After installing an
expensive alarm system in his apartment and then getting robbed,
Jerry Seinfeld learned a valuable lesson: no matter how good the
security system, if it isn't used correctly, it is completely
ineffective. That lesson holds just as true when it comes to everyday
computer users and their firewalls.
Most computers now come
with a firewall built in, but despite this, the number of computers
that are infected with viruses, worms and other types of malware
grows by the day. One of the biggest reasons why firewalls are not
doing their job, is because many of us have never taken the time to
tweak our firewall to make it effective. This 10 step list will help
introduce individuals and small business owners alike to some very
simple ways that they can tweak, supplement, and support their
firewall in order to keep their computer and private information as
secure as possible.
1. INSTALL WINDOWS XP,
SERVICE PACK 2, ONTO YOUR WINDOWS OPERATING SYSTEM
Before you can start
supporting or tweaking your firewall, it is important to make sure
you actually have one installed. Surprisingly, a large number of
individuals who believe they are already protected, have not even
taken the most basic step of installing a free firewall.
If you are using
Microsoft's Windows XP and just assumed that you were protected by a
built-in firewall, you may be wrong. In fact, the standard version of
Microsoft's Windows XP is notoriously vulnerable to worms and viruses
precisely because it has no substantial built-in firewall. In
response to the criticisms, Microsoft created an all-in-one patch (or
downloadable add-on) to Windows XP called SP2. By downloading and
installing SP2 onto your computer, you will automatically be equipped
with Windows Security Center, Windows Firewall, a Pop-up blocker for
Internet Explorer, an Email virus scanner for Outlook Express, and a
Wireless Network Security
system.[http://www.microsoft.com/windowsxp/sp2/default.mspx]
Given the standard version
of Windows XP's notorious weaknesses against worms and viruses, it is
a necessary first step for all individual and small business users
who use Windows XP to download the all-in-one patch. Make sure,
however, to download the patch directly from Microsoft, as clever
spammers often offer a version on their own sites which are full of
hidden viruses.
[http://www.microsoft.com/windowsxp/sp2/default.mspx].
For those individuals that
haven't been using any sort of firewall whatsoever, having SP2 in
place is a big step up. Unfortunately, however, the Windows Firewall
will only block attacks that come from the outside, it just presumes
that anything you send out is safe. But, if you have been connecting
your computer to the internet without a firewall in the past, that
assumption is probably wrong. Your computers may already be infected
and you simply have no idea. To deal with this problem you will need
to install a 'bidirectional' third-party firewall. For individuals,
there are some good free ones available, including Zone Labs'
ZoneAlarm. If ZoneAlarm does not fit your needs, there are dozens
of other options. Check out PCWorld's firewall review for a few more
ideas.
[http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp][http://www.pcworld.com/article/id,115939-page,1/article.html?findid=42886#]
Now that we have made sure
that you actually have a firewall in place, it is time to start
optimizing it.
2. ENABLE AUTO UPDATES
FOR THE FIREWALL.
New viruses, worms and
other forms of malware are created daily, so it is important that
once a firewall is installed in your personal computer or across your
company's computers, you develop a plan to regularly check for and
install new patches for your firewall. While normally it is a
terrible idea to let your computer download anything without your
approval, when it comes to fighting viruses, there is a whole new set
of rules. Because every small business is strapped for time, the only
reliable means of ensuring that your business's firewalls remain up
to date is to setup auto-updates. Once automatic updates are set up,
your firewall will upload the newest patches each time you have them
scheduled or each time you turn off your computer. These updates will
enable to firewall to protect your computer against any new viruses,
worms, Trojan horses or bugs that have been created since the program
was last updated.
If you are using the
default Windows XP firewall that you downloaded with the SP2 patch,
then you should simply enable Windows Automatic Updates. This is a
program for Windows that will actually check to see what patches you
need, and then suggest that you download them. Once you are current,
the program will frequently check for new updates and when they are
created, it will wait for a time when your computer is idle, so as
not to interrupt your work, and automatically download the new patch.
The setup for Automatic Updates is a simple step-by-step process that
will not take more than 15 minutes to complete, even fore the most
technically disinclined.
[http://www.microsoft.com/athome/security/update/msupdate_keep_current.mspx]
If you decided to opt for
greater protection and downloaded or purchased a 'bidirectional'
firewall you can still setup automatic updates, and typically the
process is very straightforward. If you selected the free version of
ZoneAlarm, the setup instructions are here, otherwise you will simply
need to check the manufacturer’s website for instructions on how to
setup auto updates for your firewall.
[http://www.zonelabs.com/store/content/support/zasc/index.jsp?dc=12bms&ctry=US&lang=en&lid=zasupp_c]
3. TWEAKING THE
SETTINGS TO YOUR USAGE
Firewall settings are
designed with the median user in mind. The problem is, none of us is
that mythical 'median' user, so almost everyone will benefit from
tweaking the settings on their firewall.
One of the most common
tweaks is the timing of automatic updates. You enabled automatic
updates to take place because they will keep your firewall updated
all the time. But that can only happen if the 'automatic update'
actually happens. For most firewalls the automatic update is timed to
start each night at 3 a.m. If you typically have your computer off
and disconnected from the internet at that time, however, your
firewall will never update. So, make sure to schedule your updates
for a time when the computer is going to be on and connected, but not
in heavy use. If you cannot come up with a time that works for your
home or business, just select an option that the computer notify you
when an update is ready, and then you can decide pick a convenient
time that day.
At work, most of us are
focused on getting the job done in the quickest way possible. So if
your employees are having trouble with a pop-up blocker (e.g. it is
blocking pop-ups they need to sign in or fill out a form) often they
will just disable the pop-up blocker rather than spending the time to
whitelist that site. Very soon, you will find that all the computers
in your company now have disabled pop-up blockers, and as a result
your firewall has to filter a lot more bad content, and ultimately
your computer is less secure. Rather than have that happen, make sure
to tweak your firewall to allow exceptions, by listing all the
trusted sites that your employees will need to frequently visit
throughout their workday. So for instance, if your employees
constantly need to sign in to the company email provider, which uses
a pop-up, make sure that that site is listed in your 'trusted sites'
list so that pop-ups can appear. Just adding the five or ten sites
that your employees visit most frequently to the exceptions list,
will stop them from disabling that pop-up blocker, and keep your
whole network safer.
[http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfexceptions.mspx]
For a hacker to be
effective, he or she needs a way to get information on and off your
computer without you knowing. One of the most common ways they do
this is by hiding their malware inside of a legitimate program, and
then directing that legitimate program to establish a connection
between your computer and the internet. Untweaked firewalls that are
left to their default settings can often do little to prevent this,
as the firewall does not know which programs need to send and receive
messages from the internet and which do not. But, by tweaking the
settings of your firewall, you can restrict those of your programs
that do not need to send and receive information from the internet
from doing so. One of the most common steps is to restrict your
printer from having access to anything beyond the local network
level. That way, a virus will not be able to embed itself into your
printer software and send and receive information through that
connection. For those programs that do require internet access, you
should consider whether they need to both send and receive
information, or whether they might simply send information. If that
is the case, you can toggle your settings so that that program is
restricted to sending outgoing information, but cannot receive
incoming information. While this offers less protection than a total
block, it is certainly better than the default firewall setting.
4. KEEPING SETTINGS
CONSISTENT ACROSS NETWORKS
In most companies and
homes, individual users access the internet and use their computers
in wildly different ways. Because of these different uses, many
individuals and small companies decide to setup the individual
firewalls within a network differently according to the usage habits
of that individual. For example, if a person accesses a certain site
more than the other users, he might authorize that site to show
pop-ups by adding it to his ‘trusted site’ list. And even more
commonly, an individual employee might decide to toggle their
firewall settings to permit Instant Messenger to function without
hindrance.
While these sorts of
individualized tweaks can seem harmless, in fact they create
different attack surfaces for each computer throughout the network,
so that when a worm or other malicious program eventually succeeds in
breaching the firewall, it is far more difficult to tell where the
firewall vulnerability is located, and thus what change needs to be
made to close up the weakness. This same reasoning also requires that
the firewall administrator not permit different firewall settings for
each connection, or profile, on the computer. Just as individualized
firewall settings on different computers make it difficult to
identify where the firewall weakness is, having different settings
for different users within the same computer make the task of
identification nearly impossible.
5. ADD MULTIPLE LAYERS
TO YOUR PC AND SECURITY SYSTEM.
An easy way to think about
a firewall, is that it is a program that creates a sort of shell
around your computer that lets certain types of authorized
information pass through it, while identifying and blocking out other
types of code or information that it recognizes as bad. But for all
their advancements, firewalls are and will always be defensive in
nature. That means, that a firewall can only block malware that
humans have coded it to recognize as bad, and that code can only be
created for viruses that already exist and have already infected some
computers.
Because of the inherent
defensive nature of firewalls, they are always fighting an uphill
battle against hackers who are creating new sorts of malware. Thus,
to help put a firewall on equal footing, it must always be
supplemented with an aggressive anti-virus program. Unlike a firewall
which tries to form a shell around your computer, an anti-virus
program scans information that has gotten through the firewall and
quarantines then eliminates the malware that it finds. That way, even
if a new virus is quick enough to sneak past your firewall, it will
eventually be rooted out by your anti-virus software, once your
software is updated to recognize the new virus.
In addition to an
anti-virus program, you should also add a pop-up blocker and
spam-blocking software to your company's computers. While these two
firewall supplements will not directly fight against attacks by
viruses, worms, and trojan horses, they will limit the number of
these types of malware that your computer faces, and thus help make
your firewall more effective overall.
Because many viruses are
designed specifically for Internet Explorer, it is safer for you or
your company to begin using an alternative internet browser such as
Firefox. Firefox comes with a built-in pop-up blocker and spam
blocker that are usually regarded as better than most off the shelf
third party alternatives. So if you decide to go this route, you
won't need add-on spyware or spam blocker protection.
[http://www.mozilla.com/en-US/firefox/].
But if you decide to use
an internet browser besides Internet Explorer or Firefox, it may not
come with a strong pop-up and spam blocker. This means that you will
need to download spam and spyware blocking software, Microsoft offers
a free program entitled Windows Defender, which will alerts you if
viruses, Trojan horses, or worms try to enter your computer and stop
them. If you want protection beyond the off the shelf freebie
version, you should consider acustomized security solution.
[http://www.microsoft.com/athome/security/spyware/software/default.mspx]
By supplementing your
firewall with the essential add-ons like a spam blocker, spyware
blocker, and of course, an anti-virus program, you add valuable
layers to your malware protection and better ensure that your
computer remains malware free.
6. USE STRONG PASSWORDS
An effective firewall will
shield out almost every attack by a hacker to gain access to your
computer. No matter how effective a firewall, however, it can be
rendered useless if a hacker is able to gain access to your sensitive
data through direct means. For example, anyone can access your
wireless network if they have the correct WEP encryption key.
Similarly, a hacker need not breach your firewall to gain your
banking information, if he or she can instead just guess your
password. For these reasons, an essential part of supporting the
effectiveness of your firewall is to use strong passwords.
Using a strong password
requires four things:
- Length: One of the simplest methods that hackers use to obtain sensitive information is to simply start guessing. The longer a password the more letter and number combinations a hacker will have to try before he or she can guess a password. Even with a computer program designed specifically for trying every letter and number combination, most hackers are quickly frustrated by longer passwords.
- Structure: Hackers often use a password stealing method in which a computer program repeatedly tries various combinations of words out of a dictionary to guess a password. Consequently, your password should never be a single word found in a dictionary, nor should it be a combination of two or three words. Instead, your password should always involve either fake words or word and number combinations.
- Distinctness: Around the house, no one uses just one key to open the garage, backdoor, front door, the car, and their safe. Just as in the physical world, you should never use the same password for all of your access codes. If a single password holds the key to all your bank accounts, social security number, personal emails, and work intranet, then a single correct guess by a hacker will leave you and your company irreparably harmed.
- Frequency: Nobody is perfect, and you should build that assumption in when you consider how often you need to change your password. Eventually your password information will leak out to someone. But as long as you change your password frequently enough, you can minimize the chance that when the information leaks out, it will still be relevant. The frequency with which you change your password will depend upon how important the information it protects is, but under no circumstances should you give your personal password(s) to anyone.
7. A 128-BIT WEP
ENCRYPTION ON YOUR WIRELESS NETWORK
No one would consider
leaving a box of keys to the office laying right out side the office
doors. Yet many individuals and small companies do just that when
they fail to encrypt or password protect their office's wireless
network. With an unencrypted network, anybody can access your network
and thus access your company's computers. Even beginner hackers can
then use this access to steal company information like credit card
numbers and passwords, or barrage your computer with viruses and
worms since they have essentially circumvented your network firewall.
While big companies need
to undertake major steps to protect their wireless networks, for
homes and smaller companies, WEP encryption is an easy and good
solution. The most common WEP encryption is a 128-bit encryption,
however, encryptions can range anywhere from 40-bit to 152-bit.
Practically speaking, the higher the number encryption, the longer
the password required to access your wireless network, and thus the
harder to hack into. But if you are worried about performance and
speed, there is very little difference in security between a 64-bit
and a 128-bit encryption, and a 64-bit encryption will require
slightly less time to log in to.
Setting up a wifi
encryption is very easy to do, and the technology to encrypt comes
standard on almost every commercially available wireless router. If
you have not purchased a wireless router, you should consider D-Link
and Linksys, two cheap but reliable systems. If you already have a
wifi system that is not yet encrypted, just check the website of the
manufacturer for your particular models instructions. Once the WEP is
in place, the network is sealed and only users with the correct WEP
can use the network.
[http://www.dailywireless.com/wifi/]
[http://www.dlink.com/]
[http://www.linksys.com/]
8. STANDBY IS YOUR PC'S
BEST FRIEND
A hacker can only get to
your computer remotely if it is accessible to him or her. That is to
say, a hacker cannot remotely place a Trojan hore onto a computer
that is not connected to the Internet. Consequently, one of the
easiest ways to reduce your vulnerability to hackers and thus
supplement your firewall's efforts to keep your computer malware
free, is to shut down or change over to standby mode whenever you are
not actively using your computer.
Remember that no matter
how strong you make a firewall or how frequently you update it, a
firewall can never provide perfect protection against malware. But by
shutting the computer down each night and setting the computer to
standby mode when not in use, you can cut your potential exposure to
malware like viruses and Trojan horses by more than half.
9. TEST #1: LOOKING FOR
LEAKS
Having tweaked and
strengthened your firewall by installing certain software and
taking certain preventative steps, you should now feel reasonably
secure that your computer's firewall and overall safety are
reasonably strong. But the only way you will actually know if your
firewall is working well is if you do not get infected with malware.
Since that trial by fire method of testing can be so dangerous,
however, a safe alternative is to undergo firewall leak testing.
These firewall leak tests will actually try to bypass your personal
firewall and in so doing actually test the firewall's software
filtering, and outbound filtering capabilities. Because each firewall
link test uses slightly different techniques to try to circumvent
your firewall (just like different malware will use different
techniques), it is helpful to run a variety of different leak tests
in order to ensure that your firewall makes the grade. There are a
number of free online versions of firewall leak tests, including
Gkweb's Firewall Leak Tester and Gibson Research Corporation's
LeakTest.
[http://www.firewallleaktester.com/]
[http://www.grc.com/lt/leaktest.htm]
10. TEST #2: CHECKING
THE PORTS
A port is not just a word
for the socket that you plug your mouse or keyboard into. Rather, a
port also refers to a special number in a data packet that helps
route data to and from a particular program running on your computer.
Ports can either be open, closed, or filtered. When a port is open, a
hacker will be able to use that opening to gain easy access to your
computer. Consequently, it should always be a goal to keep as few
ports open for as short of time as possible.
Therefore, when you
install a new program and find that your firewall is conflicting with
it, make sure to tweak your firewall correctly by selecting a
'program exception' rather than a 'port exception' to get the program
working. A 'program exception' will open the port only as that
particular program needs it opened to function, that way a port will
not remain open unnecessarily. A 'port exception' by contrast, will
leave the entire port in open status.
Because of the stated
security benefits of having ports open only as your programs need
then opened, it is important to know exactly which programs use which
ports, so that you can make sure that no ports are accidentally left
permanently open. Thankfully, there are a number of free port
scanners available online that will tell you the status of your
computer's ports. A few of the more well-reputed are:
Microsoft's Port Reporter
Tool.
[http://support.microsoft.com/default.aspx?scid=kb;en-us;837243]
Sygate's Online Scan.
[http://scan.sygate.com/] An extended security check that also
includes a stealth scan and a trojan scan.
Planet Security's
Firewall-Check.
[http://www.planet-security.net/index.php?xid=%F7%04T%BDP%92nD] A
fast test that checks currently highly endangered ports.
AuditMyPC's complete port
scanning. [http://www.auditmypc.com/firewall-test.asp] An in-depth
test which will scan all 65,535 of your computer’s ports.
CONCLUSION
While no single resource
can adequately cover everything you need to know about maintaining
your firewall effectively, the ten points introduced in this article
should serve as a basic primer of the deficiencies of many firewalls
as well as cover a few of the ways to upgrade, tweak and supplement
your personal or small businesses’ firewall in order to improve
your computer's overall security.
And while no computer is
absolutely secure, at least you will have the advantage of knowing
that you are more secure after reading this article than you were
before.
-Birdy
