self-secure

IT security information & advice

[selfsecure]

Ransomware: An Explanation and Advice

The world is currently going through the worst computer virus outbreak in the Internet's short history so here is what you need to know.

Ransomware is a virus that attempts to extort money by making files inaccessible/unreadable. It promises to unlock these files in exchange for payment.

Paying the money doesn't always result in the files being unlocked. Victims who do pay become more of a target (as attackers know they're vulnerable and willing to pay).

The most common method of infection is e-mail. A victim will receive an e-mail with a bad attachment or link to a bad web-site.

What Can You Do?

Be careful in what e-mails you open, sites you visit and files you download.

Use Windows Update to 'patch' your computer.

Keep programs (like Adobe Acrobat) up to date.

Backup your important files (like photos) on a portable drive. Don’t keep this drive always connected to your machine (only connect it when you want to copy files).

Have an anti-virus but remember this is no guarantee you’re safe.

If you do get infected it is most likely your PC will need to be rebuilt from scratch and files gone, so backup what is important to you in case this ever happens.

Published by Mark Toh for Self-Secure Visit us at https://www.facebook.com/selfsecureIT or http://self-secure.com/

[selfsecure]

Security Tip: Administrator Access

When you start up a computer/Windows for the very first time you are asked to set up an account. You set a username and a password (or no password at all) and that becomes the main account for the computer. Most people use this account for everything and never need another. My advice is never use this account for your day to day use.

The first thing you should do is create a second account (or a third and fourth, one for every user of the computer) that is a ‘basic user’. This account won’t have access to install programs or have access to every folder on the computer but that’s what you want. Especially for children.

A Windows 7 User Account Management window

In older versions of Windows some programs wouldn’t run under basic privileges, forcing you to use an administrator account. Now whenever you need administrator rights (like to install something new) ‘user access control’ will prompt you to enter it in. So you can stay logged in as a normal user and only enter the administrator details when you need to. The great thing is if you get prompted and you weren’t expecting it you can ignore it which means you may have avoided something malicious running, that could have run otherwise.

The administrator account is exactly that. It has full ‘administrative privileges’ meaning it has access to everything and the ability to do anything. So this is the account viruses and hackers want to run as when attacking a machine. When you use this account you greatly increase the risk to your computer.

Every month Microsoft release vulnerabilities (issues with Windows or Microsoft products) which can be exploited by attackers (now this isn’t just a Microsoft problem, all software has this problem). The majority of these vulnerabilities all say the same thing, “they allow the attacker to use the privileges logged in at the time”. So what does this mean? If you’re logged in as a normal user and you’re exploited the most they have access to what a basic user does. If you’re logged in as an administrator and you’re exploited they have access to everything.

You can get viruses/exploits just from going to the wrong site or making a wrong click. You can even get them going to the right site because it’s been compromised. You can get them from e-mail attachments, links and many other innocuous ways. This is a simple way to reduce or avoid the damage these can do. Now this isn’t foolproof, as some malicious programs don’t need administrator privileges to run, but you can sure feel a lot safer using the computer.

[selfsecure]

Introducing Self-secure

Self-secure was created to help as many people as possible with computer security issues. As well as writing about IT security it invites anyone to ask for advice. It will attempt to address all manner of issues such as best practices, threats and even just how to deal with life on the Internet.

I’ve been working in IT Security since the early 2000′s and I’d like to share some of my experience and philosophies to try and help people. I’ve worked in private, government and education organisations of all shapes and sizes and come across thousands of different problems. My goal with Self-secure is to help prevent thousands more problems from even occurring.

I’ll strive to provide information in a way that is easy to understand and beneficial to a wide variety of people.

If you’d like to get in contact or ask for advice just use the Ask Link or contact me on Facebook or Twitter.