4

I run a small (1 man) consulting company in the field of embedded systems, working from home using a standard DSL internet access. My main development machine is a Windows XP PC, which is connected to the router with an ethernet cable. I also have a MacBook Pro laptop, which is connects to the network via WLAN (WPA-PSK).

Besides enabling the Windows firewall, not using IE, having an up-to-date antivirus program and strong passwords, what do I need to know to keep my customers' data safe on these computers?

1
  • Use WPA2 with AES cipher if you can. Avoid WEP, WPA, WPA2/TKIP. They're all broken or shown to be much weaker than intended.
    – Alex Holst
    Apr 8, 2010 at 10:03

6 Answers 6

10

Actually, your question is much broader than the title says it is. It involves not only security as in protection against malicious intent, but also protection against things you do not have influence over (i.e. fires, earthquakes, that sort of thing).

I think it would be best to handle this 'bottom up' (or top down, depends on your point of view), so to say, starting with the computers themselves, then going to your own network and ending with your computers on the internet, as it were.

Your computers

Your computers are actually the most important asset. They contain the data that needs protection, so I'll talk about them first.

Backup, or: keeping your data from harm

The first thing to do to keep data safe is to implement a proper backup procedure. This ensures safety of your (their) data in the disaster-protection/recovery sense. What a proper backup procedure is, depends entirely on your budget and the sensitivity of the data you work with. A good starting-point would be an encrypted and off-site backup done via the internet.

Firewall, or: keeping others away from your data

Second would be to look at the protection of the computers in the firewall kind of way. Any computer needs a decent firewall, but there is a choice: you can firewall your individual machines, or you can do what is called 'perimeter firewalling'. I would suggest you choose the third option, a combination of both.

The reason for doing both perimeter and workstation firewalling is simple: a perimeter firewall doesn't stop your workstation getting infected via email-attachment. Your antivirus product might, but a workstation firewall should ensure it doesn't spread via the network to any other computers.

Antivirus, or: keeping data away from your data

Well, the subtitle is slightly weird. That's because this actually could have the same subtitle as the previous header. The third step to protecting the data on your computers is to make sure no data (i.e. programs) with malicious intentions can run on your computers. To do this, of course you need an up-to-date browser as you mention. But you also need a way to inspect what is what and what is and what is not malicious. In other words: you need a virus scanner.

Use the 'net to find a decent one, or, even better: buy a corporate version. From what I've heard McAfee is quite decent, as is Kaspersky.

Common sense

Of course, you can install any security software you want, if the configuration isn't right, it'll do you no good. So make sure you check the settings. For firewalls I'd recommend to basically shut down everything. Nothing goes in, nothing goes out. After that, start to open ports on a need-to-open basis. You will want port 80 going out, for example, because that is the port HTTP uses by default. There are a few others and the internet knows them.

The other thing is choosing decent passwords. The internet has plenty on this, too, but rest assured that it's quite important.

Your network

Now that your computers are essentially secure, it's time to secure your network. It's important to know that any encryption or safety can be breached, given enough time and resources. Also: a possibility that is not there, is no possibility. That sounds obvious enough but it's very important.

Wired network

There is not much to secure about a wired network, to be honest. The most important thing here, in the network-sense, is the perimeter firewall. You can of course do all kinds of neat obfuscation like not using DHCP and using a different private subnet than default (192.168.1/24), but in the end they are not a security measure, they just make it a little bit harder to find out what you're doing.

But then there is also the physical way of viewing it. Security on your box is no good if I can access it physically. Same goes for your network. I take it it's inside your home, but it is still a thought.

Wireless network

The wireless network is much more of a PITA. Unlike the wired network, you don't need a physical plug to access it. So it stands to reason that the security must be that much stronger. Fortunately, 'they' have thought of this and given us wireless encryption.

In the beginning there was WEP. It was good enough at the time, because no-one could crack it in reasonable time. Currently, it takes about two to five minutes to crack it, on a reasonably busy network. So WEP is out.

Then WPA came along and was much better. However, the WPA standard is already under jeopardy. The advent of the GPU as a calculation processor instead of doing graphics only has sped up key-cracking a humongous amount. So WPA is also out of the question.

At this moment, only WPA2 can be expected to offer reasonable security, especially if implemented with RADIUS (and not PSK). This is where the security versus resources comes into play. If you want more security, you will have to install a RADIUS server. This will come at a cost, however, so the added security might not out-weigh the added cost.

I think the best you can do for now is use WPA2-PSK with a sufficient passphrase. Make it long, make it complicated.

Anything like not broadcasting your SSID is bogus, any tool can find your network anyway. So is registering MAC addresses. It takes about a minute to find an accepted MAC and set my adapter to it.

Short summary

  • Good passwords and pass phrases.
  • Offsite backups
  • Firewall your workstations and perimeter
  • Upgrade wireless encryption to at least WPA2-PSK
2

You should first think about "What do I want to protect and from what" and then come up with measures.

Since you have two machines the most secure solution would be to have all the "data" on one machine and never connect it to a network but to use e.g. USB storage to transfer data.

Besides that I would advise you to consider the following points:

  • Blocking outbound connections by default

  • File Encryption (Full Disk Encryption AND, if possible, Encryption of the "data" itself in containers (try Truecrypt))

  • E-mail encryption

P.S.: Since you are from Germany you SHOULD (No really, do it...) take a look at the BSI homepage (Federal Office for Information Security)

2

The weakest link in your environment is Windows XP. It is terrible for security. Why? Because everything you do there is done as a user with complete Administrator rights.

Why should your web browser or email client run with Administrative rights over your operating system? It does not need it. Yet this is the route by which most malware arrives on Windows.

I recommend upgrading to Windows 7, where the security model is a little more like Linux or Mac OS. You can run the desktop applications in Windows 7 as an ordinary user, and you will be prompted for your admin password as required for installation of apps and drivers, etc. If while running Windows 7 you see a prompt for your admin password and you did not initiate an install or application update, then you know it was malware about to be installed and you can say cancel. That isn't happening right now in Windows XP, and there is a half decent chance you already have stealthy malware on the system undetectable by the anti-virus product you use. BTW, if you didn't already know, many malware target and cripple the anti-virus products.

As a small operation you are not going to be investing a great amount in data backup and protection. So try for something simple that just works for you. Determine what data cannot be replaced if it were lost. Determine how much data that is. Come up with a plan to periodically back it up to DVD or possibly a USB drive or several. Give that media to someone you trust that lives in another building (maybe your brother, etc.). Now you have off-site backup. (Put your product keys on that media as well.)

9
  • Great point about running as admin but this is not an XP or Windows7 issue. In both OS's as Windows7 UAC is pretty easy to get around is just a matter of setting up a non-privileged account and logging into it for day to day stuff. Only logging into the admin account to update/install software and drivers. Apr 8, 2010 at 13:51
  • The general consensus I've read is that Windows XP and prior does support non-privileged users, but practically most software does not work under this set up. Windows Vista was the first to allow a person to practically use applications without Administrator rights.
    – labradort
    Apr 8, 2010 at 14:25
  • Most programs run just fine as an unprivileged user. I'm not sure where you're reading this from but it's not correct. With Vista and Windows 7 there have been changes to try to improve this such as Microsoft finally telling software vendors that they can't save files such configuration files in Program Files. That sort of thing should be in the user's directory. This doesn't affect that many programs though and you can work around it with permissions on the program files folders that need write access by the users. Apr 8, 2010 at 14:48
  • In industry, no one was advising people they could get through their day on Windows XP as a non-Admin user. I mean as a user who is not part of the Administrator group. The only sort of user who could have taken advantage of this in Win XP is someone who works in a single app all day, like Call Centres, etc. Other people need to manipulate their software, access system devices like CD burners, attach and detach storage or network devices, etc. In Windows XP it would require a logout/login to switch roles for each event, while in Vista/7 it can simply prompt for a password or acceptance.
    – labradort
    Apr 8, 2010 at 15:08
  • Thanks for the great advice. As a developer, I'm indeed working with administrator rights because everything else is too troublesome. I'll switch to Windows 7 as soon as the development software I'm using (Xilinx ISE) supports it.
    – geschema
    Apr 8, 2010 at 17:18
1

PCI standard outlines main branches of business security very well. You may not to strictly follow all the advises here, but it shows main ideas to concentrate on.

2
  • PCI is horrendous overkill for one man companies :-P
    – Cian
    Apr 8, 2010 at 9:15
  • @Cian: true, but it gives good pointers on what should be done. Apr 8, 2010 at 11:02
1

Let's apply the CIA-model to this question:

Confidentiality: Data must only be available to authorized individuals.

  • Theft: Disk encryption limits your exposure, but you should understand cold-boot attacks.
  • Server compromise: Keep your source code in an encrypted container that is only unencrypted at check-in/check-out time.
  • Client compromise: If someone exploits IE/Flash/PDF on your system, it's probably too late to do anything. Avoid this risk by not using the system for email/browsing, if at all possible.
  • Armed robbery: Would you give up your data and secrets at gunpoint?

Integrity: Detect unauthorized changes to data.

  • Network tampering: Use encryption with mutual authentication (e.g https with client certs, ssh keys, etc) to send/receive your work. Use two-factor authentication, if possible.
  • Server compromise: Some SCM systems allow for cryptographic signatures attached on each check-in.
  • Client compromise: IE/Flash/PDF is exploited and used to tamper with your data. Restore from known good backups. Avoid compromise by not using the system for email/browsing, if at all possible.

Availability: The data must be available to authorized individuals.

  • Theft/fire: Your system and data is gone. How do you obtain a new system and how do you restore from backup onto it? Test this often, to make sure it works.
  • Software defects: When your OS blows up, how quickly can you get back to work and make up for lost time/work? Test your assumptions.
  • Hardware defects: When your PC blows up, how quickly can you recover from failed hardware and make up for lost time/work? Test your assumptions.

Some additional words to live by:

There is no perimeter. Resourceful attackers can get to where they want to be. Ankle-biters cannot.

It's not about how often you can do backups - it's about how often you have verified your restore method works.

Anti-virus software and other malware scanners can only reliably detect inactive threats on disk. Active malware can modify the OS kernel, your anti-virus software and your personal firewall. As soon as you have malware running on your system, it becomes untrustworthy and you should assume anything you see on screen is a lie. Recover from known good backups.

1

There are two aspects of security. 1) what to do to prevent a break-in and 2) what to do if when it happens. Others have covered 1), I will try some information on 2).

One issue is communication. Who do you tell and what do you tell? You do not have the issue of escalating the issue to the correct person, since it is only you, but you will have to tell your customers (or not), the police (or not) or other partners (if you have any).

Then there is a technical issues. For example, if you have a DoS, you should have an idea where to look at, who can help you. You may have to move/rebuild your servers/applications after a break in, do you know how to do it? How long? Are the backups good? Recent?

Basically, what I am telling you is that you should have some sort or disaster recovery plan/draft. This may be very valuable for other situations as well.

Not the answer you're looking for? Browse other questions tagged .