windows security or web browsing/email best practices

[Egaladeist]

Originally Posted by dinowuff: here

Ok here are the basics. I would appreciate any comments. Do you want more info, did I miss something – Could I be a total moron? I might turn this into a tut if I get enough feedback. Remember the target audience has ZERO knowledge with windows security or web browsing/email best practices.

Thanks


1. Make a boot disk in case your computer is damaged or compromised:
Do this prior to configuring or adding new software. If you get infected or some program install hoses your registry (To the point you can’t boot into safe mode) it’s too late to look for a restore / boot disk.

2. Use virus protection software:
AVG from Grisoft. At the time of this writing there is a free version.

3. Use a firewall:
XP’s firewall is fine until you can download and install one that will actually work. I suggest for the average user, Zone Alarm in conjunction with a Linksys router. Even if you are not networked, the hardware firewall in the Linksys router will help protect aginst things the software firewall cannot (by default) catch.

4. Disable hidden filename extensions:
Windows operating systems contain an option to “Hide file extensions for known file types”. The option is enabled by default, but you can disable this option in order to have file extensions displayed by Windows.

Windows 9x and Windows NT 4.0:
Open the Windows Start menu
Select “Settings -> Control Panel” to open the control panel
From the “View” menu, select “Options...”
Click on the “View” tab
Insure “Hide files of these types” and “Hide file extensions for known file types” are both unchecked
Insure “Show all files” is selected
Click “OK” to complete the changes

Windows 2000:
Open the Windows Start menu
Select “Settings -> Control Panel” to open the control panel
From the “Tools” menu, select “Folder options”
Click on the “View” tab
Under “Hidden files and folders”, insure “Show hidden files and folders” is selected
Insure “Hide file extensions for known file types” is unchecked
Insure “Hide protected operating system files” is unchecked. Note, Windows 2000 will display a dialog asking for confirmation. Be sure to read and understand the information contained in the dialog and then click on “Yes”.
Click “OK” to complete the changes

There is a registry value which allows Windows to hide certain file extensions regardless of the above settings. The NeverShowExt registry value is used to hide the extensions for basic Windows file types. For example, the .lnk extension associated with Windows shortcuts remains hidden even after a user has turned off the option to hide extensions.

Remove the registry value:

Open the Windows Start menu
Select “Run” and enter “regedit” to open the registry editor
From the “Edit” menu, select “Find”
Uncheck the “Keys” and “Data” entries under “Look at”, and insure the “Values” entry is checked. Enter “NeverShowExt” in the “Find What” box and click “Find Next”
When a value is found, right click on the value name and select “Delete”
Press F3 to find the next occurrence of “NeverShowExt”.
Repeat the previous two steps until all occurrences of “NeverShowExt” have been deleted from the registry. “Finished searching registry”
The computer will need to be rebooted for changes to take effect

5. Internet Explorer:
Disable Java, JavaScript, and ActiveX.
Under Tools, Internet Options
Choose Security.
Highlight the Internet Icon
Under Security level for this zone slide the bar up to HIGH
Apply and OK. (if you do not see the bar, click the default settings button and then change to high.
There are other ways to Custom Configure these settings, but that’s another story. Also, with this setting, many sites will not display properly or at all.

Never save passwords or user names for web sites. Disable this feature when prompted.

6. Email - Don’t open unknown email attachments
Before opening any email attachments, be sure you know the source of the attachment. It is not enough that the mail originated from an address you recognize.
If you must open an attachment before you can verify the source, we suggest the following procedure:
Be sure your virus definitions are up-to-date
Save the file to your hard disk
Scan the file using your antivirus software
Open the file

Turn off Auto Preview in your email client. Search the on-line documentation (Help) using the key words “Auto Preview” for instructions. If you are using outlook or outlook express the security settings are managed by I.E. Browser security settings. (Below)

7. Programs:
Don’t run programs of unknown origin. You know those cute little screen savers you can download for free? Rules of thumb, if you didn’t write it or pay for it DON’T TRUST it!

8. Keep all applications, including your operating system, patched.

Turn off your computer or disconnect from the network when not in use. If you use ZoneAlarm right click on the system tray icon and choose Disable all internet traffic. Do the same to enable.


9. Make regular backups of critical data
Keep a copy of important files on removable media such as ZIP disks or recordable CD-ROM disks (CD-R or CD-RW disks). Use software backup tools if available, and store the backup disks somewhere away from the computer.

10. Windows 2000 and above.
Never log on as administrator. Create a user account that has no admin rights what so ever. Use the above browser settings. Change the administrator account password. Know this Windows XP home edition. The administrator password is blank and EVERYONE of the bad guys out there knows this. Change the admin password. You must log into safe mode to change the password.