Computer Security 101

This page provides an overview of computer security, with emphasis on why you should be aware of a system's security and how you can protect yourself even if you're not a system administrator. More details are given in the CITES Computer Security pages.

Why you should care

Ramifications from a security breakin can range from annoying (for example, your standard screen and printer fonts being replaced by Pink Floyd's handwriting) to catastrophic (for example, being used as part of a network of attacking machines that takes a national or international Internet service offline). If the attacker is reasonably clever, your system can be compromised in a way that you personally might not notice, but if your system's spare operating time is being used to launch attacks on other systems, your computer can be disconnected from the network or subject to other serious
actions. Bottom line: The time you spend on preventive security measures is small in comparison to the potential loss of time and productivity resulting from a single breakin.

Fortunately, there are some easy steps you can take to protect yourself from most computer crackers and virus writers.

What you can do

There are two main areas to think about:

• Protecting your account (login name and password)
• Protecting your computer system

Protecting your account

To protect your login name and password, you should:

• Choose a good password. For tips on what makes a good password, see the Introduction to Your Passwords page.
  
  
• Make sure that your login name and password are encrypted whenever that information is sent across the network. The simplest way to do this is:
  
  
  • Use CITES Express Email for email access. Express Email is found at https://express.cites.uiuc.edu/.
    
    
  • Use SSH instead of telnet. If it's already installed on a system, you can start SSH and log in to your account the same way you would with telnet. If it hasn't been installed yet, you can find instructions for installing it on your operating system in the Computer Security pages.
    
    
  • Use SFTP rather than FTP. Just as SSH securely replaces telnet, SFTP securely replaces FTP. If it is already installed on a system, you can start SFTP and manipulate files the same way you would with regular FTP. (There are both command-line and graphical interfaces available with different versions of SFTP; you can choose the interface you prefer.) If it hasn't been installed yet, you can find instructions for installing it on your operating system in the Computer Security pages.

Protecting your computer system

In addition to protecting account information, you should protect your computer itself. To protect your system from attack:

• Install anti-virus software and keep it up to date. Anti-virus software protects your system from malicious code that could be imbedded in files you download, email you receive, or Web sites you visit. If anti-virus software hasn't been installed on your computer yet, you can find instructions for installing it on your operating system in the Computer Security pages.
  
  
• Keep your operating system and applications patched with the latest available patches. Because new exploits are written every day, and not all of them involve viruses, you should pay attention to the effort your operating system manufacturer puts into keeping security patches current. Check the vendor websites often, and make sure you have installed the most current version of the software and the most current patches.
  
  
• Disable any unneeded services. This really isn't a novice task on any operating system, but if you know a system administrator or a bright computer science student, ask him or her for assistance. Many computers are shipped with extra services enabled. If you don't intend to use them, you can turn them off to reduce the number of ways intruders can get into your system unannounced. Again, see the Computer Security pages for assistance, advice, and contacts.