Chapter 8 – Computer Security
In the cyber world, everything happens faster than in ordinary life. Computer security must, therefore, be based on equally fast technical means. We must also prevent theft or unauthorized access.
1. Introduction
In the real world, everything happens relatively slowly, and people are used to this speed. However, computers can perform billions of operations per second and are also connected to a network that allows information to be transmitted over hundreds of kilometres in fractions of a second. What takes a significant amount of time in the real world can take just a moment in the world of computers on the Internet. This can be used to work more efficiently, but it can also be abused.
Protection against cyber abuse must, therefore, be based on technical means that are just as fast and can keep up. However, it is also necessary to think about protecting against abuse of devices in the real world by defending against theft or unauthorized access.
2. Physical access to the device
When securing devices such as workstations, laptops or smartphones, it is essential to limit physical access. This prevents misuse of the device and its theft and prevents any components from being removed or added.
Therefore, it is necessary to keep your devices under constant supervision and, if this is not possible, to prevent access to them. Most often, this is done by locking the room where the workstation is located or by storing the laptop in a lockable cabinet or table. When travelling or at conferences, it is essential not to leave the device lying around but to carry it with you or use security frames, for example, in which the laptop can be placed and locked to the table with a cable.
In addition to physically manipulating the device, a freely available device has the disadvantage that anyone can work with it. Most users remain logged in when they leave the device, so anyone passing by can use it, upload something, or delete it. If the user is also logged into an agenda, such as an information system or email account, the passerby will also gain access to these systems.
It is, therefore, more than appropriate to turn off the device when leaving the office and lock the screen during shorter absences, such as making tea or taking a lunch break, so that colleagues in the same room cannot work with your device.
3. Automatic updates of the operating system
Nowadays, almost all devices are connected to the Internet to communicate – send and receive emails, visit websites, download files, etc. This means coming to the device in person is unnecessary, but it is accessible remotely under certain circumstances thanks to its Internet connection.
If the world were ideal, nothing could happen to connected devices because they would always be in perfect technical condition (and in an ideal world, there would be no cyber criminals). In reality, it is necessary to consider that the world is not perfect, take proper care of your devices, and use them correctly. This is the only way to survive safely on the Internet.
4. Automatické aktualizace operačního systému
The operating system (Windows, Linux, MacOS, etc.) must be included in every device; otherwise, it would be impossible to have user accounts, run applications, and use the device. From a practical point of view, an operating system is nothing more than an extensive and complex application. Due to its incredible complexity and the fact that it is produced (programmed) by people, many errors arise that no one knows about. However, over time, someone may discover them, for example, the manufacturer during further development, users during use, or cybercriminals who want to use them for themselves. Fortunately, most errors cannot be exploited, but occasionally, a severe one appears, which can, for example, be exploited to control your device remotely.
Operating system manufacturers respond to detected errors by issuing fixes in the form of updates. To quickly fix mistakes on your devices, it is necessary to install these updates as soon as possible – today’s operating systems already have the option of automatic updates as standard, where you as a user do not have to worry about anything and your device checks at regular intervals whether an update is ready for it. If so, it automatically downloads and installs it.
Every operating system eventually becomes obsolete, is no longer supported by the manufacturer and stops issuing fixes. Operating system manufacturers announce the end of support dates well in advance. This practically means that if our operating system has ended support, we have to switch to another, newer, supported one. Otherwise, we run the risk of cybercriminals exploiting an operating system error that the manufacturer will never fix.
5. Automatické aktualizace používaných aplikací
Aplikace, které jsou v zařízení nainstalovány, trpí úplně stejnými problémy jako operační systémy a mohou obsahovat chyby, které je potřeba opravovat. Často používané další aplikace jsou například kancelářské balíčky, aplikace na správu pošty (např. Thunderbird, Outlook) a mnohé jiné specializované, např. účetnictví apod.
Většina soudobých aplikací je schopna se sama aktualizovat nebo alespoň upozorňovat na existenci nové verze. V takovém případě aktualizaci proveďte co nejdříve. Pro ostatní, zejména starší, aplikace je vhodné nové verze kontrolovat manuálně alespoň jednou za určitý čas.
6. Automatic updates of used applications
You can also install various applications that are supposed to ensure the device’s security and prevent security problems. For several years now, it has been standard for quality manufacturers to combine the functions of all their security applications into one more significant application, usually called Endpoint Security. Let’s see what they can help us with.
Antivirus program
During standard work, users commonly launch applications, open files from external storage devices, and open content downloaded from the Internet. But what if the downloaded file contains a malicious application that only looks like a regular document? What if there are viruses on the connected flash drive?
An antivirus program protects us from these threats, a unique application that constantly runs in the system’s background and checks which files are accessed. Each such file is then carefully examined to see if it contains a virus that could harm your device, and if so, it does not allow the file to be opened.
An antivirus program evaluates each file against a list (database) of known malicious code, which it updates from databases published by the manufacturer several times a day. Conventional antivirus programs can detect suspicious computer behaviour and block this activity, even if the malicious code is not on the list (so-called heuristics).
What is a virus?
A virus is a program designed to damage or intrude into a computer system. Cybercriminals create it, and it is a set of commands that are executed when they run. As a rule, these commands do not occur separately but are contained in other executable files. It can be a very malicious virus that can, for example, delete saved files or just a virus that is designed to annoy the user—for example, pop-up windows with advertising.
Firewall
Two devices can communicate thanks to computer networks and the Internet (simplified). However, every communication can be potentially dangerous – it can target errors in some installed applications, errors in the operating system, or even an incorrectly configured device. Therefore, the rule of least access applies here, too, and communication is limited to only that which is necessary.
There is a so-called firewall for these needs, which is nothing more than a gateway between the device and the rest of the world. Communication passing through this gateway is controlled, and based on the rules set by the user, it is decided whether the communication will be released or not. Typically, there are restrictions on who can connect to the device and request something, e.g. remote login, file download, etc. Modern firewalls also allow you to set which installed applications are allowed to communicate and how to prevent unwanted communication of these applications.
Safe web browsing
According to statistics, the most common activity of a user is browsing the web and web pages, which is why security applications often include a component that actively prevents visits to malicious websites (malicious from a security perspective, not the information provided on them) or at least blocks their malicious components on such websites. Even if a user does not recognize that they have received a malicious link in an email, for example, and visits the page, they can be protected.
7. Separation of administrator and user accounts
To work with a computer, we always need a user account to which a profile is assigned. For example, it tells us what the desktop should look like and, most importantly, what permissions the user has. An application launched by a user with a regular user account cannot access files that do not belong to the user and generally has minimal options. In contrast, an administrator account allows you to interfere with the operating system settings and access to all files, and its misuse is potentially very dangerous. Therefore, we should avoid regular work under the administrator account and use it only for a limited, necessary time to set up the system.
8. Device administrator
Each device should have an administrator who will ensure that security recommendations are met. With the available instructions, any user could certainly handle it, but they are usually experts in other areas and do not want to waste their time on device administration. In such a case, it is necessary to ensure that their devices are administered – by user support in their organization, by the IT administrator of their department, by a knowledgeable colleague or by a professional company. It works similarly with cars – their users also entrust them to service stations. The user, like the driver, should know what he requires for his device and be able to arrange for its care.
9. Summary
In this chapter, we learned that we must behave correctly towards the device we use to access the Internet. First, it is required to prevent unauthorized persons from using or being alone with the device – that is why physical security of the device and locking the screen when leaving are essential.
It is typical for today’s devices to be connected to the Internet and, therefore, can be accessed remotely. Consequently, it is necessary to use appropriate technical means – an application for securing endpoints, including an antivirus program and a firewall. We must also not forget that updating the device’s operating system and installed applications, including an antivirus program, is necessary. If the device is successfully attacked, it is advisable to always work under a user account because the damage will not be as significant, thanks to lower access rights. If you do not feel technically proficient enough to manage your device or do not have the time, secure a quality administrator who will take care of your device.