10 Commandments of Windows Security
6th commandment: Add/activate anti-theft tools
Invest in, install and activate anti-theft tools that can either lock the system; conduct an IP trace; report, take and send pictures; and even wipe the computer when a lost or stolen computer reconnects to the Internet. An example is Absolute Software's Lojack for Laptops.
Vendors like Lenovo are embedding Absolute's CompuTrace Agent into the BIOS, so even if somebody erases or replaces the hard drive, the agent is automatically re-installed.
Computers that include Intel Anti-Theft technology in their hardware let you add additional security services, such as automatically locking the main board until it receives the "unlock" password, lock or wipe if a machine goes too long without connecting to the Internet or if a user fails the login process too many times. Intel Anti-Theft is typically part of third-party security products like CompuTrace, adding perhaps $3/year, and as the anti-theft option on WinMagic's full disk encryption product.
7th commandment: Turn off sharing and other unneeded services
Windows allows you to share resources that are on your computer, like file-sharing (Shared Folders) and print sharing. Your computer's Internet connection management utility (Windows includes one, but many systems have their own) lets you define each network as either Public, Home or Work. If you mis-set a connection, your Shared Folders will be visible to other computers on the network.
Suggested Desktop Security Reading
- Windows 7: Explore New and Improved Security Features (Microsoft)
- Security checklist for Windows 7 (Microsoft)
- "Enhancing Endpoint Security for Windows Desktops," Derek Melber, President and CTO of BrainCore.Net
- Best Practices: Windows Desktop, IT Security for the University of Missouri
If you are behind a firewall, when your computer's Internet connection manager tool asks you what kind of location/connect it is, you can call it either a Home or Work network, Bott says. But specify Public network if you are connecting directly to the Internet (e.g., at home or in the office), if you don't have a hardware router but instead are directly connected to the cable modem, or if you are connecting to a public network like a Wi-Fi hotspot or a hotel or conference Ethernet. This will ensure that no local sharing is allowed.
In general, disable any services and remove programs you don't need. For example, if you're sure your applications won't need it, you may want to uninstall Java. If your machine has Internet Information Services (IIS) running but doesn't need it, disable that, as well.
8th commandment: Secure your Web browser and other applications
Web browsers access Web sites that neither you nor your company control (and these sites, in turn, may have ads or link to other content that they don't control). Any of these may try to inject malware onto your computer.
[Also read 10 ways to secure browsing in the enterprise]
Today's browsers include more security, like "private browsing" session modes that prevent any personal information from being stored, or don't save cookies or history for a session. However, this may interfere with productivity.
Check each browser's security options and select the ones that look useful, like Firefox's "Warn me when sites try to install add-ons" and "Block reported attack sites."
Set Microsoft Internet Explorer to have the highest security setting you can tolerate (since higher security often means you have to click more often), suggests Tom Henderson, Managing Director of ExtremeLabs.com, an Indianapolis, Indiana technology testing lab.
9th commandment: Rope in Autorun
AutoRun is a major threat vector for viruses and other malware in Windows XP and Windows Vista. [Editor's note: Simson Garfinkel called Autorun an "OS design flaw" all the way back in 2006.] With this function, the operating system automatically begins executing a program when it sees an autorun.inf file in the root directory of a new drive, such as a network drive, a CD or a flash drive. So, if you haven't yet moved to Windows 7, make sure you've got all the security updates for the OS version you are running. (See MS Security Advisory: Update for Windows Autorun.)
With Windows 7, all the security settings are "No Autorun." When you attach external media like CDs, DVDs, SD cards and USB flash drives, they will give you a dialog box offering to run a program, but by default, nothing happens automatically.
10th commandment: Consider application whitelisting and other controls "Whitelisting" refers to a list of everything you allow on your computer, including e-mail addresses your mail program can accept, Web sites your browser is allowed to connect to and applications the operating system is allowed to run. Whitelisting may not be a match for e-mail or Web browsing, but for preventing unwanted applications from running--such as malware or zero-day attacks--it may be a good additional tool.
Windows 7 includes AppLocker, a whitelisting utility, or you can buy third-party white-listing products for either individual computers or groups of networked computers. For home users, Windows 7 has fairly robust parental controls that can restrict access by time-of-day or by site, and log Web access, Bott says.
Conclusion: It's easy to become more secure
As you can see, there is a lot you can do affordably, even to existing Windows systems, to increase their security. It shouldn't take a lot of time or money to do; however, it may take a lot of both if you don't do anything and something avoidable goes wrong.
Daniel P. Dern is an independent technology and business writer. He can be reached at firstname.lastname@example.org. His Web site is www.dern.com, and his technology blog is TryingTechnology.com.