Security

10 Commandments of Windows Security

With the introduction of Windows 7, many PC and notebook users may feel more secure than they did using older versions of the Microsoft operating system. Newer OSs have more security features, offer better out-of-the-box security settings and have closed many of the historical security holes. Windows 7, for example, has changed the default User Account Control level so that it's harder for rogue programs to run without first explicitly gaining the user's permission.

[Also read 3 steps to protect your personal data]

However, feeling too secure can be dangerous. With that in mind, here are 10 tips--commandments, if you will--for ensuring your desktop or notebook computer can be used productively as well as safely. Many of the recommended tools are free, and all are affordable--and certainly less expensive than the potential problems of an unsecured computer. Similarly, many will take you only a minute or two to perform--again, far less time than you'd spend recovering from a security problem.

Yes, Windows 8 is on the way; it'll be many years before that version runs on a majority of the installed base. So these tips are focused at the computers you are actually using today--especially Windows 7 computers, though most of the advice also applies to Windows Vista or XP machines.

1st commandment: Start with new hardware

Today's new hardware--motherboards, BIOS, CPUs, hard drives, and the system as a whole--includes more security "baked in," even before the operating system is installed. Examples include Trusted Platform Modules (TPM), which embed cryptographic security directly into the hard drive or other component, Unified Extensible Hardware Interface (UEFI) firmware instead of the traditional BIOS, and Intel's vPro security and management technologies. For example, machines with UEFI and TPM will, as part of each boot-up, check the computer's firmware and boot-up binaries to confirm they have not been infected with malware.

If you are working with an existing machine, consider doing a fresh install of the operating system, after completing one (or several) full backup. Ideally, the operating system would be the newest version rather than what was previously installed. (Products like LapLink's PC-Mover can reduce the effort of saving and migrating settings and even application software--although applications should be freshly installed if possible, as well.)

Even if you're working with an existing machine, consider swapping in new hard drives that include built-in encryption. Drives that support the OPAL Storage Specification standard enable companies to manage encrypted drives from multiple vendors--and have also helped reduce the extra cost for an encrypted drive from $100 to nearly zero. After-market drives often include migration tools to speed and simplify a drive swap.

If a self-encrypted drive isn't an option, look at using full-disk encryption software, such as Windows' BitLocker (available only on Enterprise or Ultimate Windows Vista, 7 or 8) or a third-party tool.

2nd commandment: Use current OS versions and automatically get OS and application updates

If you aren't using the most current commercial version of the operating system, it's time to upgrade. Additionally, make sure you set the software to automatically apply updates (not just the OS, but all applications) and periodically turn off the computer, which is when many updates are auto-applied. An appalling number of security breaches occur because applications lack important security fixes that have been available for a year or more.

The computer vendor may also include helpful update tools. For example, Lenovo includes an update process that is designed to show all BIOS and driver updates available for that particular model. You can also manually start the update-check apps process. This may take several cycles, particularly for the first time around, if some updates require other updates.

"Third-party software is usually the vector that security intrusions come through, not the operating system," says Ed Bott, a Windows expert and ZDNet blogger. Flash, Adobe Reader and Java are three of the biggest targets, Bott says. While many programs include their own automatic update checker, Bott urges using a tool like Ninite or Secunia Personal Software Inspector, which automate update checking for all the applications on your computer.

3rd commandment: Use Windows' new security tools (and/or third party software)

Windows 7 includes a number of security controls and tools through its Actions Center (which replaces the Security Center), and other tools are available via the Control Panel, including:

  • Windows Firewall: With its basic settings, this wards off basic attacks, and you can use its advanced settings for more specific control. There are also third-party firewall programs available.
  • Microsoft's Microsoft Security Essentials and Windows Defender. These tools secure your computer against viruses, spyware and other malware.

Obviously another option is to invest in third-party security software, like individual anti-virus, anti-spam and other programs, or a security suite, such as Symantec's.

4th commandment: Set up (or remove) user accounts

Historically in Windows, the default account had administrator privileges--meaning that programs capable of taking unwanted insecure actions wouldn't have to first ask the user if they could run. Starting with Vista, Microsoft added User Account Control (UAC), which asked non-administrator users for permission to run certain programs or actions. With Windows 7, UAC still protects systems but less intrusively.

[Can you guess the 15 worst data breaches?]

Even so, managing which user accounts are--and aren't--available contributes to security in the following ways:

  • Establishes non-administrative user account(s) for each user.
  • Disables or removes user accounts that aren't used or shouldn't be there.
  • Disables the "guest" account, unless it's needed. If it is needed, a password should be required for elevating privileges, to prevent unauthorized changes to the system.

Consider renaming the administrator account so that it's not obvious to an intruder. Since this account can't be "locked out," password attacks can be performed indefinitely; changing the name makes the account less of a target.

5th commandment: Set passwords

Set the main Windows password, as well as the Power/Time to lock the system, with a screen saver, and require a password to resume activity.

Also, depending on the sensitivity of information on your system (did someone say "online banking"?), consider password alternatives, such as:

  • Fingerprint reader
  • Smartcard reader (contact or contactless)
  • Biometric facial recognition
  • RSA software and external token
  • Password "gesture" (e.g., Android tablets)

Another option is two-factor authentication, such as requiring both a fingerprint and a password.

Subscribe to the Security Watch Newsletter

Comments