The occurrence of malicious attacks against Internet users has grown exponentially in the last year or so. The high level of publicity surrounding gaps in the security of our operating systems and other software applications, along with the rise in popularity of high speed (always on) Internet connections has made it more difficult to protect your home computer/network from these attacks. In recent months, numerous ICON members have had their PC's infected by some form of virus, unknowingly allowed huge amounts of malware to make a home on their hard drive, or had their browser hijacked.

For years, we have preached at you to back up your data, maintain updated virus protection, and use common sense about opening e-mail attachments…but that is no longer enough. We must all take a proactive approach to protecting ourselves and our computer equipment, not only from unnecessary expense, but from the frustration associated with equipment downtime.

We want to help you learn how to protect yourselves from these evildoers. Each of us have different interests and habits when it comes to using e-mail and the Internet, and unlike the MSN butterfly, we don't claim to protect you from unseen or unexpected evils. What we can do is try to help you understand how to reduce the risk that you will fall victim to them. As the old saying goes, "an ounce of prevention is worth a pound of cure". If you know and understand the potential threats and the different ways to deal with them, you should be able to devise a plan that works well for you.

One of the simplest, most basic ways to protect your computer is to run basic maintenance tasks frequently:

• Backup personal files
• Delete unnecessary personal files
• Delete unnecessary Cookies
• Delete Temporary Internet Files
• Run Disk Cleanup
• Run Disk Defragmenter

Good housekeeping helps your computer perform at optimum levels and helps alleviate open doors for potential exploitation.

In the past, you had to insert a floppy disc containing a virus in order to get bitten. With the advent of electronic mail and the Internet, e-mail attachments became the most common route for a virus to enter your computer. This is not the case anymore, but it is still one of the easiest ways for a cracker to send malicious code to your PC. Interestingly enough, these old fashioned methods require the user to open the executable file him/herself. While there are many more ways for malicious code to infect your computer today, an uneducated user is still the most vulnerable target.

Writers of malicious code have continually become more creative in disguising their ill intentions, so it pays to be informed of what and what not to do when opening e-mail. Those who use one of the big name Internet Service Providers (ISPs), such as AOL, Earthlink, Juno, etc., are at lower risk than those using a local provider such as PCIS. The big providers have their own, proprietary e-mail client, and the user's inbox is stored on the server instead of on the user's hard drive. These providers scan all the mail that passes through their system and filter out anything with a suspicious signature. It is also more difficult for crackers to write malicious code for these proprietary mail clients, since they are not available for retail sale. A virus writer needs to be able to get the software and search it for vulnerabilities in order to write codes that will exploit it.

If your ISP doesn't provide their own e-mail client, you must use commercially available software such as Microsoft's Outlook, or Outlook Express. In this case, your e-mail, along with any malicious code, is downloaded to your hard drive. This poses no threat to the ISP's server, so locally operated ISPs generally don't provide any filtering or protection of any kind. Outlook Express is included in all versions of the Windows operating system and is the most common mail client for most home users who subscribe to smaller ISPs. Outlook is available at any software outlet, and is by far the most widely used mail client for business networks (and nearly all offices have more than one computer), a cracker has a greater chance of inflicting more widespread damage if he targets these applications. Because of this, the end user must be more knowledgeable and exercise more caution in handling their messages.

After routine maintenance, an up-to-date antivirus program is the next step in your line of defense against malicious code. If you do not have antivirus software installed on your computer, DON'T OPEN E-MAIL AT ALL! Maintain your antivirus program by downloading the latest virus definitions and have it scan all incoming messages and attachments.

Both of Microsoft's e-mail clients are, by default, set to display a highlighted message in a preview, or reading pane. This is a very dangerous setting. If the first message in your inbox contains any malicious code, it will open automatically when you start your mail program. Before you receive any mail, open the "View" menu and turn off the reading pane. Your computer should also be set to show file extensions (such as .doc, .jpg, .asp, etc.). Certain file types carry more potential danger than others.

Once your mail program is properly configured, and incoming mail has been scanned, you are ready to inspect each message suspiciously. Is the message from someone you know and might reasonably expect to send you e-mail? If not, delete it without opening it. If the message appears to be from someone you know, look at the subject line…does it sound like something the person might send you…and is it worded in a way they might say it? If the message includes an attachment, is it reasonable to think that this person might send you an attachment…and did they mention it in the message? If you have any doubts at all, pick up the telephone and call them to find out if they really did send it. Did you know it is a very simple thing to forge an e-mail address? Would you be surprised if I sent you a message that appeared to be from yourself? Many of the worst worms send themselves to everyone in the victim's address book, so they appear to come from someone known to you. A little knowledge and some common sense can help protect you and your friends from these types of intrusions.

Learn how to protect yourself from the threats I've mentioned, check ICON's online calendar and attend as many of ICON's Focus on Security events as you can. Our aim is to give as broad an overview of computer and online security as possible. Don't get caught with your antivirus down!

Next month, we'll talk about things you can do to protect yourself while surfing online.

Safe Computing!
Terry