With computers being a critical component in running a business, it is more valuable than ever to ensure the security of your networks particularly where there is sensitive data. News headlines announcing that networks have experienced security breaches are all too prevalent. This is where you need a service that checks for those vulnerabilities and prevents from future attacks. Better yet, you need a service that prevents it before it ever happens to your company. Imagine the embarrassment at having to explain to your customers that someone has stolen their credit card information. 

We continue to read headline after headline with news stories that credit card information or social security numbers were exploited. Some companies perform security audits on a regular basis. Certainly institutions like hospitals are required to perform these. But it’s mostly small to mid-sized companies that are the most vulnerable. 

Hackers employ various methods for gaining access to systems. An audit often looks at replicating those methods, looking for vulnerabilities and weaknesses in the infrastructure. Affectionately known as Penetration Testing, it involves isolating mild, moderate and critical security threats and then determining the best course of action. When performing a Penetration test, a couple of key areas need to be targeted to ensure that a secure network system helps companies to avoid: – Preventing financial loss through fraud (hackers, extortionists and disgruntled employees) or through lost revenue due to unreliable business systems and processes. – Legal problems. Non-compliance can result in your organization losing business, receiving heavy fines, gathering bad PR or ultimately failing. At a personal level it can also mean the loss of your job, prosecution and sometimes even imprisonment. Poorly protecting your brand by avoiding loss of consumer confidence and business reputation. 

From an operational perspective, penetration testing helps shape information security strategy through identifying vulnerabilities and quantifying their impact and likelihood so that they can be managed proactively; budgets can be allocated and corrective measures implemented. 

For the average home user, there are some basic things, especially when setting up a wireless network at home that you can easily do to prevent users piggybacking on your network or even hacking in to it. 

Add a little security 

Change the SSID (name) of your network and disable the SSID broadcast. Disable DHCP Control MAC Address Filtering 

Add more security 

WEP Encrypt – adds an extra blocking mechanism for hackers 

Even more Security 

WPA – setting up a random pre-shared key of 10 characters ensures your network is practically rock-solid. This is a random string of numbers and letters, just make sure you can remember it yourself. 

These are some very basic steps to securing your data and ensuring your privacy. Keep in mind that small to medium business should do a little more to keep their information secure as there is even more valuable data ie. other people’s.

What about security for WLAN? Today wireless networks are at least secure as wired. You only have to use right tools and configurations. Physical security is most important part of security. If you do not have physical access to network, you can not use it. If you can not plug cable you do not have network. This is situation in wired word. 

The biggest security problem, in any type wireless network, is lack of physical security. 
802.11 standards use Authentication as replacement for physical security. Problem is that application uses WEP as encryption. 

WEP – Wired Equivalent Privacy has never deserved its name. It does not take more than 2 minutes, with cracking tools, to break WEP. 

First WEP versions have used 64-bit shared key. 40 bits are for a shared secret and 24 bits are for IV (initialization vector). IV is used that receiver could decrypt the frame. 
Next improvement of first WEP key was 128-bit shared WEP key. With that WEP version 104 bits are used for shared key and 24 for initialization vector.

IEEE proposed in 2004 new version of WEP – WEP2. It uses the same RC4 algorithm with 128-bit initialization vector. WEP2 has not improved significantly security. It only increases time for cracking. 
Next step in wireless security is WPA – Wi-Fi Protected Access. 

What is WPA encryption? Wi-Fi Alliance launched in October 2003 Wi-Fi Protected Access – WPA, the next generation in WLAN security. Wi-Fi Protected Access does not require a hardware upgrade in 802.11 equipment.

Only software and firmware upgrade is needed and it makes minimal degradation in network performance. 

WPA was designed as an answer for all WEP weaknesses. It uses Temporal Key Integrity Protocol (TKIP) with Message Integrity Check (MIC). It also has mutual pre-shared key (PSK) authentication scheme using 802.11X/EAP.

WI-Fi Alliance launched WPA2 in September 2004. It is certified interoperable version of WPA. WPA2 besides PSK 802.1X/EAP authentication, use advanced encryption mechanism.

This new mechanism is Counter-Mode/CBC-MAC Protocol (CCMP) called Advanced Encryption Standard (AEP).

WPA and WPA2 have 2 certification modes. 

– Enterprise
– Personal 

You have 4 different versions of Wi-Fi CERTIFIED devices: 
1) WPA-Personal
2) WPA2-Personal
3) WPA-Enterprise
4) WPA2-Enterprise 

Personal Mode is designed for home and office (SOHO) environment. You do not need authentication server (Radius or IAS).

It uses manually entered PSK (pre-shared key or pass-phrase). Security level of your wireless network is based on this PSK.

So, use mix of letters, numbers and non-alphanumerical characters.

Personal mode uses methods of encryption as Enterprise-per-user, per-session, per-packet encryption with TKIP (WEP) or AES (WEP2). 

Enterprise Mode operates in managed mode with authentication servers (Radius or IAS). With this mode you can meet rigorous requirements of enterprise security.
Most of access points and wireless routers have option of MAC filtering. With MAC filtering, you can restrict access to stations that you have entered in MAC filtering list. 

The main key to wireless security is to put as many obstacles as you could. If you simultaneously use WEP, WPA, MAC filtering, and if you use IPsec tunnel and SSH then your wireless network is secure like it’s wired.

Today, many people rely on computers to do homework, work, and create or store useful information. Therefore, it is important for the information on the computer to be stored and kept properly. It is also extremely important for people on computers to protect their computer from data loss, misuse, and abuse. For example, it is crucial for businesses to keep information they have secure so that hackers can’t access the information. Home users also need to take means to make sure that their credit card numbers are secure when they are participating in online transactions. A computer security risk is any action that could cause loss of information, software, data, processing incompatibilities, or cause damage to computer hardware, a lot of these are planned to do damage. An intentional breach in computer security is known as a computer crime which is slightly different from a cybercrime. A cybercrime is known as illegal acts based on the internet and is one of the FBI’s top priorities. There are several distinct categories for people that cause cybercrimes, and they are refered to as hacker, cracker, cyberterrorist, cyberextortionist, unethical employee, script kiddie and corporate spy. 

*The Hacker. 
The term hacker was actually known as a good word but now it has a very negative view. A hacker is defined as someone who accesses a computer or computer network unlawfully. They often claim that they do this to find leaks in the security of a network. 

*The Cracker. 
The term cracker has never been associated with something positive this refers to someone how intentionally access a computer or computer network for evil reasons. It’s basically an evil hacker. They access it with the intent of destroying, or stealing information. Both crackers and hackers are very advanced with network skills. 

*The Cyberterrorist. 
A cyberterrorist is someone who uses a computer network or the internet to destroy computers for political reasons. It’s just like a regular terrorist attack because it requires highly skilled individuals, millions of dollars to implement, and years of planning. 

*The Cyberextortionist. 
The term cyberextortionist refers to someone who uses emails as an offensive force. They would usually send a company a very threatening email stating that they will release some confidential information, exploit a security leak, or launch an attack that will harm a company’s network. They will request a paid sum of money to prevent the threat from being carried out, a bit like black mailing. 

*The Unethical Employee. 
An unethical employee is an employee that illegally accesses their company’s network for numerous reasons. One could be the money they can get from selling top secret information, or some may be bitter and want revenge. 

*The Script Kiddie. 
A script kiddie is someone who is like a cracker because they may have the intentions of doing harm, but they usually lack the technical skills. They are usually silly teenagers that use prewritten hacking and cracking programs. *The Corporate Spy. 

A corporate spy has extremely high computer and network skills and is hired to break into a specific computer or computer network to steal or delete data and information. Shady companies hire these type people in a practice known as corporate espionage. They do this to gain an advantage over their competition an illegal practice. 

Business and home users must do their best to protect or safeguard their computers from security risks. The next part of this article will give some pointers to help protect your computer. However, one must remember that there is no one hundred percent guarantee way to protect your computer so becoming more knowledgeable about them is a must during these days. 

When you transfer information over a network it has a high security risk compared to information transmitted in a business network because the administrators usually take some extreme measures to help protect against security risks. Over the internet there is no powerful administrator which makes the risk a lot higher. If your not sure if your computer is vulnerable to a computer risk than you can always use some-type of online security service which is a website that checks your computer for email and Internet vulnerabilities. The company will then give some pointers on how to correct these vulnerabilities. 

The Computer Emergency Response Team Coordination Center is a place that can do this. The typical network attacks that puts computers at risk includes viruses, worms, spoofing, Trojan horses, and denial of service attacks. Every unprotected computer is vulnerable to a computer virus which is a potentially harming computer program that infects a computer negatively and altering the way the computer operates without the user’s consent. Once the virus is in the computer it can spread throughout infecting other files and potentially damaging the operating system itself. 

It’s similar to a bacteria virus that infects humans because it gets into the body through small openings and can spread to other parts of the body and can cause some damage. The similarity is, the best way to avoid is preparation. A computer worm is a program that repeatedly copies itself and is very similar to a computer virus. However the difference is that a virus needs to attach itself to an executable file and become a part of it. A computer worm doesn’t need to do that, it copies itself to other networks and eats up a lot of bandwidth. 

A Trojan Horse named after the famous Greek myth and is used to describe a program that secretly hides and actually looks like a legitimate program but is a fake. A certain action usually triggers the Trojan horse, and unlike viruses and worms it will not replicate itself. Computer viruses, worms, and Trojan horses are all classified as malicious-logic programs which are just programs that deliberately harm a computer. Although these are the common three there are many more variations and it would be almost impossible to list them. You know when a computer is infected by a virus, worm, or Trojan horse if your computer displays one or more of these things: 

* Screen shots of weird messages or pictures appear. 
* You have less available memory than you expected. 
* Music or sounds plays randomly. 
* Files get corrupted. 
* Programs are files don’t work properly. 
* Unknown files or programs randomly appear. 
* System properties fluctuate. 

Computer viruses, worms, and Trojan horses deliver their payload or instructions through three common ways. 

1 – When an individual runs an infected program so if you download a lot of things you should always scan the files before executing, especially executable files. 

2 – When an individual boots a computer with an infected drive, so that is why it’s important to not leave removable media in your computer when you shut it down. 

3 – When an unprotected computer connects to a network. Today, a very common way that people get a computer virus, worm, or Trojan horse is when they open up an infected file through an email attachment. 

There are literally thousands of malicious logic programs and new ones come out by the numbers so that’s why it’s important to keep up to date with new ones that come out each day. Many websites keep track of this. There is no known method for providing 100% protection for any computer or computer network from computer viruses, worms, and Trojan horses, but people can take several precautions to significantly reduce their chances of being infected by one of those malicious programs. Whenever you start a computer you should have no removable media in the drives. This goes for CD, DVD, and floppy disks. When the computer starts up it tries to execute a boot sector on the drives and even if it’s unsuccessful any given virus on the boot sector can infect the computer’s hard disk. If you must start the computer using removable media for any reason, such as when the hard disk fails and you are trying to reformat the drive make sure that the disk is not infected. 

How can you protect your computer? 

The best way to protect your computer from any of the above is by using good quality internet securities software. Purchasing this from a reputable security company is recommended to ensure that your software is kept up to date with the most recent virus signatures. If you are not up to date an unrecognised virus will not be stopped by the software. A full security package will protect you from viruses, Worms, Trojan horses, keyloggers and will detect when a hacker is attempting to hack into your computer and prevent them from gaining access when you are online or connected to a network. It is not advisable to use a free antivirus service as these do not provide adequate protection and are a false economy. Recommended internet security software companies are:- Norton, McAfee and others.

Neque lacus porttitor cras. Augue dolor mauris sapien, wisi augue nibh,felis ornare sed a risus ullamcorper venenatis, tristique turpis dignissim nunc arcu massa metus, sit sapien pellentesque elit. Eget id, luctus sit lectus mi.

Bob squinted at the email and began to read: 

Dear eBay User, as part of our security measures, eBay Inc. has developed a security program against fraudulent attempts and account thefts. Therefore, our system requires further account verification 

Security Measures. A threat to suspend his account to prevent fraudulent activity. The email went on to say that there were procedural safeguards with federal regulations to protect the information you provide for us. 

Bob clicked the link and was confronted with an authentic looking logon page, just waiting for him to input his user name and password and confirm what ebay supposedly didn’t know. 

He almost did it. The page looked absolutely authentic, and he had already been set up by the email message. His fingers were poised over the keyboard when he happened to glance at the URL. 

There was something very, very wrong with it. 

Pharming to Fleece Sheep 

The art of pharming involves setting up an illegitimate website that is identical with its legitimate prototype, for example the ebay page Bob was almost suckered into using, and redirecting traffic to it. 

Pharmers can do it in two ways: 

1. By altering the Hosts file on your computer. The Hosts file stores the IP address of websites you have been accessing. By inserting a new IP address into the database field corresponding to a website, your own computer can be redirected to the pharmer’s website. Any information you give the bogus site is immediately hijacked by the pharmer. 

2. Hijacking the DNS (Dynamic Name Server) itself. A DNS matches the names of address with their IP addresses. If this server can be coerced into assigning new IP addresses to traditional names, all computers using the name resolution provided by the DNS server will be redirected to the hijacker’s web site. 

Once that happens, it’s time to be fleeced. 

down on the pharm 

Pharmers hijack your hosts file or DNS servers using Spyware, Adware, Viruses or Trojans. One of the most dangerous things you can do is to run your computer without some form of Internet Security installed on it. 

Your security software should be continually updating its virus definitions, and be capable of warning you if something has been downloaded from a web site or through email. It should be able to remove it, quarantine it or tell you where it is so that you can remove it by hand. 

You should also have Spyware and Adware programs installed, and be aware of any change in Internet browsing patterns. If your home page suddenly changes, or you experience advertising pop ups (which may pop up even when you are not hooked up to the Internet), you should run a Virus, Spyware or Adware scan. 

Thanks to the efficacy of these protection programs, pharming is a lot more difficult than it used to be. It isn’t as easy to hijack a computer as it once was. 

So, the pharmers have teamed up with the phishermen to get you to visit the bogus web page yourself, and enter all the information they need. 

PHISHING TO catch YOU on THE PHARM 

As Bob discovered, the page he had been taken to by the bogus email message was identical to the ebay logon page. Identical in every way except for the URL. 

Out of curiosity, he checked the URL for the ebay logon by accessing ebay directly and clicking on the logon link. The two URL’s were nothing alike, except the bogus one did have the word ebay in it twice – just enough to make it look authentic. 

By combining the two techniques, the phishermen/pharmers had avoided the high tech problems associated with downloading a Virus that could get past his protection software. They had gone straight for the throat. 

Bob’s throat. 

your ONLY REAL IDENTITY THEFT PREVENTION AND protection 

The bottom line is that the only real protection against the pharmers and phishermen is YOU. There are three things you must consider when you read any email demanding information: 

–  Why do they want it? Be extremely skeptical when they say they have to update their records, comply with federal regulations, or prevent fraud. They are the ones initiating the fraud. 

–  Why can’t this be done at the website? Why not invite you to access the website directly and provide this information? The answer is because the bonafide company doesn’t need an update. 

–  What does the URL look like? Is it a series of subdomains some of which have the name of the bonafide company? Most likely the subdomain is set up with a free hosting company. 

–  Have they provided partial information about you as a guarantee that the email authentically comes from the legitimate source? Be very careful of this one. This technique is effective for pretexting, impersonating a person or company, and was used in the Hewlett Packard scandal to collect information. Just because they know your first and last name (and any other information – known only to the legitimate source) doesn’t mean the email is legitimate. They probably hijacked the information off the server. 

the bottom line 

The bottom line is: don’t provide any information at the behest of an email, no matter how authentic it looks, or how authentic the page it directs you to looks. If you must log in, do so at the parent site itself. 

Your Identity Theft prevention and protection is, in the final analysis, up to you. 

Don’t be the next sheep fleeced by the pharmers who caught you with the phisherman’s hook. Being dropped naked into their frying pan is NOT a fate you want.

“Leaving your Web applications insecure makes no more sense than building a brick wall but using a gate made from chain link fencing. 

Whenever the President of the United States travels anywhere there are numerous individuals charged with making sure the President is secure and unharmed from attack. This is the premise behind Internet security. The work you have done on your site is the product of valuable time and energy. For some business owners the website represents significant research and creative energy. It is possible for a vulnerable website to be hijacked and remade in the image of something that only resembles your website in name only or to have safeguarded data copied for the use of a third party. 

One of the biggest mistakes a website owner can make is allowing the work to be left unguarded. As reported in recent years hacking of a computer system can occur both from within a company or from a remote location, which makes the use of Internet security so important. 

Advances in firewall technology (making them easier to install and configure), improvements in vulnerability scanning and better explanations of how to repair them, and better intrusion-detection with fewer false-positives are all key technologies in this race. 

Some hackers argue they are not involved in felonious activities, but are simply seeking knowledge and using the internet to find answers, however the U.S. Government views the activity as a felony and punishable by applicable state and federal laws. 

It should be noted that the term hacker has been adjusted. No longer is the term ‘hacker’ only used to describe someone gifted at programming and is able to break a website code to gain access to information. Today a hacker is also someone who misappropriates company data. Typically this scenario occurs from an inside and often trusted source. 

System administrators must learn about and maintain their systems securely. Users have to understand their security responsibilities. 
In many cases, business are now making a non-disclosure agreement a part of the hiring procedure to provide an extra legal recourse in the event that data is electronically removed and used in ways unauthorized by company heads. 

If a stranger came into your house, looked through everything, touched several items, and left (after building a small, out of the way door to be sure he could easily enter again), would you consider that harmless? 

Taking security issues seriously is needed in the development of a web-based business infrastructure. It may be worth exploring both on-site and off-site security features as a means of ensuring the long-term usability of your website.

Our society is maintained by information: information about who we were, who we are, and in some cases who we will become. We live in the Information age, a time where movement of information is faster than physical movement. Some say that we live in a new type of society called an Information Society, in which the creation, distribution and manipulation of information has become a significant economic and cultural activity. Matthew Lesko, a columnist, made this point clear when he wrote, “Information is the currency of today’s world.” Sir Francis Bacon an English statesman from the 1500s proclaimed wisely that, “Knowledge is power.” His words echo today in the familiar truism, “Information is power.”

In our lives today we experience how the personal information that we keep, that we share and that we lose, moves us through a waxing and waning dance of power and powerlessness. Keep your information safe and you protect your home, your assets, your family and maybe even your life. Share your information and in return you hope to receive valuable goods and services. Lose your information and the things that you enjoy and love can come crumbling down around you. 

Today, instead of on paper, most of our private information is stored in electronic format on hard drives. This technology allows our world to do business as never before imagined. Business is faster, less expensive and requires far less labor than even one generation ago. 

However, throughout history we discover that technological advancement has a price. Pollution and stress invades our environment and often our bodies. The loss of certain skills once familiar drives us toward a dangerous dependency. Now high-tech scam artists and thieves prey on victims around the world at the speed of light and neither needs to be awake for the crime to occur. With these things in mind we are moved to the realization that now is the time for each of us to examine the state of, and the danger to, our personal information. 

Your private information is vulnerable in two ways. It is vulnerable to loss and theft. We can compartmentalize your storage locations into two frameworks, your local, personal computer storage and your online storage. These frameworks each have their strengths and weaknesses. 

Your local, offline information can be stolen by someone breaking into your house, car or wherever you keep your computer. Your data can be destroyed by a hard drive crash, a fire or flood. It is difficult and time consuming to keep consistent, daily backups of your hard drive then store them at a location other than your computer. You can never be sure if your computer is at this very moment infected with spyware, adware, trojans, back doors, key loggers, bots or viruses. Each one is capable of taking control of your computer and sending your valuable, private information from your hard drive to anywhere in the world. 

Many people enjoy keeping notes and documents online. People every day are discovering the convenience of having their thoughts, to-do lists, diaries, customer lists or essays available from any computer in the world. Business people, real estate agents, sales people and others are now getting more work done more efficiently thanks to the wellspring of online document authoring sites. 

Now freed from the task of daily backups and concerns about loss and theft due to an infected computer, only one thing remains from making online document authoring and storage the perfect solution: privacy. 
Unless you see that the address of the website you are on begins with the five letters https, your login ID and password are sent in plain text through unknown places over the Internet. Your documents and everything you type is available to be seen, captured and used by criminals and scam artist devious enough to use that which was supposed to be private. 

Once your information is on the remote computer, do you know how your data is stored? Do you know who has access to it? Perhaps it is a computer technician who think it’s fun to read about other people’s lives and secrets. Perhaps it’s someone who sells information on the side to make a little extra money. You just can’t know. And unfortunately, none of these sites seem to care enough about your privacy to encrypt your documents to prevent this from happening.

Your subscriptions to your favorite anti-virus and spyware software expired 28 days ago. You have been meaning to pull out your credit card and renew. However, you just haven’t gotten to it. 

Yesterday an e-mail, SPAM really, hit your inbox with an interesting by-line on the latest natural disaster. You click on the innocuous looking link. The next thing you know, Internet Explorer doesn’t quite work correctly, followed by a failure of Windows Explorer, followed by your PC running really slow. You have just been hit with spyware! Next thing you know, your PC will not boot and you are dead in the water.

This Whole Scenario is Preventable 
In this example (which is played out dozens of times every day) the user did not keep his/her software counter measures up to date. There are some extremely top shelf software products available which do a simply wonderful job of keeping up with the latest spyware and virus threats. In fact, by employing several similar products you can often catch threats with one product which was not neutralized by another. 

However, there are no guarantees here! A variety of circumstances may result in a threat to your PC. Depending solely on software counter measures (e.g. anti-spyware, anti-virus software) is only part of the story. You can actually take your destiny and digital protection in your own hands and add another layer of protection. 

Software Backup- Your Own Version of Digital Time Travel 
The two approaches available are: 
·  Data Backup 
·  Image Backup 
Data Backup refers to making a copy of your valuable files, personal and business information on some other media that is physically separate from your computer. A myriad of products and services exist for storing this information including USB drives, DVDs, CDs, external disk drives, network drives, archiving services and even the humble diskette. 

However, you must really think through all of the information contained on your computer that you want to save if your PC or Server became unusable including: 

·  Files from software applications like Word, PowerPoint, etc 
·  e-Mail files 
·  e-Mail rules and SPAM filter settings 
·  Web browser favorites 
·  Customizations of installed software products 
·  Product installation keys 
·  Password files 
·  Software installation files 
·  Desktop background images 

Image Backup refers to a process where your server environment is saved. The difference is that in the case of a data backup you may have saved ALL of your valuable information. This is the good news. The bad news is that you have now have to rebuild your personal computer’s software: 

·  The operating system, complete with maintenance 
·  Customizations that might include your Internet Service Provider settings, preferences, etc 
·  Shortcuts 
·  Registry customizations 

An image backup makes a snapshot of your entire server. The ideal scenario is that you tweak and install all of your software. At the point where things are working just right, you take your snapshot which you store away in a safe place. At this point you also start to regularly make regular backups of your valuable data that has changed since the snapshot has changed. 

If you have the misfortune to get nailed by malicious software that cripples your computer, you now have the ability to 
·  Restore your computing environment 
·  Restore the most recent copy of your data 

You now can keep on trucking with a minimum of disruption. This approach does take a bit of discipline. However, it really does not take a whole lot of time. These backups can be started when you go to bed, and will be completed by the time that you wake in the morning. 

The alternative is spending time trying to rebuild your system (if you can find all of the software) and IF you can get your valuable data off of your crippled server. It’s a simple matter of time, money and aggravation. It’s your choice…