Security for all-2004-08-01-Seven ways to prevent computer hacking.-Nick Brookins

There are an estimated 58,000 computer viruses in existence worldwide, and they are multiplying at a disturbing rate, with 400 to 500 new viruses emerging each month. Over the past year, there has been a 65 percent increase in security threats to information systems. In the past two years, the number of internal network intrusions has almost quadrupled. Despite these astonishing statistics, the Fifth Annual Information Security Survey by Ernst & Young found that only 64 percent of respondents monitor networks for security incidents and an equal number have no response plan for security breaches.

The reality is that any small business with a broadband connection to the Internet risks becoming a victim of a cyber crime. Skilled computer hackers are intent on breaking into private computer networks. These attackers can infect systems with viruses or gain access to sensitive files that could include financial information and confidential customer records. Many hackers can penetrate networks and use them as a launch pad for sending junk e-mails to disrupt or overload other networks. Ultimately, such attacks can crash a network, potentially causing data to be permanently deleted or irreparably damaging computer equipment or systems.

Cyber-crime also packs a mean punch in terms of dollars lost. For example, the cost of a denial-of-service (DoS) attack, in which hackers attack a site with phony traffic in order to overwhelm and crash servers, can run into the millions of dollars. In February 2000, in a well-coordinated DoS attack, hackers successfully crippled Amazon.com, eBay, CNN, and Buy.com, one day after a similar attack halted Yahoo's service for hours. Since then, numerous small businesses have been the victim of DoS attacks.

However, the news is not all bad. While the threat of hackers and viruses remains real, there are a number of simple, highly effective steps that small-business owners and network administrators can take to protect their systems against cyber-sabotage (not to mention sleep better at night). Following are some key pointers.

Implement a firewall

As the name implies, a firewall is a barrier that keeps destructive forces away from computer networks. All firewalls, whether software systems or hardware computer appliances, intercept network traffic, allowing only authorized data to pass through. A firewall is your system's best defense against would-be intruders.

The cost of implementing a firewall depends on product features and implementation. The price can range from a few hundred to thousands of dollars.

To be effective, firewalls must work in concert with other efforts to provide a safe computing environment. Cyber security is a process, not a product, and firewalls should be viewed as one component of the strategy in achieving network security.

Develop a corporate security policy

Establish a corporate security policy that details company practices to secure the network. The policy should direct employees to choose unique passwords. This is important because brute-force password cracking programs readily available on the Web contain tens of thousands of common passwords, such as 1234, abcd, admin, access, and buzz. Accordingly, companies should require passwords to be non-dictionary terms and a combination of letters and numbers. Passwords should also be changed every 90 days so that by the time a hacker or co-worker has gained access to a password, it's already changed.

When an individual is no longer employed by the company, immediately eliminate his or her access to the network by deleting the username and password.

The corporate policy should outline consequences for current and former employees found tampering with or entering the network without authorization.

Install antivirus software

Antivirus software is a powerful tool against network invasions. All computers should run the most recent version of the virus protection subscription. Ideally, a server should be configured to push virus updates out periodically to all client systems, since new virus signatures are discovered nearly every day. Viruses are among the greatest threats to network firewalls and can spread quickly. Employees should be educated about viruses and discouraged from opening unexpected e-mail attachments, or e-mail from unknown senders.

Two common antivirus software packages are Norton and McAfee; the price will vary depending on how many agents are needed for the network, and what additional packages are required, such as Antivirus for Exchange Server or SQL Server.

Keep operating systems up to date

Upgrade operating systems frequently and be sure to regularly install the latest patches or versions of software. Updates and patches are often free over the Web. Maintaining the most recent version of a software product will help you stay ahead of hackers. On older versions of software, hackers have had time to break the code, which allows them to easily disrupt systems. This means that a computer running version 5.0 of a product is typically more secure than a system running version 4.0. Check Windows >www.windowsupdate.com< periodically for the latest patches.

Don't run unnecessary network services

When installing systems, servers in particular, every network service is a potential security hole. For this reason, any non-essential features should be disabled. For example, a domain controller or file server typically doesn't need to run the IIS Web/FTP servers, so these options should not even be installed. There have been numerous viruses and exploits for IIS, and if an organization has it installed but is not actively using the feature, it is less likely to be updated regularly, often presenting an even larger security threat than it would to someone who actively uses the feature.

In addition, allow only the software your employees need to do their job effectively. If employees don't need instant messaging or file-sharing applications, don't allow them to be installed, and block their access at the firewall. By limiting the network and excluding nonessential services, security risks can be greatly reduced.

Conduct a vulnerability test

Conducting a vulnerability test is a cost-effective way to evaluate the current security program. This test highlights flaws and limitations in the program, and as a result, experts can offer ways to decrease exposure to a potential hacker. The best method for conducting a vulnerability test is to contact a computer consulting company and provide access to your system for a day or two. This will provide ample time for network appraisal and follow-up discussion and planning.

Read current literature about network security. Numerous books, magazines, and online resources offer current insights on effective prevention tools, and "lessons learned" from recent attacks. Also, the Web provides ample and very current information about security--type in the keywords network security on any search engine site.

These types of assurances can offer both peace of mind and real security to business owners. Preventive security measures, combined with a little bit of common sense and network vulnerabilities awareness, can ensure that your business won't be a hacker's next victim.

Here are the topics we cover computer certification computer careers computer training computer games consulting data recovery data security digital entertainment emerging technology gadget reviews handheld computers hardware reviews home automation home networks home office how-to advice internet linux local companies local news local profiles macintosh mp3 players network security online music online security open-source small-business technology soho software reviews technology books technology dictionary vpn web site reviews wi-fi windows wireless technology tech articles tech news press releases tech dictionary education resources career solutions create your personal blog upload your videos become a writer usergroups special interest group SIG 3com cipts adobe adobe certified expert apc ncpi apple achds acpt acsa actc avaya bea 8.1 certified administrator 8.1 certified architect 8.1 certified developer 9 certified administrator bicsi rcdd checkpoint ccmse ccsa ccsa ngx ccse ccse ng plus with ai ccse ngx cisco access routing and lan switching ccda ccdp ccie ccip ccna ccnp ccnp old ccsp ccvp crmam ip communications optical proctored exams for validating knowledge sales specialist storage networking vpn and security wireless lan citrix cca 3.0 cca 4.0 cca 4.5 cca xp ccea 3.0 ccea 4.0 ccea xp ccia ciw ciw associate ciw certified instructor master ciw admin master ciw designer master ciw enterprise developer security analyst comptia a+ network+ security+ server+ computer associates ca cusa cuse cwna cwna cwsp dell eccouncil cea cep certified ethical hacker chfi e-commerce architect emc emc specialist implemenation technology foundations enterasys ese eta exam express exin exin itil extreme networks ena ens filemaker f7cd f8cd fortinet fortigate foundry cne fujitsu fujitsu guidance software ence hdi css hda hdm hdsa hitachi hitachi certified professional hp ais apc app aps ase certified systems developer csa cse master ase huawei hcne hyperion hcp ibm advanced deployment professional advanced technical expert application developer business process analyst certified administrator certified advanced system administrator certified advanced technical expert certified associate developer certified enterprise developer certified solution designer certified specialist certified systems expert database administrator db2 deployment professional enterprise developer eserver certified specialist ibm on demand business solution advisor solution designer solutions developer solutions expert storage administrator system administator iisfa cifi intel isaca cisa isc cissp sscp iseb itil ism cpm juniper jncia jncis legato lcaa lcea lotus clp lpi lpic level 1 lpic level 2 lpic level 3 macromedia mcafee mcdata csnd microsoft crm mbs mcad .net mcdba mcdst mcitp mcp mcpd mcsa longhorn mcsa 2003 mcsa 2008 mcsd .net mcse mcse 2000 security mcse 2000 to mcse 2003 upgrade mcse 2003 mcse 2003 messaging mcse 2003 security mcse 2008 mcts microsoft business solutions microsoft partner competency mile2 cnsa network appliance nac-na nac-nie naca nace nacp network general sniffer certified professional nokia nokia security administrator nortel ncde ncds ncse ncss ncts novell5 cna 5 cne 6 cna 6 cne 6.5 cne cne upgrade omg ocup oracle 10g dba 10g oca 11i 8i dba 9i dba 9i internet application developer oca ocp8 to ocp8i dba upgrade exam pmi project management professional polycom pcve redhat rhce rhct sair sas institute sas scp saas scp snia snia certified architect snia certified professional snia certified systems engineer snia storage networking certification program administrator professional associate symantec scse scsp scta scts teradata tca v2r5 tcad v2r5 tcda v2r5 tcis v2r5 tcm v2r5 tcp v2r5 tia ccnt ctp tibco tcp trusecure ticsa veritas infraguard chamber of commerce vcp vmware certified professional webex linkedin facebook myspace Professional page layout, image editing, vector illustration, and print production Website design, development, prototyping, and blogging Creation of rich interactive content Industry-standard visual effects and motion graphics Video capture, editing, and production; DVD titling; and digital audio, Adobe Photoshop CS3 extended, Adobe illustrator CS3,Adobe indesign CS3,Adobe Acrobat 8 Professional, Adobe Flash CS3 Professional, Adobe Dreamweaver CS3,Adobe Contribute CS3,Adobe Fireworks CS3,Adobe After Effects CS3 Professional, Adobe Premiere Pro CS3,Adobe Soundbooth CS3,Adobe Encore CS3,Adobe OnLocation,Adobe Bridge CS3,Adobe Version Cue CS3,Adobe Device Central CS3,Adobe Stock Photos, Intel Pentium 4 (1.4GHz processor for DV; 3.4GHz processor for HDV), Intel Centrino, Intel Xeon, (dual 2.8GHz processors for HD), or Intel Core, Duo (or compatible) processor; SSE2-enabled processor required for AMD systems Microsoft Windows XP with Service Pack 2 or Microsoft Windows Vista Home Premium, Business, Ultimate, or Enterprise (certified for 32-bit editions) 1GB of RAM for DV; 2GB of RAM for HDV and HD; more RAM recommended when running multiple components 10GB of available hard-disk space (additional free space required during installation) Dedicated 7,200 RPM hard drive for DV and HDV editing; striped disk array storage (RAID 0) for HD; SCSI disk subsystem preferred Microsoft DirectX compatible sound card (multichannel ASIO-compatible sound card recommended),1,280x1,024 monitor resolution with 32-bit color adapter Blu-ray burner required for Blu-ray Disc creation OHCI compatible IEEE 1394 port for DV and HDV capture, export to tape, and transmit to DV device QuickTime 7.1.2 software required to use QuickTime features Broadband Internet connection required for Adobe Stock Photos* and other services

3PAR, Accellion, Acronis, Actional, Active Endpoints, ActiveGrid, activePDF, ActiveServers, ActiveState, Actuate, Adaptec, Agile Software, AGiLiENCE, Agilysys, Akorri, AlachiSoft, Alter Logic, Altor Networks, Altova, AMD, AMDAHL, Amentra, Amyuni, anacubis, Apani, APC, Appcelerator, AppSense, AppStream, Array Networks, Ascential, Astaro, Attune Systems, Autodesk, AutoVirt, Availl, Avanade, Azul Systems, Barracuda Networks, BEA Systems, B-hive, Black Duck Software, Blackbaud, Blade Network Technologies, Blue Coat, Blue Lane, BlueArc, BlueNote Networks, BluePheonix Solutions, BMC Software, Borland, Bristol Technology, Brix Networks, BroadVision, Brocade, Burton Group, Business Objects, CA, CalAmp, Cassatt, Cast Iron Systems, Catbird, Cayenne Technologies, Ceedo Technologies, Cenzic, Certeon, CiRBA, Cisco Systems, Cision, Citrix Systems, ClearApp, ClearCube Technology, CollabNet, Compass America, Composite Software, Compugen, Compuware, Configuresoft, Continuity Software, Coraid, Courion, Coyote Point Systems, Crescendo Networks, CSC, DataCore, DataSynapse, Dell, Desktone, Digipede Technologies, Double-Take Software, Ecora Software, EDS, eG Innovations, Egenera, Elastra Corporation, Electric Cloud, Embotics, EMC Corporation, Emulex, Endeavors Technology, Enigmatic Corporation, Enterprise Management Associates, Entuity, EqualLogic, Ericom Software, ESRI, EVault, eXludus Technologies, F5 Networks, FalconStor, FastScale Technology, Foedus, Force10 Networks, Fortisphere, Forum Systems, Fujitsu, GemStone Systems, Getronics, GlassHouse, Green Hills Software, Grid Dynamics, GridGain Systems, GT Software, Hitachi, HP, Hyper9, Hyperic, IBM, ICEsoft, IGEL Technology, Illumita, ILOG, IMEX Research, Information Builders, Ingres, InstallFree, Integrien, Intel, Intellium, International Computerware, iTKO LISA, JBoss, Juniper, KACE, Kidaro, LeftHand Networks, Leostream, Lifeboat Distribution, Liquid Computing Corporation, Liquid Technology, Lynux Works, Mainline, ManageIQ, Managed Methods, ManageSoft, Marathon Technologies, McAfee, Mellanox Technologies, Microsoft, Mid-Atlantic Computers, Mindbridge Software, Mindreef, MKS, MonoSphere, Motorola, MQSoftware, mySoftIT, NASTEL, Ncomputing, NEC, Neocleus, NeoPath Networks, Neoware, NetApp, Netegrity, Neterion, Netuitive, Neverfail, Nexaweb, NextAxiom, Nimbus, Nimsoft, Niyuta, NoMachine, Novell, ONStor, Opalis Software, Open Kernel Labs, OpenSpan, OPNET Technologies, Optaros, OpTier, Oracle, Pano Logic, Parallels, Parasoft, Perforce Software, PHD Technologies, Phoenix Technologies, Phurnace Software, Pillar Data Systems, PlateSpin/Novell, Progress Software, Prolifics, ProSync Technology, Provision Networks, QLogic, Quest Software, Racemi, Raritan, Raxco Software, Red Hat, Reflex Security, Resolution Enterprises, RingCube Technologies, Riverbed Technology, Rogue Wave Software, RSA Security, Sagnet Solutions, SanDisk Corporation, SAP, SAVVIS, ScaleMP, Scalent Systems, Seanodes, Secure Command, Secure Computing, Sentillion, Shavlik Technologies, ServInt Internet Services, Silpion IT Solutions, SIMtone, Skytap, Skyway Software, Software AG, Sonasoft, SourceGear, Splunk, StackSafe, SteelEye Technology, StillSecure, StoneFly, Stonesoft, Stoneware, StoreVault, StrikeIron, STT WebOS, Sun Microsystems, SunGard, Supermicro Computer, Surgient, SWsoft, Sybase, Symantec, Systar, TBD Networks, Tenfold, TheInfoPro, Thinstall, Third Brigade, TIBCO Software, Tidal Software, Tideway Systems, TOA Solutions, TRANGO Virtual Processors, Trend Micro, Tresys Technology, Trigence, Tripwire, Ulteo, Unisys, United Devices, VaST Systems, VDIworks, VeeAm Software, Verari Systems, Verio, VeriSign, Vicom Computer Services, VirtenSys, Virtera, Virtual Iron, VirtualLogix, Virtugo Software, Virtutech, VisionCore, Vizioncore, VKernel, VMLogix, vmSight, VMware, Vordel, vThere-Sentillion, Vyatta, WaveMaker, Web Age Solutions, WSO2, Wyse Technology, XDS, XenoCode, Xiotech, xkoto, Xsigo Systems, Zenith Optemedia, Zeus Technology.