Security isn't a program - it's a mindset. It's educating yourself and keeping that knowledge up to date.
I'd recommend starting with 3 things:
1) anti-virus AND anti-spyware
This usually causes managers and financial people to cringe, but you can find good free options out there for both. The two anti-virus I've heard the most about are
Avast and
ClamAV
For spyware I've used previous versions of
AdAware (there is a free link on there somewhere), and liked it, though I haven't used it recently
2) computer patching and 'hardening'
I would recommend updating/patching all desktops to the 'latest and greatest' versions. This is, of course, after testing such updates/patches on a low-priority system to ensure it won't break any of your applications.
Windows systems can be updated from
here
Linux/Unix systems differ per version, but you can google '<version> linux update' and find good links
Hardening each computer merely means doing 'standard preventative measures' (like having fire exits clearly marked in buildings). There are many methods, and the important things are to pick the ones that apply to your systems. I'd recommend starting
here
3) Knowledge
Passwords - Write down a clever sentence or phrase that you use frequently. Mash it all together so there are no spaces. Use 'leet' speak to play with the combination of letters/numbers/capitalization. Pick out noticeable fragments.
For example:
The TV show Chuck is hysterical
TheTVshowChuckishysterical
7heTVsh0wChuck!shyst3r!c@l
7TVsh0wC!hy
I have several of such passwords for different uses (accounts I don't care about I re-use one of such passwords) That's 10 characters, mix of letters, numbers, and capitalization, and will be a good standard password, plus is a show I've watched for 3 years and thoroughly enjoy.
SSL - if a website doesn't use SSL, it's probably not secure (though there are exceptions such as VPN). Research what SSL is and what makes it secure - what certificates are good/bad, and how to look for 'phishing' attacks that use common misspellings or similar-looking letters
As an example, yourbank.com yovrbank.com - one letter difference, but also the difference between losing your identity and not
The last thing for a 'quick' education I can recommend is NEVER click links or enter info into an email. Even if a friend sends me something, I type the URL in manually and then search the site for the link they want me to see. A person can link ANYTHING to a set of text. For example
http://www.chase.com does not go to chase.com, but rather disney.com. Hackers can get even more complicated and do various things like URL masking (if you see instead something like htp://10.129.186.58, but chase.com loads - it's a compromised copy of the site), or redirection where it'll show chase.com/abunchofstuff and then after the 'abunchofstuff' scrolls off the screen there is a 'redirect' command to the compromised site, or even use the method I showed earlier about sending to a similar site
My final recommendation is to assume your boss' computer has been compromised. I'd suggest having him write down for 3 days everything he uses to ensure that you've got everything, and the folder path to all such information. Backup that information, and any other 'known' info on the box, and completely reinstall everything - that'll wipe out the virus (hopefully), and get him going on a 'hardened' system
There are lots more things I could recommend, but those are the basics I recommend starting with - I'm sure other people can chime in and post suggestions as well
23
