IT Security Awareness – Privacy and WEB Browsers
OK, let’s take a look at WEB Browsers. It’s your window to the World Wide Web, but just like in a house a window can be used to break in as well as look out. We have limited my explanations to Firefox from Mozilla and Internet Explorer from Microsoft. The same sorts of tips apply to other browsers such as Chrome, Safari, and so forth.
#1 Keep it up to date (update the locks on the window)
It may seem obvious, but when your browser version is updated it often closes many “holes”. Internet Explorer is currently at version 9 and Firefox is at version 5. Both have minor updates regularly so keep an eye out for them. For Internet Explorer, make sure you have Windows Updates enabled on your computer. Firefox will generally let you know when an update is available but you can always go into Help, About Firefox to check.
Of course it’s not just the WEB browser. It’s also all the add-ins and other tools on the computer. It’s important to make sure they are kept up to date as well. It can be a daunting task but there are tools out there to help. Obviously with Microsoft products you can make sure Automatic Updates are enabled, but for other products, they these :
- Secunia Consumer products (http://secunia.com/products/consumer/) : These tools will scan your
computer and ensure that the latest versions are installed. If not they will assist you in getting updated.
- Qualsys Browser Check (https://browsercheck.qualys.com/) : This tools will scan your Web Browser and
ensure that it, and your plugins, are updated. If not they will assist you in getting updated.
If you don’t have time to keep up to date with all your plugins, at the very least keep on top of Adobe Flash and Adobe Reader.
#2 Change the security settings (add bars to the window)
Internet Explorer 8 and higher come with a number of features enabled by default. Earlier versions may need a tweak. There is a huge amount you can
configure with Internet Explorer ranging from DEP (Data Execution Protection/Prevention) all the way to blocking scripts and popups, disabling cookies, phishing filtering, controlling content and downloads, managing component behavior and cross domain security, and so forth. If any of that sounds like geek speak then you may want to get guidance before changing stuff as you can seriously impact your browsing pleasure ! If you are feeling brave then pretty much everything is configurable from the Tools / Internet Options menu.
Firefox also has a plethora of configuration updates that can help (or hinder) your time on the Web. These are mostly available under Tools / Options.
However, there are other options available for you in the guise of plugins. Firefox has a vibrant plugin market (not all of which are “good” or “safe”).
We have listed a couple here to get you started!
- NoScript (http://noscript.net/) : Provides a level of protection against various forms of scripting attacks. It’s been
around for a while now and has a good history.
- HTTPS Everywhere (https://www.eff.org/https-everywhere) : This plugin tries to connect to a WEB site
securely (using HTTPS) if you forget. If the site does not offer a secure connection it reverts back to an insecure connection. It takes the guesswork away!
#3 Keep a good firewall and anti-virus program installed and updated (add a burglar alarm and a security guard)
Yes, we know, we keep saying it. Anti-virus software is a must these days, and it needs to be a good one (there are some very good free products too). It really pays for itself the first time you visit a compromised WEB site (do we all remember the Herald Sun incident a couple of weeks ago?). When combined with a firewall, be it on your computer or between your computer and the Internet, you really do get yourself off to a great start.
Now, we don’t want to start any arguments here, but both anti-virus and firewalls are really a very good idea regardless of what operating system you use. Enough said.
#4 Try out some WEB site warning or blocking services (employ an armed patrol at the gate)
What about the idea of knowing a Web site is potentially bad before you even get there ? Well, you can. There are a number of solutions out there already.
Later versions of Internet Explorer, for example, will let you know if a site is possibly worrisome. These two options are also very good and have been
around for a while
- OpenDNS FamilyShield (http://www.opendns cheap cialis generic online.com/home) : OpenDNS provides a free service that allows you to change
over and use THEM as your Internet DNS provider (rather than your Internet provider which is the norm). Due to the nature of how the Internet works they
will let you know before you actually get to a site if it does not meet a set of criteria you lay out.
- WEB Of Trust (http://www.mywot.com/) : This is a community effort that allows you to vote on the reputation of a Web
site and be alerted to the opinion of others on the Internet.
#5 Don’t be an administrator (keep the key somewhere else)
It’s almost never a good idea to be an administrator of your own computer when browsing the Internet. While operating systems in general have improved tremendously over the years it is still possible to configure a computer so that you are always an administrator. Whenever possible, don’t. The fewer permissions you have when you browse the Internet, the fewer permissions the malware has when it attacks !
Other technologies help to reduce the risk. Things such as UAC (in the Microsoft world, and it’s equivalents in the Apple and Linux worlds) go a long way towards helping. But heed point #6!
Other options include “sandboxing” and “virtualization”, but that is really another article all together.
#6 Use your own good judgement (… don’t live next door to anyone that scares you)
Yes, at the end of the day technology can only do so much. You need to be vigilant and wary. Always take note of waning messages that pop up rather than just clicking “Continue” or “Ok”, because in effect you are telling all that protection technology you have installed that “I really don’t care, just
install that virus and let it do what it wants”. Also, letting your Web Browser store you passwords for you is generally not a fantastic idea. There are a
plethora of applications that are easy to get hold of and whose sole purpose is to get your “forgotten” passwords out of your WEB browser, be it Internet Explorer, Firefox, Chrome, and so forth.
Well, that is about it for this edition. Check out the rest of our website for more IT blogs and feel free to pop us an e-mail with any questions or suggestions.