully reinstalled Windows Vista! It's now time to move on to the critically important post-installation tasks.


Post-Installation Tasks

The hard work really begins after the Windows Vista installation process is complete. Not only do you have to install the regular programs that you use on a day-to-day basis, but you also need to restore your personal files and settings, and get down to the business of securing Windows Vista so that the chances of having to go through this process again in the future (at least for security reasons) are next to nil.

After the Windows Vista installation process is finished, complete the following tasks:

  • Install your preferred anti-virus program and update it with the latest virus definition files. Run a complete virus scan of your computer.

  • Install your preferred anti-spyware program and update it with the latest spyware definition files. Run a complete spyware scan of your computer.

  • Install your firewall program, preferably one that includes both inbound and outbound filtering capabilities.

  • Visit the Windows Update web site to download and install all critical Windows Vista updates.

  • Create standard user accounts for each person who will be using your Windows Vista system, and ensure that each account is password-protected.

  • Have each individual user log on and add a strong password to his user account.

  • Restore any files, settings, and certificates that you've backed up, including those belonging to other users. When complete, scan all drives with your antivirus and antispyware programs.

  • Install any additional programs that you require for day-to-day use, such as office suites, alternative web browsers, and so forth.

Your newly reinstalled Windows Vista system is now secured and ready to enjoy!


Appendix B: Helpful Windows Vista Security Web Sites

Keeping your Windows Vista system properly secured is a little more involved than simply following a series of steps once and then hoping for the best. Keeping any PC secured is more accurately described as an ongoing process - one in which you need to stay abreast of all the latest security threats, and then address them accordingly. New security threats (or variations of existing threats) pop up all the time, and as the size and speed of the Internet grows, so to do the number of risks that you and your Windows Vista system are likely to encounter.

Thankfully, it's fairly easy to keep informed about all of the latest security risks making the rounds on the Internet and to obtain the necessary information to keep your Windows Vista system protected. This appendix outlines some of the more useful Windows Vista web sites that are worth visiting regularly in your quest to maintain a clean, secure system.

Windows Vista Home Page

The official Windows Vista Home Page isn't dedicated to security, but it is a portal to all things Windows Vista and worth a visit from time to time. Visit the Windows Vista Home Page online at http://www.microsoft.com/windowsvista/.


Windows Help and Support Page

When you have Windows Vista questions and want answers, head to the Windows Help and Support Page at http://www.windowshelp.microsoft.com/. This page will keep you up-to-date on all the latest Windows Vista news, and the site's Solution Center is your gateway to hundreds of howto articles, troubleshooting resources, and Windows Vista downloads.


Microsoft Security Home Page

The Microsoft Security Home Page is the perfect resource for users who want to stay abreast of all the latest security threats, warnings, and updates related to Windows Vista. Accessible at http://www.microsoft.com/security/default.mspx, this site provides a wealth of useful security information in plain English, and includes the ability to receive security notifications by e-mail or RSS feeds.


TechNet Security Home Page

If you're of a more technical inclination and find the regular Microsoft Security Home Page a little limiting, check out the Microsoft TechNet Security Center home page at http://www.microsoft.com/technet/security/default.mspx. TechNet is Microsoft's premier resource for IT professionals, but it's also an excellent resource for more advanced Windows Vista users who want to dig a little deeper on the security front.


Windows Vista Security and Protection

The Windows Vista Security and Protection web site is a great source of information relating to new security features and recommended settings for securing a Windows Vista system. It is especially useful for system administrators who manage networks that include many Windows Vista systems, and it's a great resource for advanced users looking for more insight into Windows Vista security features. The Windows Vista Security and Protection web site can be found on the TechNet web site at http://www.microsoft.com/technet/windowsvista/security/default.mspx.


Windows Vista Community

The Windows Vista Community site is an online community for Windows Vista users who want to learn more about these operating systems' features and capabilities. Many of the site's experts write about a wide variety of security-related topics in a simple and jargon-free fashion. To access the Windows Vista Community site, visit http://www.microsoft.com/windowsvista/community/.


PC Magazine Security Watch

Keeping any computer secured is all about staying informed, and when you want the skinny on all of the latest developments in the world of PC and Internet security, head for the PC Magazine Security Watch web site at http://www.pcmag.com/category2/0,1874,12,00.asp. Here you'll find all of the late-breaking security news that every PC user should be aware of, along with features, articles, and tips that will help you keep your PCs and networks more secure.


The Elder Geek on Windows Vista

The Elder Geek on Windows Vista site isn't dedicated to Windows Vista security alone, but it does include a wide variety of tips, tricks, and articles related to just about every facet of Windows Vista. Whether you're looking for step-by-step instructions for performing a particular task or details about a Windows Vista component, chances are good that this site will have what you're looking for. Fire up your web browser and head to http://www.theeldergeekvista.com to check it out.


Index

Note to the Reader: Throughout this index boldfaced page numbers indicate primary discussions of a topic. Italicized page numbers indicate illustrations.

A

access
to files. See files
to games and other programs, 96, 98, 99-100
in Internet Explorer, 78-80, 79-80
physical, 50-51
to wireless networks, 299-305, 300-304
Access Manager program, 46
access points, 295-296, 310-311, 311
Account Is Locked Out option, 41
Account Lockout Duration setting, 38, 41
Account Lockout Policy settings, 38, 40-42, 41
Account Lockout Threshold setting, 38, 41
Account Policies setting, 60
accounts, user. See user accounts
"acting as a server" programs, 114
Action screen, 119, 120, 121
activities, user, 101-102, 101-102
Activity Viewer screen, 101, 101
Ad-Aware program, 168, 176-178, 177
ad-hoc networks, 294
add-ons management in Internet Explorer, 81-83, 82
Add or Remove Snap-in window
for add-ons, 83
for Group Policy Object Editor, 64, 64
Add Printer Wizard, 284
Add Recovery Agent Wizard, 243-244, 244
Add Sender to Blocked Senders List option, 192
Add Sender to Safe Senders List option, 192
Add senders' certificates to my Windows Contacts option, 223
addresses
e-mail, 184-185, 200-201
MAC, 303-305, 303-304
Administrator accounts
hidden, 20
overview, 14
User Account Control for, 24-26
for wireless networks, 296-297, 297
Advanced Attributes window, 245-246, 245, 248
Advanced Encryption Standard (AES) algorithm
benefits, 250
for WPA2, 313
Advanced Privacy Settings dialog box, 75, 75
Advanced Security Settings window, 222-223, 222
Advanced Security tool, 124
Advanced Sharing window, 279, 279
Advanced tab for Windows Firewall, 112, 113
adware, 163-164, 164
AES (Advanced Encryption Standard) algorithm
benefits, 250
for WPA2, 313
alert messages, 74
Alerts service, 140
Allow Read permission, 237, 279
Allow Read to the Everyone group permission, 277, 280
Allow This Web Site setting, 78
Allowed items tool, 173
Always encrypt to myself when sending encrypted e-mail option, 223
anti-spam software, 196-199, 197
anti-spyware software
definition files for, 170, 170
installing, 168-169, 169
scanning with, 170-172, 171-172
tools for, 172-174, 173
in Windows Vista installation, 319
anti-virus software
configuring, 150-153, 151-153
definition files for, 149-150, 150
installing, 146-148, 148-149
scanning with, 153-154, 154
in Windows Vista installation, 319
Any computer firewall option, 124
Application Restrictions screen, 100, 100
Approved Sites tab, 78, 79
asymmetric encryption, 207
attachments, e-mail, 134, 152, 152
AuditMyPC port scanner, 129
authentication, 208
Automatic wireless configuration, 289-290
Autoresponders, 187
AVERT Stinger, 156-158, 157-158
AVG Anti-Virus program, 147
configuring, 150-153, 151-153
definition files for, 149-150, 150
installing, 148, 149
scanning for viruses, 153-154, 154
AVG First Run screen, 148
AVG Free Edition Test Center screen, 148, 149
AVG Plus Firewall Edition firewall, 125
AVG Resident Shield window, 151, 151
AVG Update File Download window, 149


Previous Page
Next Page

Index

B

batteries, CMOS, 48
Bayesian filtering, 198
beacons for spam, 186-187, 187
BearShare program, 164, 164
BHOs (Browser Helper Objects), 165
BIOS
for boot source, 267-268
passwords, 47-48, 47
settings, 46
BIOS Password configuration screen, 47-48
blacklists in spam filtering, 199
Block or Allow Specific Games link, 98
Block The Connection option, 119, 121
Block web content automatically section, 97
blocked sender lists, 191-192, 192
Blocked Top-Level Domain List window, 193, 193
blocking connections, 117-118
inbound, 121-122, 121-122
outbound, 119-121, 119-120
bootable CDs for erasing disks, 267-268
bootable disks, bypassing passwords with, 46
Broadband Reports port scanner, 129
broadcasts, SSID, 299-301, 300-301
Browser Helper Objects (BHOs), 165
browser hijacks
eliminating, 178-179, 178-179
overview, 164-165
browsers, 69
Internet Explorer. See Internet Explorer
other, 87-88, 88
browsing for folders, 282-283, 283
browsing history lists, 264-266
business environments, content filtering in, 102-103
bypassing passwords, 46, 48


Previous Page
Next Page

Index

C

CA Spyware Encyclopedia web site, 179
CAcert CA, 211
CAs (Certificate Authorities), 206
cases, locking, 50-51
CastleCops web site, 83, 179
CCleaner tool, 266, 266
CDs
bootable, 46, 48
for erasing disks, 267-268
CERT Coordination Center, 158
Certificate Authorities (CAs), 206
Certificate Export Wizard dialog box, 214
Certificate Export Wizard welcome screen, 213, 249
Certificate Import Wizard, 250
certificate revocation lists (CRLs), 214
certificates
EFS, 248-250, 249
example, 209-210
managing, 211-214, 212-214
obtaining, 210-211
in public key cryptography, 205-206
revoking, 214-215
Certificates MMC, 213-214
certmgr.msc command, 248
Change an Account window, 18, 20-21
Change permission, 277
Change settings screen, 137, 137
Change Your Password screen, 40
changing passwords, 33-34
Chat history, 265
Check for revoked Digital IDs option, 223
Check for updates but let me choose whether to download and install them option, 137
Check This Website option, 85
children, parental controls for. See parental controls
Choose A Username And Picture screen, 319
cipher command, 243, 243
clean installation of Windows Vista, 318-319
Clean Private Data option, 266
Clear Log option, 57
CLSID/BHO List/Toolbar Master List, 83
CLSIDs, 83
CMOS battery, 48
Co-owner option for shared folders, 275
Comodo CA, 211
Computer Management MMC, 41-42
computer-to-computer networks, 294
configuring
account lockout policy settings, 40-42, 41
anti-virus software, 150-153, 151-153
file and folder settings, 234-237, 235, 237
Internet Explorer
privacy settings, 74-78, 75-77
zone settings, 70-74, 72-73
Local Computer Policy, 62-66, 63-65
Local Security Policy, 60-61, 60, 62
password policies, 38-40, 39-40
Windows Firewall
exceptions, 113-116, 114-116
overview, 109-110
Confirm Erasing dialog box, 261-262, 261
Connect Private Disk window, 252
Connect to a network window, 291-293, 292, 301, 313
connections
blocking, 117-118
inbound, 121-122, 121-122
outbound, 119-121, 119-120
enabling and disabling, 112-113, 113
to shared folders, 280-283, 281-283
to shared printers, 284-285, 285
to wireless networks, 292-294, 293
Content Advisor, 78-79, 79
content filtering
in business environments, 102-103
for parental controls, 95-97, 98
ratings for, 78-79, 79
content zones, 70-74, 72-73
ContentProtect program, 96
Contributor option for shared folders, 275
CONVERT.EXE utility, 231-232, 231
converting FAT file systems to NTFS, 231-232, 231
cookies
blocking, 76, 76
as malware, 163
malware infection through, 166
privacy settings for, 74
storing, 265
CoolWebSearch browser hijacker, 178-179, 178-179
Create A Password For Username's Account screen, 21
CRLs (certificate revocation lists), 214
cryptography. See encryption
Cryptography FAQ, 209
CSLIDs, 81
Custom list option, 124
CWShredder program, 178-179, 178-179
CYBERsitter program, 96


Previous Page
Next Page

Index

D

dangers
e-mail, 204-205
malware, 167-168
online, 91-92
wireless networks, 294-295
Darik's Boot tool, 267-268
data miners, 163
Data Recovery Agent (DRA), 242-244, 243-244
Data tab, 263
definition files
spyware, 170, 170
virus, 149-150, 150
Dekart Private Disk Light encryption program, 250-253, 251-252
Delete Browsing History option, 266
deleted file recovery, 257-258, 258
deleting
browsing history lists, 266
files, 255
erasing, 259-263, 260-263
formatting for, 257, 257
Recycle Bin for, 256-257, 256
partitions, 257, 257
user accounts, 23-24, 23
Destination Location screen, 177
Details tab for certificates, 212, 212
Device Manager, 309-310, 310
Devices with Removal Storage section, 252, 252
Diagnose and repair link, 293
dialers, 163
digital certificates
EFS, 248-250, 249
example, 209-210
managing, 211-214, 212-214
obtaining, 210-211
in public key cryptography, 205-206
revoking, 214-215
digital signatures
sending and receiving messages with, 215-218, 216-219
working with, 207-208
Digitally Sign All Outgoing Messages Only option, 222
Disabled option for Local Computer Policy, 64
disabling
browser add-ons, 81-83, 82
firewall connections, 116
Sharing Wizard, 272, 276, 277
specific connections, 112-113, 113
SSID broadcasts, 299-301, 300-301
Disk Management tool, 257
disks
CDs and floppy
bootable, 46, 48
password reset, 23, 43-44, 43
hard
erasing, 266-268
passwords for, 49
mapping, 281-282, 281-282
private, 250-253, 251-252
Do not allow attachments to be saved or opened that could potentially be a virus option, 196
Do Not Ask For The Update Source Next Time option, 149
Documents folder, 232-233
dollar signs ($) for hiding shared folders, 280
Download Images section in Windows Mail, 196
Download updates but let me choose whether to install them option, 137
downloading
updates, 138-139, 138
virus definitions, 149-150, 150
DRA (Data Recovery Agent), 242-244, 243-244
drive-by downloads, 165, 175
drives. See disks
driving, war, 295


Previous Page
Next Page

Index

E

e-mail
attachments, 134, 152, 152
encryption for. See encryption
passwords, 36
phishing, 85
risks, 204-205
signing, 215-218, 216-219
spam. See spam
e-mail addresses
harvesting, 184-185
protecting, 200
replacing, 200-201
E-mail Scanning Details window, 152
eavesdropping, 204
Edit the Allow and Block List link, 97
EFS (Encrypting File System), 240-241
Data Recovery Agents for, 242-244, 243-244
keys in, 248-250, 249
operation of, 241-242
process, 244-248, 246-248
802.11 standards, 290
Elder Geek on Windows Vista site, 322
Enabled option for Local Computer Policy, 64
enabling
logging settings, 123, 123
parental controls, 96-100, 97-100
Remote Assistance, 114, 115
scope settings, 123-124, 125
specific connections, 112-113, 113
Encode message before signing (opaque signing) option, 223
encoding settings for junk e-mail, 193, 193
Encrypt All Messages option, 222
Encrypting File System (EFS), 240-241
Data Recovery Agents for, 242-244, 243-244
keys in, 248-250, 249
operation of, 241-242
process, 244-248, 246-248
encryption, 203, 208-209, 239
certificates for. See certificates
EFS. See Encrypting File System (EFS)
example, 209-210
public key cryptography, 205-208
sending and receiving messages, 219-224, 220-222, 224
third-party programs, 240, 250-253, 251-252
wireless networks, 305
WEP, 305-308, 306-308
WPA, 308-313, 308-313
Encryption Details window, 246, 246, 248
Encryption Password window, 251
Enforce Current Settings option, 97
Enforce Password History option, 37, 39
Eraser dialog box, 262, 262
Eraser Report window, 262, 262
Eraser tool, 259
erasing files with, 261-262, 261-262
settings for, 259-260, 260
for unused disk space, 263, 263
erasing hard drives, 266-268
eTrust PestPatrol Anti-Spyware program, 169
Event ID numbers, 57
Event Viewer, 42, 55-58, 56-58
exceptions, Windows Firewall, 113-116, 114-116
Exceptions tab, 114-116, 114-116
Export File Format screen, 213, 213, 249
Export Private Key screen, 213, 249


Previous Page
Next Page

Index

F

Failure Audits in Security log, 56
false positives in spam filtering, 198
FAT and FAT32 file system
converting to NTFS, 231-232, 231
vs. NTFS, 230-231
FDISK tool, 257
File and Printer Sharing feature, 272
File Encryption Key (FEK), 241-242
File Scavenger program, 258, 258
File to Export screen, 213, 214, 249
files, 229
deleting, 255
erasing, 259-263, 260-263
formatting for, 257, 257
Recycle Bin for, 256-257, 256
encryption for. See encryption
file systems in, 229-232, 230-232
passwords for, 36
in personal and Public folders, 232-233, 233
recovering, 257-258, 258
security settings for, 234-237, 235, 237
sharing. See shared folders
filtering
in business environments, 102-103
firewalls for. See firewalls
junk e-mail, 190, 190
MAC addresses, 304, 304
for parental controls, 95-97, 98
ratings for, 78-79, 79
spam, 196-199, 197
financial costs of malware, 168
Firefox browser, 87, 88
FireHole program, 129
firewalls, 107
hardware, 127-128
inbound filtering, 108-109
outbound filtering, 109
purpose, 108
testing, 128-131, 130-131
third-party, 125-127
Windows Firewall. See Windows Firewall
in Windows Vista installation, 320
firmware, router, 312, 312
First Run wizard, 148
First Time Help screen, 131
Flash plug-in, 81
floppy disks
for erasing disks, 267-268
password reset, 23, 43-44, 43
folders
browsing for, 282-283, 283
personal and Public, 232-233, 233
settings for, 236-237, 237
shared. See shared folders
Forgotten Password Wizard, 43
Format dialog box, 252
formatting
partitions, 257, 257
private disks, 252
419 messages, 188-189
freeware, 163
Full Control permission
for files, 234
for folders, 236
for shared folders, 277
Full scan for malware, 171


Previous Page
Next Page

Index

G

game access, 96, 98, 99-100
General System Information screen, 102, 102
General tab
for account lockout, 41
for certificates, 221
for encryption, 245
for file systems, 230, 230
for Security log, 57
for Temporary Internet files, 265
for Web content, 79, 80
golden rules of Windows security, 4-5
Group Policy Object Editor, 64, 64
Guest account, 16, 16
Gutmann erasing method, 259


Previous Page
Next Page

Index

H

hard drives
erasing, 266-268
passwords for, 49
hardware firewalls, 127-128
harvesting e-mail addresses, 184-185
Help Protect Windows Automatically screen, 319
heuristic analysis, 151
hiding shared folders, 280
High option for junk e-mail filters, 190
High security level for Internet Explorer, 72
hijacks, browser
eliminating, 178-179, 178-179
overview, 164-165
HijackThis tool, 180
hints, password, 22
history items, Internet, 264-266, 264-266
HOSTS file for malware, 175


Previous Page
Next Page

Index

I

ICF (Internet Connection Firewall), 109
ICRA (Internet Content Rating Association), 78
identity theft, 33, 167
Idle Time Out setting, 297
IDs tab, 217, 218
IE Security Zone settings, 195
IE-SPYAD2 utility, 74
inbound connections, blocking, 121-122, 121-122
inbound filtering by firewalls, 108-109
Include my digital ID when sending signed messages option, 223
information bar in Internet Explorer, 84-85, 84
infrastructure mode networks, 294
Install updates automatically (recommended) option, 137
installing
anti-spyware software, 168-169, 169
anti-virus software, 146-148, 148-149
Windows Vista. See reinstalling Windows Vista
International tab, 193
Internet
history items for, 264-266, 264-266
malware tracking on, 167
parental controls. See parental controls
Internet Connection Firewall (ICF), 109
Internet Content Rating Association (ICRA), 78
Internet Explorer, 69-70
access settings in, 78-80, 79-80
add-ons management, 81-83, 82
information bar, 84-85, 84
Phishing Filter, 85-87, 86
pop-up windows, 83-84, 84
privacy settings, 74-78, 75-77
zone settings, 70-74, 72-73
Internet Explorer Content Advisor settings, 78
Internet Options dialog box, 265, 265
internet service passwords, 36
Internet Service Providers (ISPs) and passwords, 36
Internet zone, 71
Intranet zone, 71
ipconfig /all command, 303, 303
ipsCA CA, 211
IPSec Policies section, 61
ISPs (Internet Service Providers) and passwords, 36


Previous Page
Next Page

Index

J

junk e-mail
filters, 190, 190
regional and encoding settings, 193, 193
Junk E-mail Options window, 194, 194


Previous Page
Next Page

Index

K

K9 program, 197
Kazaa program, 164
keyloggers, 162
keys
EFS, 248-250, 249
FEK, 241-242
product, 319
public. See public key cryptography
WEP, 307


Previous Page
Next Page

Index

L

laptop computers
encryption for, 240
theft, 51
LeakTest program, 129
length, password, 30
levels in Internet Explorer security, 71-72, 72
License Agreement screens
Ad-Aware, 176
CWShredder, 178
Windows Vista installation, 319
List Folder Contents permission, 236
Local Computer Policy settings, 62-66, 63-65
Local Hard Drives option, 263
Local Policies in Local Security Policy, 61
Local Security Policy settings, 38, 41, 60-61, 60, 62
Local Security Settings window, 39-40
locking cases, 50-51
lockout, account, 38, 40-42, 41
logon attempt tracking, 42
logon security, 12
logs
Security, 42, 55-58, 56-58
settings, 122-123, 123
loopback addresses, 175
Low option for junk e-mail filters, 190
Low security level for Internet Explorer, 71


Previous Page
Next Page

Index

M

MAC (Media Access Control) addresses, 303-305, 303-304
MailWasher Pro program, 197, 197
Make Changes To Your User Account screen
for creating accounts, 17
for deleting accounts, 23
for password policies, 40
for passwords, 21-22
for renaming accounts, 19
for type of accounts, 18
malware, 54, 161
adware, 163-164, 164
browser hijackers
eliminating, 178-179, 178-179
overview, 164-165
guidelines, 174
infection process, 165-166
infection signs, 166-167
information for, 179-180
overview, 161-162
removing, 175-179, 177-179
risks, 167-168
spyware. See spyware
toolbars from, 81, 165
Malware Protection section, 147, 148
Manage Accounts window, 17
Manage Add-ons window, 81-83, 82
Manage Documents permission, 286
Manage network connections link, 293
Manage Printers permission, 286
Manage wireless networks link, 293
mapping network drives, 281-282, 281-282
Maximum Password Age setting, 37, 39
McAfee AntiSpyware program, 168
McAfee AVERT Stinger, 156-158, 157-158
McAfee Personal Firewall Plus firewall, 125
McAfee VirusScan program, 146
Media Access Control (MAC) addresses, 303-305, 303-304
Medium security level for Internet Explorer, 71
Medium-high security level for Internet Explorer, 71
Medium-low security level for Internet Explorer, 71
Microsoft Alerts service, 140
Microsoft AntiSpyware Home Page, 179
Microsoft Security, 158
Microsoft Security Home Page, 321
Microsoft SpyNet tool, 173
Minimum Password Age setting, 37, 39
Minimum Password Length setting, 37, 39
mobility, passwords for, 46
modification, e-mail, 204
Modify permission
for files, 234
for folders, 236
http://www.MVPs.org web site, 175
My network (subnet) only option, 124


Previous Page
Next Page

Index

N

Name screen, 119-121, 120
names
rules, 119-121, 120
Security IDs for, 24
share, 278
user accounts, 19-20, 20
wireless networks, 298-299, 298
NetNanny program, 96
Netscape browser, 87
Network and Sharing Center, 292-294, 293
Network Center window, 291
network drive mapping, 281-282, 281-282
Network Stumbler tool, 294
networks, 6
resource sharing on, 272
shared folders on, 280-283, 281-283
wireless. See wireless networks
Never check for updates (not recommended) option, 137
new e-mail addresses, 200-201
New Outbound Rule Wizard, 119-122, 119-122
New Private Disk window, 251, 251
Nigerian scam messages, 188-189
NNTP protocol, 121
No automatic filtering option, 190
non-repudiation, 208
Norton AntiVirus program
for malware, 169
for viruses, 146
Norton Internet Security firewall, 125
Not Configured option, 63
notification messages, 291, 291-292
NTFS file system
converting FAT files systems to, 231-232, 231
vs. FAT, 230-231
NTFS permissions
for files, 234-236, 235
for folders, 236-237, 237
Nuke tool, 267


Previous Page
Next Page

Index

O

objectionable and offensive content. See parental controls
one-way hash functions, 34
Opera browser, 87
Options settings in Windows Defender, 173
ORDB service, 199
out-of-office replies, 187
outbound connections, blocking, 119-121, 119-120
outbound filtering by firewalls, 109
Outbound security tests, 129
Overview screen, 117, 118, 123


Previous Page
Next Page

Index

P

P3P (Platform for Privacy Preferences Project), 78, 185
P3P privacy policy, 74
P3P Public Overview web page, 77
Panda Titanium Antivirus program, 147
parental controls, 91-92
capabilities, 95-96
computer location for, 94
discussions with children, 93-94
enabling, 96-100, 97-100
online risks and dangers, 91-92
overview, 94-95
ratings for, 78
user activity reports, 101-102, 101-102
partitions, formatting and deleting, 257, 257
Password dialog box, 252
Password Must Meet Complexity Requirements option, 37, 40
Password Policy folder, 39
Password Policy settings, 37
Password protected sharing is disabled option, 273
Password protected sharing is enabled option, 273
password reset floppy disks, 23, 43-44, 43
Password Reset Wizard, 44
Password screen, 213, 249
passwords, 29-30
Administrator accounts, 20
BIOS, 47-48, 47
bypassing, 46, 48
certificates, 213, 249
changing, 33-34
Data Recovery Agent, 243
Dekart Private Disk Light, 250-252
e-mail and internet service, 36
files, 36
Guest account, 16
hard disks, 49
hints, 22
management software for, 44-45, 44-45
mistakes, 31-32, 32
policies, 36-42, 39-41
selecting, 30
shared folders, 273
storing, 42-46
Syskey, 49-50, 50
user accounts, 11, 21-23, 21, 34-35
web site, 35, 79
in Windows Vista installation, 319-320
wireless networks, 296-297, 297
WPA, 310
patches. See updates
PC Magazine Antispyware Product Guides and Reviews web site, 179
PC Magazine Security Watch web site, 158, 322
Per Site Privacy Actions screen, 76, 76
Permanently delete suspected junk e-mail instead of moving it to the Junk E-mail folder option, 190
permissions
files, 234-236, 235
printers, 286-287, 286
shared folders, 275-277, 276, 279-280
Personal Firewall Plus firewall, 125
personal folders, 232-233, 233
personal information, disclosing, 93
PGP (Pretty Good Privacy), 224-225
phishing
spam for, 188
Windows Mail for, 194, 194
Phishing Filter, 85-87, 86
physical access to computers, 50-51
Platform for Privacy Preferences Project (P3P), 78, 185
Plugins tab, 152
policies
Local Computer Policy settings, 62-66, 63-65
Local Security Policy settings, 41, 60-61, 60, 62
password, 36-42, 39-41
pop-up ads
in Internet Explorer, 83-84, 84
malware infection through, 166
POPFile program, 197
pornography, online, 93
port scans, 129-131, 130-131
portability, passwords for, 46
ports, firewall, 114
post-installation tasks, 319-320
pre-installation tasks, 317-318
predators, online, 93
Prepare For A Forgotten Password option, 43
Pretty Good Privacy (PGP), 224-225
principle of least privilege, 15
Print permission, 285-286
printers, shared, 271-272, 283
connecting to, 284-285, 285
process, 283-284, 284
securing, 285-287, 286
Privacy Report dialog box, 77, 77
privacy settings in Internet Explorer, 74-78, 75-77
Privacy Summary document, 77, 77
Privacy tab, 75
private disks, 250-253, 251-252
private keys, 207
Private Profile tab, 123
processes, Task Manager for, 53-55, 54
Processes tab, 54-55, 54
product keys, 319
Profile screen, 119, 121
program installations, malware infection through, 165
Program screen, 119
Properties window
for file systems, 230, 230
for Local Computer Policy settings, 65, 65
Protocols and Ports screen, 121
Pseudorandom Data erasing method, 259
Public folders
sharing, 273-274, 274
working with, 232-233, 233
public key cryptography, 205
Certificate Authorities in, 206
certificates in, 205-206
digital signatures in, 207-208
keys in, 207
performance with, 208
Public Key Policies section, 61


Previous Page
Next Page

Index

Q

Quarantine option for malware, 172
Quarantined items tool, 173
Quick scan for malware, 170


Previous Page
Next Page

Index

R

ratings for Web content, 78-79, 79
Ratings Sites tab, 78, 79
RBLs (Realtime Blackhole Lists), 199
Read permission
for files, 234
for folders, 236
for shared folders, 276
Read & Execute permission
for files, 234
for folders, 236
Read Permissions permission, 234
Reader option for shared folders, 274
Ready to Test screen, 131, 131
Really Simple Syndication (RSS) feeds, 158
Realtime Blackhole Lists (RBLs), 199
receiving e-mail messages
encrypted, 219-224, 220-222, 224
signed, 215-218, 216-219
Recent Files list, 264-265
recovering deleted files, 257-258, 258
Recycle Bin
with Eraser, 262
working with, 256-257, 256
regional settings for junk e-mail, 193, 193
Registry
for passwords, 34
scanning, 180
reinstalling Windows Vista, 317
installation process, 318-319
post-installation tasks, 319-320
pre-installation tasks, 317-318
for virus recovery, 156
Remote Assistance
enabling, 114, 115
options for, 124
Remote IP Address settings, 124
Remove option for malware, 172
removing
malware, 172, 175-179, 177-179
viruses, 156-158, 157-158
renaming user accounts, 19-20, 20
Report This Website option, 85
reports of user activities, 101-102, 101-102
repudiation, e-mail, 204
Reset Account Lockout Counter After setting, 38
Restricted sites list, 74
Restricted sites zone, 71
Review Your Time And Date Settings screen, 319
reviewing user activity reports, 101-102, 101-102
revoking certificates, 214-215
risks
e-mail, 204-205
malware, 167-168
online, 91-92
wireless networks, 294-295
RoboForm program, 44-45, 44-45
router firmware upgrading, 312, 312
RSA encryption, 208
RSS (Really Simple Syndication) feeds, 158
Rule Type screen, 119, 121
rules
for hardware firewalls, 128
for inbound connections, 121
for outbound connections, 119
Run As command for user accounts, 24-27, 24-27


Previous Page
Next Page

Index

S

S/MIME (Secure/Multipurpose Internet Mail Extensions) protocol, 206, 218
Safe list only option, 190
Safe Mode
for Administrator password, 20
for anti-spyware tool installation, 176
for virus recovery, 156
safe sender lists, 191-192, 192
SAM (Security Accounts Manager) database, 34-35
Save Events As option, 57
scam messages, 188-189
Scan Results screen, 172, 172
scanning
for malware, 170-172, 171-172, 176-177, 177
for viruses, 153-154, 154
Scanning Result screen, 177, 177
schedules
Eraser, 263
hardware firewalls, 128
logons, 95-96
virus definitions, 149, 150
virus scanning, 153-154
Windows Defender, 173
scope settings for firewalls, 123-124, 125
Secure Deletion of Data from Magnetic and Solid-State Memory paper, 259
Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol, 206, 218
Securing the Windows Account Database window, 49
Security Accounts Manager (SAM) database, 34-35
Security Center tool
for malware, 169
for virus protection, 147, 148
for Windows Firewall, 110-111, 111-112
for Windows Update, 136, 136
working with, 58-59, 59
Security Help screen
for encrypted e-mail messages, 219, 220
for signed e-mail messages, 215, 216
Security IDs (SIDs) for accounts, 24
Security log
reviewing, 55-58, 56-58
for tracking logons, 42
security map, 5-6
Security Settings window, 72
Security tab
encrypted e-mail messages, 220-221, 220
file permissions, 235, 235
folder permissions, 236-237, 237
Internet Explorer, 72, 73
printers, 286, 286
signed e-mail messages, 215, 216
Windows Mail, 196, 222
security updates, 134
Security Warning dialog box, 148
http://www.SecurityStats.com site, 31-32
Select Group Policy Object window, 64
Select Recovery Agents screen, 244
Select Users or Groups window, 235, 237
sender lists, 191-192, 192
sending e-mail messages
encrypted, 219-224, 220-222, 224
signed, 215-218, 216-219
Service Packs
manual updates, 140
status information, 134-135, 135
Service Set Identifiers (SSIDs), 298-301, 298, 300
session keys, 208
Set up a connection or network link, 293
Set up a network wizard, 302
shared folders, 271-272
advanced settings, 276-280
connecting to, 280-283, 281-283
Public, 273-274, 274
specific folders, 274-275, 275-276
shared printers, 271-272, 283
connecting to, 284-285, 285
process, 283-284, 284
securing, 285-287, 286
Shareware, 163
Sharing tab
for folders, 278, 278
for printers, 284, 284
Sharing Wizard feature, 274-277
Shields UP!! port scanner, 129-131, 130
Shockwave Flash Object, 81
signatures, digital
sending and receiving messages with, 215-218, 216-219
working with, 207-208
SMC access points, 310-311, 311
Software Explorer tool, 173
Software Restriction Policies section, 61
software updates, 141-142, 142
Sophos Anti-Virus program, 147
spam, 183
beacons for, 186-187, 187
e-mail address acquisition for, 184-185
filtering, 196-199, 197
guidelines, 199-200
overview, 183-184
for phishing, 188
for scams, 188-189
viruses from, 186
Windows Mail for. See Windows Mail
Spam Reporting Addresses web site, 189
Spamhaus service, 199
SpamPal program, 197
special characters in passwords, 30
specific connections, enabling or disabling, 112–113, 113
Specific Local Ports setting, 121
spoofing
e-mail, 204
MAC addresses, 305
Spybot Search & Destroy program, 168
SpyNet tool, 173
spyware, 54, 161-163
anti-spyware software
definition files for, 170, 170
installing, 168-169, 169
scanning with, 170-172, 171-172
tools for, 172-174, 173
in Windows Vista installation, 319
information for, 179-180
removal tools, 176-178, 177
SpywareInfo web site, 179
SpywareWarrior web site, 179
SSIDs (Service Set Identifiers), 298-301, 298, 300
standalone virus removal tools, 156
standard user accounts, 15-16
standards, wireless networks, 290
startup passwords, 49-50, 50
Statistics tab, 263
status
Service Pack, 134-135, 135
Windows Defender, 169, 169
Windows Firewall, 110-111, 111-112
Steganos E-mail Encryption program, 225
Stinger tool, 156-158, 157-158
Store Startup Key on Floppy Disk option, 49
storing passwords, 42-46
strength of passwords, 31-32, 32
Success Audits in Security log, 56
supervisor passwords, 47-48
surfing, malware infection through, 165
Symantec Security Response site, 158
Syskey password, 49-50, 50
System screen for Service Packs, 135, 135


Previous Page
Next Page

Index

T

Task Manager, 53-55, 54
Task Properties window, 263
TC TrustCenter CA, 211
TechNet Security home page, 322
Temporary Internet files, 264-265
testing firewalls, 128-131, 130-131
Thawte CA, 210
theft
identity, 33, 167
laptop computers, 51
third-party programs
browser add-ons, 81
encryption, 240, 250-253, 251-252
firewalls, 125-127
Time Limits setting, 98, 99
time restrictions, parental controls for, 95, 98, 99
toolbars from malware, 81, 165
Tools and Options screen, 172-173, 173
Top-Level Domain (TLDs) junk e-mail settings, 193
tracking
logon attempts, 42
by malware, 167
travelers, encryption for, 240
Trend Micro Anti-Spyware program, 168
Trojan horses, 144
Trusted Sites window, 73, 73
Trusted sites zone in Internet Explorer, 71
Turn off sharing (people logged on to this computer can still access this folder) option, 273
Turn on sharing so anyone with network access can open, change, and create files option, 273
Turn on sharing so anyone with network access can open files option, 273
Type a Computer Name And Choose A Desktop Background screen, 319
Type Your Product Key For Installation screen, 319


Previous Page
Next Page

Index

U

uninstalling updates, 140, 141
unsolicited commercial e-mail (UCE). See spam
unused disk space, erasing, 263, 263
Unused Disk Space tab, 260
updates, 133-134
anti-spyware definition files, 170, 170
manual process, 139-140, 141
security, 134
Service Packs, 134-135, 135
software, 141-142, 142
virus definition files, 149-150, 150
Windows Update, 136-139, 136-139
upgrading router firmware, 312, 312
URL history, 265
US DoD 5220.22-M erasing methods, 259
USB flash drives for wireless networks, 302, 302
Use Sharing Wizard (Recommended) option
for folders, 277
for printers, 286
User Account Control dialog box settings
administrators, 24-26, 24-25
certificates, 211
content ratings, 78
creating accounts, 17
deleting accounts, 23
Event Viewer, 56
Local Computer Policy, 64
Local Security Policy, 61
lockout policies, 40-42
names, 19
parental controls, 97
password policies, 39
passwords, 21-22
processes, 55
shared folders, 275, 278
shared printers, 284
spyware removal tools, 176
Syskey password, 49
types, 18
user activities, 101
viruses, 148
user accounts, 11-12, 12
benefits, 12-13
creating, 16-17
deleting, 23-24, 23
passwords, 21-23, 21, 34-35
renaming, 19-20, 20
Run As command for, 24-27, 24-27
types, 13-16, 16, 18, 19
in Windows Vista installation, 320
User Accounts applet, 12, 12
user activity reports, 101-102, 101-102
User Controls screen, 97
user passwords, BIOS, 47-48
Username Can Only Use The Programs I Allow option, 100
usernames
user accounts, 11, 17
in Windows Vista installation, 319
Using Your Private Key To Decrypt Message dialog box, 219


Previous Page
Next Page

Index

V

View Certificates window, 217, 217, 221
View Installed Updates option, 140, 141
View tab for shared folders, 277
Virus Protection section, 195
viruses, 54, 143-144
anti-virus software
configuring, 150-153, 151-153
definition files for, 149-150, 150
installing, 146-148, 149-150
scanning for viruses, 153-154, 154
in Windows Vista installation, 319
e-mail address harvesting by, 185
guidelines, 155
information for, 158
removing, 156-158, 157-158
risks from, 145-146
from spam, 186
types, 144-145
VirusScan program, 146


Previous Page
Next Page

Index

W-X

war driving, 295
Warn on encrypting messages with less than this strength option, 223
warning signs of malware, 166-167
Web browsers, 69
Internet Explorer. See Internet Explorer
other, 87-88, 88
Web sites
e-mail address harvesting by, 185
helpful, 321-322
malware infection through, 165
passwords, 35
Webroot Spy Sweeper program, 168
WEP (Wired Equivalent Privacy), 305-308, 306-308
Where Do You Want To Install Windows? screen, 319
Which Parts of the Internet Can Username Visit? screen, 97
Which Type Of Installation Do You Want? screen, 319
whitelists in spam filtering, 199
Wi-Fi Protected Access (WPA), 308-309
implementing, 310-313, 311-313
prerequisites, 309-310, 310
Windows Connect Now feature, 302
Windows Defender
definition files for, 170, 170
scanning for malware, 170-172, 171-172
status, 169, 169
tools for, 172-174, 173
Windows Firewall
configuring, 109-110
exceptions, 113-116, 114-116
for specific connections, 112-113, 113
status, 110-111, 111-112
Windows Firewall with Advanced Security, 117, 118
blocking connections, 117-118
inbound, 121-122, 121-122
outbound, 119-121, 119-120
in Local Security Policy, 61
logging settings, 122-123, 123
scope settings, 123-124, 125
Windows Help and Support Page, 321
Windows Mail, 189
anti-phishing setting, 194, 194
beacons in, 186, 187
junk e-mail filters, 190, 190
message security settings, 195-196, 195-196
options, 221-223, 222
regional settings, 193, 193
sender lists, 191-192, 192
Windows Mail dialog box, 217
Windows Security Center tool
for malware, 169
for virus protection, 147, 148
for Windows Firewall, 110-111, 111-112
for Windows Update, 136, 136
working with, 58-59, 59
Windows Server Update Services (WSUS) software, 139
Windows Settings section, 97
Windows Update, 136-139, 136-139
Windows Update screen, 138
Windows Update web site, 320
Windows Vista Community site, 322
Windows Vista Home Page, 321
Windows Vista installation screen, 319
Windows Vista Security and Protection web site, 322
Wired Equivalent Privacy (WEP), 305-308, 306-308
wireless access points, 295-296
Wireless Network Setup Wizard, 302
wireless networks, 289-291
access to, 299-305, 300-304
administrator password for, 296-297, 297
connection properties, 292-294, 293
encryption, 305
WEP, 305-308, 306-308
WPA, 308-313, 308-313
MAC addresses for, 303-305, 303-304
names, 298-299, 298
notification messages, 291, 291-292
risks, 294-295
wireless access points, 295-296
worms, 144
WPA (Wi-Fi Protected Access), 308-309
implementing, 310-313, 311-313
prerequisites, 309-310, 310
WPA2, 313
Write permission
for files, 234
for folders, 236
WSUS (Windows Server Update Services) software, 139


Previous Page
Next Page

Index

Y

Your Folder Is Shared screen, 275, 276
You're Ready To Start screen, 319


Previous Page
Next Page

Index

Z

zone settings
Internet Explorer, 70-74, 72-73
Windows Mail, 195
ZoneAlarm firewall, 125


List of Figures

Chapter 2: Implementing User Accounts and Logon Security

Figure 2-1: Click the User Accounts item in Control Panel to create and manage user accounts.
Figure 2-2: The Windows Vista built-in Guest account is disabled by default.
Figure 2-3: Select the new user account's type.
Figure 2-4: Changing an existing user account's type.
Figure 2-5: Changing a user account's name.
Figure 2-6: Adding a password to another user's account.
Figure 2-7: Options associated with deleting a user account.
Figure 2-8: The User Account Control dialog box as it appears when you're already logged on as an Administrator.
Figure 2-9: The User Account Control dialog box as it appears when you're logged on as a Standard user.
Figure 2-10: The Run As Administrator command is available from the Windows Vista shortcut menu.
Figure 2-11: Using runas.exe from the command prompt.

Chapter 3: Implementing Password Security

Figure 3-1: The Password Strength Meter is a free testing tool at http://www.SecurityStats.com.
Figure 3-2: Password Policy settings.
Figure 3-3: Enforce password history
Figure 3-4: Message displayed when a password doesn't meet policy requirements.
Figure 3-5: Account Lockout Policy settings.
Figure 3-6: Create a password reset disk from User Accounts in Control Panel.
Figure 3-7: RoboForm offers to save your username and password combination for a web site.
Figure 3-8: RoboForm offering to submit stored username and password information for you.
Figure 3-9: BIOS Security configuration screen.
Figure 3-10: Configuring a startup password with Syskey.

Chapter 4: Using Built-in Tools and Settings to Improve Windows Vista Security

Figure 4-1: The Task Manager Processes tab displays information on all running processes, including those running quietly in the background.
Figure 4-2: The Security log in Event Viewer.
Figure 4-3: Reviewing the details of a failed logon attempt in the Security log.
Figure 4-4: Configuring settings for the Security log.
Figure 4-5: The Security Center taskbar message displays when Automatic Updates are turned off.
Figure 4-6: The Windows Security Center tool.
Figure 4-7: The Local Security Policy MMC.
Figure 4-8: Reviewing the Properties of a Local Security Policy setting.
Figure 4-9: Reviewing the Explain tab in the Properties of a Local Computer Policy setting.
Figure 4-10: Adding the Group Policy snap-in to manage Local Computer Policy settings.
Figure 4-11: Reviewing user desktop configuration settings.
Figure 4-12: Reviewing the Properties of a Local Computer Policy setting.

Chapter 5: Securing Your Web Browser

Figure 5-1: Configuring custom security settings.
Figure 5-2: The Internet Explorer Security tab.
Figure 5-3: Adding a web site to the Trusted sites web content zone.
Figure 5-4: The Internet Explorer Privacy tab.
Figure 5-5: Configuring Advanced Privacy Settings.
Figure 5-6: Blocking cookies from a web site.
Figure 5-7: The Internet Explorer Privacy Report dialog box.
Figure 5-8: Reviewing a web site's Privacy Summary.
Figure 5-9: Configuring Content Advisor Ratings in Internet Explorer.
Figure 5-10: Configuring the Approved Sites settings in Internet Explorer.
Figure 5-11: Configuring the General Content Advisor settings.
Figure 5-12: The Internet Explorer Manage Add-ons window.
Figure 5-13: Disabling a browser add-on.
Figure 5-14: Configuring the Internet Explorer Pop-up Blocker Settings.
Figure 5-15: An example of the shortcut menu that appears when you click the Internet Explorer information bar.
Figure 5-16: Configuring the Phishing Filter settings.
Figure 5-17: Phishing Filter makes it easy to check for phishing-related web sites.
Figure 5-18: The Firefox web browser is a popular alternative to Internet Explorer.

Chapter 6: Implementing Parental Controls

Figure 6-1: Implementing parental control settings for a user.
Figure 6-2: Filtering a user's access to the web.
Figure 6-3: Controlling access to Windows Vista by time of day and day of week.
Figure 6-4: Configuring access to games based on their ESRB rating.
Figure 6-5: Controlling which games a user can play.
Figure 6-6: Controlling access to installed programs.
Figure 6-7: Reviewing activity reports for a user subject to parental control settings.
Figure 6-8: Reviewing General System Information relating to Parental Controls activities.

Chapter 7: Protecting Windows Vista with a Firewall

Figure 7-1: Notification message from Windows Security Center when no firewall is protecting a Windows Vista system.
Figure 7-2: Viewing firewall status information in Windows Security Center.
Figure 7-3: Windows Security Center displays information about the current status of your firewall, automatic updating, antivirus, antispyware software, and more.
Figure 7-4: The Windows Firewall Advanced tab.
Figure 7-5: The Windows Firewall Exceptions tab.
Figure 7-6: Configuring an exception for Remote Assistance connections.
Figure 7-7: Adding an exception for a program.
Figure 7-8: Reviewing the exception created for a new program.
Figure 7-9: The Windows Firewall with Advanced Security Overview screen.
Figure 7-10: Specifying the path to a program in the New Outbound Rule Wizard.
Figure 7-11: Configuring a rule's action.
Figure 7-12: Adding a name and description for a rule.
Figure 7-13: Configuring a rule's protocol and port settings.
Figure 7-14: Naming and describing a rule to block outbound access to newsgroups.
Figure 7-15: Configuring logging settings for Windows Firewall.
Figure 7-16: Limiting the scope of a rule to connections from one remote computer.
Figure 7-17: Testing your firewall with the Shields UP!! port scanning web site.
Figure 7-18: The results from a Shields UP!! port scan.
Figure 7-19: LeakTest is a basic tool to test the outbound security of your firewall.

Chapter 8: Keeping Windows Vista Patched and Protected

Figure 8-1: Use the System screen to determine which Service Pack (if applicable) has been installed on a Windows Vista system.
Figure 8-2: The Windows Security Center tool.
Figure 8-3: Configuring Windows Update settings.
Figure 8-4: The Windows Update icon notifies you that updates are ready to install.
Figure 8-5: Installing downloaded updates.
Figure 8-6: Prompt to restart Windows Vista after some updates are successfully installed.
Figure 8-7: Removing a security update using View Installed Updates.
Figure 8-8: Checking the version of an installed program.

Chapter 9: Protecting Against Viruses

Figure 9-1: Reviewing the status of Malware protection in Windows Security Center.
Figure 9-2: The AVG Free Edition Test Center window.
Figure 9-3: Downloading virus definition files with AVG Free Edition.
Figure 9-4: Reviewing scheduled tasks in AVG Free Edition.
Figure 9-5: Configuring virus-scanning options with AVG Free Edition.
Figure 9-6: Reviewing e-mail message scanning options in AVG Free Edition.
Figure 9-7: Configuring virus certification messages.
Figure 9-8: Antivirus programs usually provide options to scan your entire computer or only selected areas.
Figure 9-9: Results of a virus scan.
Figure 9-10: Configuring virus scanning and detection preferences with Stinger.
Figure 9-11: Stinger scans only drive C: by default, but can be configured to scan other drives.

Chapter 10: Fighting Malware-Protecting Against Spyware, Adware, and Browser Hijackers

Figure 10-1: The free version of the popular BearShare file-sharing program informs you that adware will also be installed.
Figure 10-2: Reviewing the status of Malware protection in Windows Security Center.
Figure 10-3: Windows Defender with outdated definition files.
Figure 10-4: Configuring custom scanning options in Windows Defender.
Figure 10-5: The results of a Windows Defender scan.
Figure 10-6: Selecting actions for objects uncovered by a Windows Defender spyware scan.
Figure 10-7: The Windows Defender Tools screen.
Figure 10-8: Scanning for malware with Ad-Aware SE Personal.
Figure 10-9: Viewing detailed scan results.
Figure 10-10: CWShredder is the premier tool for removing the CoolWebSearch browser hijacker and its numerous variants.
Figure 10-11: Results of a CWShredder scan.

Chapter 11: The Dark Side of Spam

Figure 11-1: Windows Mail automatically protects against message beacons and code embedded in HTML-based e-mail messages.
Figure 11-2: Configuring Junk E-mail Options in Windows Mail.
Figure 11-3: The Safe Senders list.
Figure 11-4: Blocking e-mail messages by TLD.
Figure 11-5: The message that Windows Mail displays when junk or phishing messages are downloaded.
Figure 11-6: Phishing settings in Junk E-mail Options.
Figure 11-7: Windows Mail Security options.
Figure 11-8: Configuring Windows Mail to read all messages in plain text.
Figure 11-9: MailWasher Pro is a popular commercial anti-spam program.

Chapter 12: Securing E-mail Messages Using Encryption and Digital Signatures

Figure 12-1: Viewing the contents of your personal certificate store.
Figure 12-2: Viewing your personal e-mail certificate.
Figure 12-3: The Details tab for a personal e-mail certificate.
Figure 12-4: Exporting your certificate, including your private key.
Figure 12-5: Select a storage location and file name for your exported certificate.
Figure 12-6: The Security Help screen appears when you open a digitally signed message in Windows Mail.
Figure 12-7: The Security tab displays details associated with a digitally signed message.
Figure 12-8: Use the View Certificates window to view the certificate used to digitally sign a message, or add the user's certificate to your Contacts list.
Figure 12-9: The Digital IDs tab in a user's address book entry displays certificates associated with that user.
Figure 12-10: A digitally signed message.
Figure 12-11: This dialog box is displayed when your private key is being accessed.
Figure 12-12: This Security Help message appears when you open an encrypted message.
Figure 12-13: The Security tab for an encrypted message.
Figure 12-14: Viewing the certificate that was used to encrypt a message.
Figure 12-15: An encrypted e-mail message.

Chapter 13: Controlling Access to Your Personal Files

Figure 13-1: Reviewing a drive's file system.
Figure 13-2: Converting a drive to NTFS.
Figure 13-3: The Public folder hierarchy.
Figure 13-4: Reviewing the NTFS permissions associated with a file.
Figure 13-5: Reviewing the NTFS permissions associated with a folder.

Chapter 14: Improving File Security Using Encryption

Figure 14-1: Creating a certificate for a Data Recovery Agent with the Cipher command.
Figure 14-2: Selecting a Data Recovery Agent.
Figure 14-3: Viewing Data Recovery Agents in EFS Public Key Policy.
Figure 14-4: Encrypting a folder.
Figure 14-5: Reviewing the details associated with an encrypted file.
Figure 14-6: This message displays when you try to open an encrypted file belonging to another user.
Figure 14-7: EFS enables you to share access to encrypted files with other users.
Figure 14-8: Use the Certificates MMC to manage your EFS certificate.
Figure 14-9: Dekart Private Disk Light allows you to create virtual encrypted drives.
Figure 14-10: Creating a new private disk.
Figure 14-11: A connected private disk is displayed as a removable disk in Windows Explorer.

Chapter 15: Erasing Files and Hard Drives Securely

Figure 15-1: You can restore files sent to the Recycle Bin if you delete a file in error.
Figure 15-2: Formatting a disk makes the disk appear to be empty, but files may still be recoverable even after the fact.
Figure 15-3: Eraser includes four predefined erasing methods, but you can also define your own.
Figure 15-4: Eraser overwrites unused disk space in a single pass by default.
Figure 15-5: To erase a file permanently, select Erase from the shortcut menu in Windows Explorer.
Figure 15-6: The Confirm Erasing dialog box allows you to configure specific erasing settings and confirm that you want to permanently erase a file.
Figure 15-7: Eraser overwrites files with 35 passes by default.
Figure 15-8: The Erasing Report window lets you know whether the erasing process was successful.
Figure 15-9: The Recent Files Start menu item displays lists of files that you've recently opened.
Figure 15-10: Internet Explorer includes the ability to delete Temporary Internet files, cookies, and your browsing history.
Figure 15-11: CCleaner is a popular free tool that enables you to delete your web browsing history, temporary files, and recently used file lists from a variety of different programs.

Chapter 16: Securing Shared Folders and Printers

Figure 16-1: Sharing Public folders over the network.
Figure 16-2: Choosing which users should have access to a shared folder.
Figure 16-3: Configuring user permissions for a shared folder.
Figure 16-4: A successfully shared folder.
Figure 16-5: Disabling the Sharing Wizard.
Figure 16-6: The Sharing tab in the Properties of a folder.
Figure 16-7: Configuring shared folder settings.
Figure 16-8: Configuring advanced shared folder permissions.
Figure 16-9: Reviewing shared folder settings.
Figure 16-10: Assigning a drive letter for a mapped network drive.
Figure 16-11: Selecting the shared folder to map the drive to.
Figure 16-12: Viewing a mapped drive in Computer.
Figure 16-13: Browsing for shared folders from the Start menu.
Figure 16-14: Sharing a printer.
Figure 16-15: Connecting to a shared printer.
Figure 16-16: Reviewing printer permissions.

Chapter 17: Securing Windows Vista on Wireless Networks

Figure 17-1: Notification about detected wireless networks
Figure 17-2: The Connect to a network window
Figure 17-3: A connected wireless network
Figure 17-4: The Control Panel Network and Sharing Center tool
Figure 17-5: The password setting configuration screen
Figure 17-6: Configuring an SSID name for a wireless network
Figure 17-7: Disable SSID broadcast to improve wireless network security
Figure 17-8: Manually configuring the SSID name for a wireless network with SSID broadcast disabled
Figure 17-9: Use the ipconfig /all command to find the MAC address associated with your wireless network card
Figure 17-10: You use the MAC filtering table to restrict access to a wireless network
Figure 17-11: Configure WEP security settings on an access point
Figure 17-12: Configuring allowed client types on an access point
Figure 17-13: Connecting to a wireless network that uses WEP security
Figure 17-14: Configuring WPA security settings on an access point
Figure 17-15: Connecting to a wireless network using WPA security


List of Sidebars

Chapter 2: Implementing User Accounts and Logon Security

What's in a Name?

Chapter 3: Implementing Password Security

Are You Being Watched?
Tracking Logon Attempts
Strong Passwords To Go
Evading BIOS Passwords
Let's Get Physical!

Chapter 7: Protecting Windows Vista with a Firewall

Hardware Firewalls

Chapter 9: Protecting Against Viruses

Danger, Read All About It!

Chapter 10: Fighting Malware-Protecting Against Spyware, Adware, and Browser Hijackers

HOSTS with the Most
All the Dirty Details

Chapter 11: The Dark Side of Spam

Positively False?
New Address = Fresh Start

Chapter 12: Securing E-mail Messages Using Encryption and Digital Signatures

Revoking Certificates
Windows Mail Security Options

Chapter 14: Improving File Security Using Encryption

Traveling Lightly

Chapter 15: Erasing Files and Hard Drives Securely

Recovering Deleted Files
Erasing Unused Disk Space?

Chapter 17: Securing Windows Vista on Wireless Networks

Wireless A-B-G's
War Driving
USB Flash Drive Easy Does It
Gearing Up for WPA
Upgrading Router Firmware