Clareity Consulting - Publications - Real Estate focused Security Articles

Real Estate Information Technology Consultants

Article Index

Is Your Computer Ready for the Internet?

Author: Matt Cohen, Clareity Consulting (www.callclareity.com)

Most people know by now that a computer with Windows on it, if it has not been updated with the newest patches from Microsoft, will likely be infected with viruses, seized by spyware, or taken over by a hacker within minutes of being connected to the Internet. This is especially true for computers belonging to mobile real estate professionals. If you own a Windows PC, here are some security "basics" to prevent your computer from being compromised. For the sake of brevity, instructions here will refer to Windows XP only. If you are running any older version of Windows, it's time to upgrade to XP. Earlier Microsoft operating systems, such as Windows 95 or 98, are pretty much impossible to secure.

If you have a "computer person" or someone else manages your computer, give this article to them and let them make the changes. The changes are easy enough for you to make, but you may want to consult them before making any changes to your computer.

If you don't have to type a password to log into your computer, it's extremely vulnerable. Make sure all user accounts have a strong password (more than eight characters long – using letters, numbers, and punctuation – and not using a word, name, or personal information that anyone else might learn). To change your password:

Go through the "Start" menu or "My Computer"
Click on "Control Panel"
Double-click on "User Accounts"
Click on "Change an Account" and then the account you wish to edit
Click on "Change my Password" and follow the instructions
While you're there, click on the "Guest" account and turn it off if you don't use it

You should use the built-in firewall in Windows XP, unless you have other software that performs that function. To check the status of the firewall:

Go to the Control Panel (from the 'Start' menu or 'My Computer').
Double-click on "Windows Firewall"
Make sure that the "On (recommended)" selection has been made
Go to the "Advanced" tab
Make sure all network connections are checked
Click "OK"

At first the firewall will start popping up dialog boxes asking if you want to allow your programs that access the Internet still to be able to do so, but after you give them the okay, the firewall will stop bugging you. If you don't have Windows XP, you should obtain a Windows-based firewall such as ZoneAlarm (www.zonealarm.com) or use the one built into popular security suites such as Norton or McAfee. Keeping up to date with security patches is extremely important. The best way to make sure you stay on top of this is to configure "Automatic Updates" to automatically keep your computer up-to-date. To do so:

Go to the Control Panel (from the 'Start' menu or 'My Computer').
Double-click "System" (or "Performance and Maintenance", then "System")
Click on the tab at the top that says "Automatic Updates"
Check the box marked ""Keep my computer up to date"
Select "Automatically download the updates and install them on the schedule that I specify"
Choose a time when the computer is turned on and someone is logged on
Click "OK"

You should, at least once a month but preferably more often, visit http://update.microsoft.com and follow the instructions on that site to ensure that your computer has been kept up to date. Remember to check for updates for other software you have installed, especially Microsoft Office (http://office.microsoft.com/en-us/officeupdate/default.aspx).

You need a modern version of an antivirus package that checks for updated definitions daily. Dozens of fine companies produce antivirus software, with Symantec, McAfee, Trend Micro, and F-Secure being some of the more popular vendors. Many of the newer packages are labeled as "Security Suites" and include firewall and anti-spyware functionality built in. If you don't have an anti-spyware tool built into software you already have, download one for free from any of these sites:

Anti-spyware tools usually let you check for new definitions (just as your antivirus does). Check for the new definitions, and following the instructions from whichever software package you are using, re-scan your computer at least every week. Some tools allow you to "immunize" your computer so that you can't easily install new spyware. Remember, no antivirus or anti-spyware tool is perfect – there are always new threats, and these tools don't make you invulnerable.

By default, other people can connect to your computer and, if they can guess your password, get access to your printer and files. If you don't use your computer as a file server or print server:

Go to the Control Panel (from the 'Start' menu or 'My Computer')
Double-click Network Connections (sometimes labeled Network and Internet Connections)
Highlight any network connection (typically, there is one labeled "Local Area Connection")
Choose "Properties" from either the File menu or the menu you see when you right-click on the connection
Highlight "File and Print Sharing"
Click the "Uninstall" button beneath it
Click "OK" through the confirmations that come up

If you couldn't find "File and Print Sharing" in the first place, it probably isn't installed – that's a good thing.

A password-protected screen saver can help prevent unauthorized persons from using your computer while you are away from it. To set a password-protected screen saver:

Right-click on a blank part of the Windows desktop area.
Select "Properties"
Select "Screen Saver"
Select a screen saver from the list
Select how many minutes of inactivity you want the screen saver to wait before it turns on
Check the box labeled "On resume, password protect" or "On resume, display Welcome Screen"
Click "Apply"

This will force you to enter your Windows password to "wake up" your computer after the screen saver has engaged. Because the screen saver doesn't turn itself on immediately when you walk away from you computer, you also may want to get into the habit of "locking" your computer when you walk away from it. If your keyboard includes a key with a Window icon on it (near your space bar) lock the computer by pressing the "Windows" and "L" keys simultaneously. You then just log back in as normal to access your computer.

I and other security professionals use a wide variety of automated testing tools to ensure that best practices are followed in dozens of areas of security, including securing the workstation. One of these tools is both easy to use and free! It's called Microsoft Baseline Security Analyzer (MBSA). Download it from here: http://www.microsoft.com/technet/security/tools/mbsahome.mspx

Once you install this tool and launch it, click on "Scan a Computer." It will default to your own computer, and you can just click on "Start Scan" to begin the test. It will take some time to start, since the first thing it does is to download updates for itself from Microsoft, but be patient – a scan usually takes less than five minutes. When the tool is done it will display a report rating the security of your computer. Hopefully, the summary at the top of the report labeled "Security assessment" tells you "Strong Security (The selected checks were passed)." More typically it won't, and you should scroll down to find the red Xs that signify the most significant problems. Follow the links such as "Result details" and "How to correct this" to learn more about the problems found and to read articles describing how to fix them. Once you have fixed all the problems, run the tool again. Hopefully this time, there are no red Xs!

These are just a few of the areas that need looking after in order to make your computer secure. Checklists for computer professionals cover many more areas, and drill deeper down to protect the heart of your computer. By using the techniques outlined above, though, your computer will not open up like a door when a hacker jiggles the handle. Hopefully, the bad guys will move on to easier targets!

About the author: Matt Cohen is Clareity Consulting's Chief Technologist and leads its security assessment practice. Matt has spoken at many conferences, workshops and leadership retreats around the country on security related topics, and is a well-regarded real estate industry expert on software design, product management, project management, data center reliability, scalability, and security. Clareity Consulting was founded in 1996 to provide information technology consulting to the real estate industry and its related businesses.