Tabula Rosa Systems Important Security Suggestions From US-CERT - ST15-003: Before You Connect a New Computer to the Internet

National Cyber Awareness System:

ST15-003: Before You Connect a New Computer to the Internet

12/15/2015 06:07 PM EST

Original release date: December 15, 2015

Why Should I Care About Computer Security?

Computers help us maintain our financial, social, and professional relationships. We use them for banking and bill paying, online shopping, connecting with our friends and family through email and social networking sites, researching data posted on the Internet, and so much more. We rely heavily on our computers to provide these services, yet we sometimes overlook our need to secure them. Because our computers play such critical roles in our lives, and we input and view so much personally identifiable information (PII) on them, it’s imperative to maintain computer security that ensures the safe processing and storage of our information.

How Do I Improve the Security of My Home Computer?
Following are important steps you should consider to make your home computer more secure. While no individual step will eliminate your risk, together these defense-in-depth practices will make your home computer’s defense stronger and minimize the threat of malicious exploit.

1.  Connect to a Secure Network

Once your computer is connected to the Internet, it’s also connected to millions of other computers, which could allow attackers access to your computer. Information flows from the Internet to your home network by first coming into your modem, then into your router and finally into your computer. Although cable modem, digital subscriber line (DSL), and internet service providers (ISP) purport some level of security monitoring, it’s crucial to secure your router—the first securable device that receives information from the Internet. Be sure to secure it before you connect to the Internet to improve your computer’s security (See Securing Your Home Network for more information).

2. Enable and Configure a Firewall

A firewall is a device that controls the flow of information between your computer and the Internet, similar to a router. Most modern operating systems include a software firewall. In addition to the operating system’s firewall, the majority of home routers have a firewall built in. Refer to your user’s guide for instructions on how to enable your firewall. Once your firewall is enabled, consult the user’s guide to learn how to configure the security settings and set a strong password to protect it against unwanted changes. (See Understanding Firewalls for more information.)

3. Install and Use Antivirus and Antispyware Software

Installing an antivirus and antispyware software program and keeping it up to date is a critical step in protecting your computer. Many types of antivirus and antispyware software can detect the possible presence of malware by looking for patterns in the files or memory of your computer. This software uses virus signatures provided by software vendors to look for malware. Antivirus vendors frequently create new signatures to keep their software effective against newly discovered malware. Many antivirus and antispyware programs offer automatic updating. Enable that feature so your software always has the most current signatures. If automatic updates aren’t offered, be sure to install the software from a reputable source, like the vendor’s website or a CD from the vendor. (See Understanding Anti-Virus Software.)

4. Remove Unnecessary Software

Intruders can attack your computer by exploiting software vulnerabilities (that is, flaws or weaknesses), so the less software you have installed, the fewer avenues for potential attack. Check the software installed on your computer. If you don’t know what a software program does and don’t use it, research it to determine whether it’s necessary. Remove any software you feel isn’t necessary after confirming it’s safe to remove the software.
Back up important files and data before removing unnecessary software in case you accidentally remove software essential to the operating system. If possible, locate the installation media for the software in case you need to reinstall it.

5. Modify Unnecessary Default Features

Like removing unnecessary software and disabling nonessential services, modifying unnecessary default features eliminates opportunities for attack. Review the features that came enabled by default on your computer and disable or customize those you don’t need or plan on using. As with nonessential services, be sure to research these features before disabling or modifying them.

6. Operate Under the Principle of Least Privilege

In most instances of a malware infection, the malware can operate only under the rights of the logged-in user. To minimize the impact the malware can have if it successfully infects a computer, consider using a standard or restricted user account for day-to-day activities and only  logging in with the administrator account (which has full operating privileges on the system) when you need to install or remove software or change system settings from the computer.

7. Secure Your Web Browser

Web browsers installed on new computers usually don’t have secure default settings. Securing your browser is another critical step in improving your computer’s security because an increasing number of attacks take advantage of web browsers. (See Securing Your Web Browser.)

8. Apply Software Updates and Enable Future Automatic Updates

Most software vendors release updates to patch or fix vulnerabilities, flaws, and weaknesses (bugs) in their software. Because intruders can exploit these bugs to attack your computer, keeping your software updated is important to help prevent infection. (See Understanding Patches.)
When you set up a new computer (and after you have completed the previous practices), go to your software vendors’ websites to check for and install all available updates. Enable automatic updates if your vendors offer it; that will ensure your software is always updated, and you won’t have to remember to do it yourself. Many operating systems and software have options for automatic updates. As you’re setting up your new computer, be sure to enable these options if offered. Be cautious, however, because intruders can set up malicious websites that look nearly identical to legitimate sites. Only download software updates directly from a vendor’s website, from a reputable source, or through automatic updating.

9. Use Good Security Practices

You can do some simple things to improve your computer’s security. Some of the most important are:

• Use caution with email attachments and untrusted links. Malware is commonly spread by people clicking on an email attachment or a link that launches the malware. Don’t open attachments or click on links unless you’re certain they’re safe, even if they come from a person you know. Some malware sends itself through an infected computer. While the email may appear to come from someone you know, it really came from a compromised computer. Be especially wary of attachments with sensational names, emails that contain misspellings, or emails that try to entice you into clicking on a link or attachment (for example, an email with a subject like that reads, “Hey, you won’t believe this picture of you I saw on the Internet!”). (See Using Caution with Email Attachments.)
   
• Use caution when providing sensitive information. Some email or web pages that appear to come from a legitimate source may actually be the work of an attacker. An example is an email claiming to be sent from a system administrator requesting your password or other sensitive information or directing you to a website requesting that information. While Internet service providers may request that you change your password, they will never specify what you should change it to or ask you what it is. (See Avoiding Social Engineering and Phishing Attacks.)
   
• Create strong passwords. Passwords that have eight or more characters, use a variety of uppercase and lowercase letters, and contain at least one symbol and number are best. Don’t use passwords that people can easily guess like your birthday or your child’s name. Password detection software can conduct dictionary attacks to try common words that may be used as passwords or conduct brute-force attacks where the login screen is pummeled with random attempts until it succeeds. The longer and more complex a password is, the harder these tools have to work to crack it. Also, when setting security verification questions, choose questions for which it is unlikely that an Internet search would yield the correct answer. (See Choosing and Protecting Passwords.)

---

Author: US-CERT Publications

=====================================================
 For a great email parody, view the following link:
=======================================================
https://www.youtube.com/watch?v=HTgYHHKs0Zw
scoop_post=bcaa0440-2548-11e5-c1bd-90b11c3d2b20&__scoop_topic=2455618



==============================================

Special Bulletin - My just released book, 

"You're Hired. Super Charge our Email Skills in 60 Minutes! (And Get That Job...) 

is now on sales at Amazon.com 

Great Reasons for Purchasing Netiquette IQ

·         Get more email opens.  Improve 100% or more.

·         Receive more responses, interviews, appointments, prospects and sales.

·         Be better understood.

·         Eliminate indecision.

·         Avoid being spammed 100% or more.

·         Have recipient finish reading your email content. 

·         Save time by reducing questions.

·         Increase your level of clarity.

·         Improve you time management with your email.

·        Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

 =================================

**Important note** - contact our company for very powerful solutions for IP
 management (IPv4 and IPv6, security, firewall and APT solutions:
www.tabularosa.net
==================================================

Another Special Announcement - Tune in to my radio interview,  on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.   

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” has just been published and will be followed by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

In addition to this blog, I maintain a radio show on BlogtalkRadio  and an online newsletter via paper.li.I have established Netiquette discussion groups with Linkedin and  Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and I have been contributing to the blogs Everything Email and emailmonday . My work has appeared in numerous publications and I have presented to groups such as The Breakfast Club of NJ and  PSG of Mercer County, NJ.

I am the president of Tabula Rosa Systems, a “best of breed” reseller of products for communications, email, network management software, security products and professional services.  Also, I am the president of Netiquette IQ. We are currently developing an email IQ rating system, Netiquette IQ, which promotes the fundamentals outlined in my book.

Over the past twenty-five years, I have enjoyed a dynamic and successful career and have attained an extensive background in IT and electronic communications by selling and marketing within the information technology marketplace.Anyone who would like to review the book and have it posted on my blog or website, please contact me paul@netiquetteiq.com.
=============================================================

Tabula Rosa Systems - Protect Your Email Address and Phone Number

How to Protect Your Email Address and Phone Number

BY JILL DUFFY from pcmag.com

OCTOBER 26, 2015

Everyone seems to want your email address and phone number these days. But giving them out can open you up to risks. Here's how to give some access without giving away too much.

Sign up to get a discount. Email address required. Install a new messaging app. Phone number, please! And if you're part of the dating scene, you certainly know the pains of people wanting your details before you're ready to give them. Every time you give away your email address or phone number, you effectively risk ruining it. What if someone spams you or sells your information to another spammer? What if you really don't want a second date, but the person in question can't seem to take "no" for an answer?

There is a solution.

Temporary or disposable email addresses and phone numbers protect you from these dicey situations. They're wonderful to use any time you're not sure of the legitimacy of a request for your information, or just whenever you want added privacy. There are a few different tricks and services you can use to protect your real email address and phone number, and a few different methods for how to go about it. Here are some of the more popular options.

Abine Blur
Abine Blur is a free software service that offers a whole bunch of privacy protections, and one of them just happens to be email masking. When you use Abine Blur, you can generate a new email address every time you need one. Messages sent to that new address can go right into your regular inbox, or, if they aren't what you expected, you can block all future emails. Email masking is free, but to get some of Abine Blur's other perks, such as credit card masking, you'll need a paid subscription (from $79 for three years).

Burner
Burner is a mobile app (there's a Burner iPhone app as well as one for Android) that gives you access to disposable phone numbers, which you can use for both short- and long-term use. Burner is really good at letting you manage multiple phone numbers, which come with different conditions, such as phone numbers that expire after only 14 days, or phone numbers that come with unlimited texting. Burner is not free, however. You have to buy credits to get numbers, with the minimum purchase being three credits for $1.99.

Google Voice
When you need an all-purpose alternative phone number, Google Voice is one of the best options. From Google.com/Voice, if you're signed in with a Google account, you can get a free phone number for calls and texts. Google gives you tools to manage the number, so you can delete it, transfer it, or change it at any time. You can also forward calls to your Google Voice number to another number, letting you give out the alias number while still having your normal phone ring whenever someone calls.

Guerillamail
Guerillamail is a fantastic free service that lets you generate a disposable email address in seconds. Guerillamail is best for situations in which you really don't want to give away your email address--ever! The service lets you see incoming emails, so it's great for getting confirmation codes. I think it's best for short-term use rather than protracted interactions. Guerillamail's website is easy to use, and the group now has a Guerillamail Android app as well.

Outlook.com, Hotmail.com, Yahoo.com
If you already use a Windows Live email, such as an Outlook.com or Hotmail address, or a Yahoo.com address, you can generate an alias at no cost. In any of the Microsoft email services, go to Options > Aliases: manage or choose a primary, and you'll be able to create a new email address on the spot. In Yahoo, go to Account Settings > Manage aliases. Mail sent to the alias you create will come into the same email account, but in a new folder that's named after the alias. This option works well for when you want to give out your email address and perhaps even intend to correspond, but aren't totally sure it's safe. It's also a great way to create an email address that you can solely use for subscriptions, daily deal emails, and other non-essential mail.

=====================================================
 For a great email parody, view the following link:
=======================================================
https://www.youtube.com/watch?v=HTgYHHKs0Zw
scoop_post=bcaa0440-2548-11e5-c1bd-90b11c3d2b20&__scoop_topic=2455618



==============================================

Special Bulletin - My just released book, 

"You're Hired. Super Charge our Email Skills in 60 Minutes! (And Get That Job...) 

is now on sales at Amazon.com 

Great Reasons for Purchasing Netiquette IQ

·         Get more email opens.  Improve 100% or more.

·         Receive more responses, interviews, appointments, prospects and sales.

·         Be better understood.

·         Eliminate indecision.

·         Avoid being spammed 100% or more.

·         Have recipient finish reading your email content. 

·         Save time by reducing questions.

·         Increase your level of clarity.

·         Improve you time management with your email.

·        Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

 =================================

**Important note** - contact our company for very powerful solutions for IP
 management (IPv4 and IPv6, security, firewall and APT solutions:
www.tabularosa.net
==================================================

Another Special Announcement - Tune in to my radio interview,  on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.   

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” has just been published and will be followed by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

In addition to this blog, I maintain a radio show on BlogtalkRadio  and an online newsletter via paper.li.I have established Netiquette discussion groups with Linkedin and  Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and I have been contributing to the blogs Everything Email and emailmonday . My work has appeared in numerous publications and I have presented to groups such as The Breakfast Club of NJ and  PSG of Mercer County, NJ.

I am the president of Tabula Rosa Systems, a “best of breed” reseller of products for communications, email, network management software, security products and professional services.  Also, I am the president of Netiquette IQ. We are currently developing an email IQ rating system, Netiquette IQ, which promotes the fundamentals outlined in my book.

Over the past twenty-five years, I have enjoyed a dynamic and successful career and have attained an extensive background in IT and electronic communications by selling and marketing within the information technology marketplace.Anyone who would like to review the book and have it posted on my blog or website, please contact me paul@netiquetteiq.com.
=============================================================

Netiquette IQ Security Blog From US-CERT - Securing Home and Small Business Routers

National Cyber Awareness System:

Securing Home and Small Business Routers

12/15/2015 08:15 PM EST

Original release date: December 15, 2015

Home and Small Business routers have become the ideal target for attackers seeking to gain control over a user's gateway to the Internet. Router misconfigurations (e.g., default credentials, interfaces open to the Internet) or the lack of security precautions (e.g., absence of updates) may make users susceptible to exploitation. Once an attacker gains unauthorized access to a vulnerable router, they may be able to obtain sensitive information from a user's computer or perform other attacks. Users and administrators are encouraged to review Security Tip ST15-002 for guidance on how to secure home and small business routers.

Additionally, the Carnegie Mellon CERT Coordination Center (CERT/CC) continues to test small office and home office (SOHO) routers for vulnerabilities. US-CERT encourages users and administrators to review CERT/CC Router Vulnerability Notes for information on recently found vulnerabilities in some routers.
=====================================================
 For a great email parody, view the following link:
=======================================================
https://www.youtube.com/watch?v=HTgYHHKs0Zw
scoop_post=bcaa0440-2548-11e5-c1bd-90b11c3d2b20&__scoop_topic=2455618



==============================================

Special Bulletin - My just released book, 

"You're Hired. Super Charge our Email Skills in 60 Minutes! (And Get That Job...) 

is now on sales at Amazon.com 

Great Reasons for Purchasing Netiquette IQ

·         Get more email opens.  Improve 100% or more.

·         Receive more responses, interviews, appointments, prospects and sales.

·         Be better understood.

·         Eliminate indecision.

·         Avoid being spammed 100% or more.

·         Have recipient finish reading your email content. 

·         Save time by reducing questions.

·         Increase your level of clarity.

·         Improve you time management with your email.

·        Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

 =================================

**Important note** - contact our company for very powerful solutions for IP
 management (IPv4 and IPv6, security, firewall and APT solutions:
www.tabularosa.net
==================================================

Another Special Announcement - Tune in to my radio interview,  on Rider University's station, www.1077thebronc.com I discuss my recent book, above on "Your Career Is Calling", hosted by Wanda Ellett.   

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” has just been published and will be followed by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

In addition to this blog, I maintain a radio show on BlogtalkRadio  and an online newsletter via paper.li.I have established Netiquette discussion groups with Linkedin and  Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and I have been contributing to the blogs Everything Email and emailmonday . My work has appeared in numerous publications and I have presented to groups such as The Breakfast Club of NJ and  PSG of Mercer County, NJ.

I am the president of Tabula Rosa Systems, a “best of breed” reseller of products for communications, email, network management software, security products and professional services.  Also, I am the president of Netiquette IQ. We are currently developing an email IQ rating system, Netiquette IQ, which promotes the fundamentals outlined in my book.

Over the past twenty-five years, I have enjoyed a dynamic and successful career and have attained an extensive background in IT and electronic communications by selling and marketing within the information technology marketplace.Anyone who would like to review the book and have it posted on my blog or website, please contact me paul@netiquetteiq.com.
=============================================================