Hi Aashutosh and all, I have seen some bizarre advice posted on this thread as well as on other threads of this nature. I am going to try and clarify things. Warning, this post is long. 1. Attackers can get on to your machines in several ways, chief amongst them are as follows. A. You copy an infected file on to the computer. B. Your computer is unpatched and there is no other protection mechanism active so it is found by an external attacker and infected. Alternatively, your computer is running a legacy operating system for which there are no updated security fixes. C. You are tricked into visiting a website that has been crafted to distribute malware or you open a malformed or malicious document that infects your machine with malware. D. You visit a legitimate website that has been infected by malware. 2. You can quote statistics endlessly to say which browser is better and or less prone to infection. These things fluctuate and it really does not matter because you have no control over what malware hits said browser. The best way to secure your browser is to control what executable content runs on it. I will elaborate on this subsequently. 3. Most anti-malware applications work by looking for malware signatures. An analogy would be a thief leaving a green circle on the door of every establishment he robs. All the police then have to do is to find the green circles and they can catch the thief. If they want to be proactive, they can look for everyone drawing green circles on the doors of their houses, shops or offices and catch them. In our case, the thief is malware, the signatures are the green circles that in computer terms are modified files, registry entries etc and the establishment is your computer. There are 3 problems with the above scenario. (1) You need to know the behavior of every thief and his signature. (2) It is possible that you are drawing a green circle on your door as a part of a design. However, a green circle is the signature of a thief so you are prevented from drawing that design. In other words, the police may block legitimate activity that involves behavior that is deemed to be malicious. (3) In many cases, detection is after the fact. 4. The question then arises of effective measures that you can take to ensure that your computer is protected. The most effective measure is not to get malware on to your machine. The problem with security is that we deal in probabilities. I can take every counter measure but the threat vector may change or I am human and I may not implement something fully because it is too inconvenient or stops business. You need to achieve a balance between protection measures and what you do with the computer. 5. I am giving you a list of steps I take to stay protected. Remember, this list works for me and may not meet your needs. A. I keep the operating systems on all my devices fully patched. Yes, this means windows update, an apt-get update and a subsequent apt-get upgrade for Linux boxes etc. B. I do the same for all programs I run. Most include an automatic update facility. The same applies to my home router and other network devices. C. I do not run as administrator. This allows me to use the native machinery of the operating system to stay protected. D. I maintain regular backups of my data and images of the operating system and software that I have installed. This is crucial in my case given my high dependence on technology. I need to minimize downtime. E. I read program installation screens carefully and ensure that unwanted programs such as toolbars are not installed. F. I keep complex passwords across websites and use a password manager. Each website has a unique password so that even if one password and or website is compromised, the chances of the attacker gaining access to other elements of my online presence are minimized. G. I use opendns to avoid visiting known malicious websites. H. I use an up-to-date anti-malware application. I. I have a home router that allows me to define firewall rules. As of this writing, it is not possible to connect to my home setup from the outside. J. I experimented with disabling flash and java script in terms of limiting my attack surface. This was too inconvenient for me therefore I have left them enabled. K. I do delete web browsing history and cookies from time-to-time.
I hope this helps. Pranav Time to meet up again! Register for AccessIndia Convention 2014: http://accessindia.org.in/harish/convention.htm Register at the dedicated AccessIndia list for discussing accessibility of mobile phones / Tabs on: http://mail.accessindia.org.in/mailman/listinfo/mobile.accessindia_accessindia.org.in Search for old postings at: http://www.mail-archive.com/[email protected]/ To unsubscribe send a message to [email protected] with the subject unsubscribe. To change your subscription to digest mode or make any other changes, please visit the list home page at http://accessindia.org.in/mailman/listinfo/accessindia_accessindia.org.in Disclaimer: 1. Contents of the mails, factual, or otherwise, reflect the thinking of the person sending the mail and AI in no way relates itself to its veracity; 2. AI cannot be held liable for any commission/omission based on the mails sent through this mailing list..
