|
StartSafe Information for Existing Home and Residence Hall Computers
last updated: Friday May 16, 2008 01:03 PM
If you must store sensitive data associated with JMU business or constituents on a laptop or other portable device, contact JMU Security Engineering at it-security@jmu.edu for assistance.
Most of these instructions apply to Windows computers. For others:
For Windows computers:
Windows versions prior to Windows XP Service Pack 3 are no longer supported by Microsoft and are unsafe to use due to unavailability of security updates. Unsupported versions include XP SP2, Windows 2000, and Windows ME/98/95/NT.
Microsoft Office 2000 and prior versions are no longer supported by Microsoft and are unsafe to use due to unavailability of security updates. JMU has purchased a license for Microsoft products making newer versions of Office available to faculty and staff for their home computers under the "Work at Home" license terms. Upgrading Office 2000 to a newer version is particularly recommended. Installation CDs are available from the JMU Bookstore for $5-$6.
STEP 1 - Enable the firewall on Windows XP and Windows 2003 Computers. If possible, do this before the computer is ever connected to a network. Note - New Windows XP computers, those running Windows XP Service Pack 2, and computers running Windows Vista and Windows 7 have their firewalls enabled by default so no action needs to be taken.
We must enable a firewall to keep criminals and their programs (viruses, worms, etc.) away from the defects on our computers. This will allow us to connect to the Internet and install updates to fix these defects. Afterwards, the firewall will help protect us against future defects and operating mistakes. This step is only necessary for Windows XP and Windows 2003 computers. The Windows Vista and Windows 7 firewall is turned on by default.
Windows XP and 2003:
- Click Start
- Click Control Panel.
- Click Network and Internet Connections
- Click the Network Connections Control Panel Icon
- Right-click Local Area Connection and select Properties
- Click the Advanced Tab. If you don't have an Advanced Tab, right-click Local Area Connection again and click Remove from Bridge. Then go back to Properties and Advanced Tab.
- Check the box labeled "Protect my computer and network by limiting or preventing access to this computer from the Internet".
- Click OK
- Connect to the network
- Restart the computer
STEP 2 - Download and Install All Critical Updates from the Microsoft Update Web Site
This step will fix the defects in Microsoft software that lets criminals take control of our computers (and our privacy, our identity, our network, etc.). This step can be time consuming because there are so many security updates to install, particularly for older computers. A later StartSafe step will have you configure your computer so it keeps itself up to date so you don't have to do this again.
You must repeat the process until you're told that no more critical updates are available. Doing it once may leave you vulnerable.
To update your Windows Vista or Windows 7 computer:
- Open Internet Explorer ( other browsers won't work )
- In the menu bar, click Safety and then select Windows Update
- In the Control Panel window that pops up, click Get updates for more products. This will start the installation of the Microsoft Update program which will better keep your computer up to date than the older Windows Update program.
- Accept the terms of use.
- Click install.
- When the Control Panel window reappears, click Check for Updates and follow the remaining directions. You'll need to repeat this process until there are no more critical and security updates available.
To update your Windows XP computer:
- Open Internet Explorer ( other browsers won't work )
- In the menu bar, click Safety and then select Windows Update.
- If you see "NEW! Get Microsoft Update Today", then
- Follow the instructions to install the new Microsoft Update program which will better keep your computer up to date than the older Windows Update program. Then come back here.
- Otherwise,
- Follow the instructions to update your computer. You'll need to repeat this process until there are no more critical and security updates available.
- If you need them, instructions showing screen shots are available here but may vary somewhat from what you actually see depending on versions and platform.
Older Microsoft Windows operating systems ( XPSP2, 2000, 95, 98, ME, NT ) are no longer supported, are not provided with security updates, and cannot be secured so they should not be used, particularly on a network.
STEP 3 - Set up your computer so it automatically downloads and installs future updates
Once you are caught up with current critical Windows updates, you'll need to install new ones that come out about monthly. You can do this manually, or, if you have a Windows XP, Vista, or Windows 7 computer, you can set it up so that it takes care of itself. Your computer will check for updates, download them, install them at a time specified by you, and reboot all on its own. If your computer is turned off at your selected installation time, it will perform the installation the next time it is powered on.
To set up the automatic updates, follow the instructions at Microsoft's Automatic Update Site. Windows Vista and Windows 7 computers are set up for automatic updates by default.
STEP 4 - Install Anti-Virus Software Provided by JMU
Anti-virus software must be installed to protect us from criminally written programs that we may inadvertently run on our computers or that criminals may caused to be run by using unknown defects. JMU has purchased a site license for Symantec Corporate Edition that allows all faculty, staff, and students to use the software both at the office and at home. The advantage of using this software is that it is provided pre-configured to offer the best security and is fully supported by the JMU Helpdesk. TO PREVENT PROBLEMS, ALL OTHER ANTIVIRUS SOFTWARE SHOULD BE UNINSTALLED FROM YOUR COMPUTER. We have experienced instances where the installation of the Symantec software on computers that have other anti-virus software installed destroys the computer necessitating a complete rebuild.
The Symantec anti-virus software can be downloaded from the JMU Computing Downloads web page. On a dial-up line, this can take several hours.
If you find that your computer is already infected with a virus that cannot be removed by the Symantec software, you will have to download and run special cleaning tools using a special procedure. Guidelines can be found by clicking here.
Having anti-virus software does not protect you from new viruses that are released daily. A clean virus scan of a program does not mean its safe to run.
You cannot legally install or distribute the JMU licensed Symantec anti-virus software on computers owned by people who are not current students or employees of JMU. You can, however, get free anti-virus software elsewhere. Microsoft itself offers free software for home computers:
Microsoft Security Essentials
STEP 5 - Configure your computer to display file names correctly
Windows hides the real names of files from you which makes it easy for virus writers to fool you. It also makes it difficult to do something which should be simple - change a file name. You can tell your computer to tell you the truth about most file names by making the simple change below.
On Windows 7 and Windows Vista computers:
- Click Start
- Select Computer
- Select Organize
- Select Folder and Search Options
- Click the View tab
- Scroll down to the line "Hide file Extensions for known file types" and uncheck the box next to it.
- Click OK
On Windows XP, 2000, and 2003 computers:
- Double-click My Computer
- Click the Tools Menu item and then select Folder Options
- Click the View tab
- Scroll down to the line "Hide file Extensions for known file types" and uncheck the box next to it.
- Click OK
STEP 6 - Run a Spyware Removal Tool on Your Computer
Several types of malicious programs not detected by anti-virus software have become common on the Internet and many computers have become infected with them. These programs can compromise your privacy and cause your computer to operate poorly. One tool to fight these programs is available on the JMU Computing Downloads site. It is called SpyBot Search and Destroy.
Depending upon your browsing and download/software installation habits, it would be a good idea to use the extra protection provided by SpyBot.
Step 7 - Install security updates for other software you may have installed ( e.g. iTunes, Winamp, Firefox, QuickTime, RealPlayer, Skype, Flash, Adobe Acrobat Reader )
People often add programs to their Windows computer. Many of these programs have security defects that can allow criminals and viruses to take control of the computer. In fact, these programs are currently more often the target of attacks and more responsible for infections than than Microsoft software. Common sites for vendor updates are listed on the JMU RUNSAFE web site. See the Securityfocus vulnerabilities web site for a more comprehensive list. You only need to update these programs if they have been installed on your computer. A partial list of programs installed on a Windows computer can be found in the 'Add or Remove Programs' Control Panel.
Download locations for programs commonly installed that have serious and/or actively exploited security defects are listed below:
Keeping track of all your installed software and needed updates is tedious, time consuming, and errorprone. One company that makes a product that can help with this task and that has had favorable reviews is Secunia. They offer a web based service you can visit with a browser that will check your computer for needed updates for a few dozen of the most popular programs. If you want, they will email you reminders on a periodic basis to rescan your computer. They also offer a more comprehensive program that can be downloaded and installed on home computers that can check for updates for thousands of programs. As always when using a web service that requires downloading software, the terms and conditions and privacy policies should be examined.
* Click here for the web based service.
* Click here to download the program for home computers.
Step 8 - Password protect your screen saver
Set your screen saver up so that you're required to type your password before it will unlock.
- right-click any blank portion of the screen and select properties
- click the Screen Saver tab
- Click the On resume, password protect checkbox
Step 9 ( optional but STRONGLY recommended ) - Set up and use a safer account for day to day use
Safer accounts for day to day use on Windows computers can be set up fairly simply. If you want to take one more step that will reduce risk more effectively than many of the other recommendations, set up a limited account on your Windows 7 computer for day to day use ( procedure for Windows XP and Windows Vista is similar except that the account on Windows XP is called 'limited' instead of 'standard' ).
Most of today's viruses and spyware will not install when using such an account. If they do install, their damage will be limited.
If you don't use such an account, the chances are high your computer will be infected with Spyware and other unwanted programs, particularly if you use Internet Explorer as your browser.
Step 10 - Review Information on Safe Operating Practices and Current Threats and Issues
Once you have set up your computer in a way that will protect it and you, it is important to realize that your operating habits can reverse all the work you've done and allow criminals or viruses to take control of your computer or information. Please review the JMU Computing Security web page for guidelines on operating it in a safe manner, common mistakes, and current threats and issues. JMU sensitive information must not be stored on personally owned computers or devices. Such data may only be stored on approved JMU owned devices and only with prior approval.
Addendum:
- File/Music Sharing Programs
- USB Portable Storage Devices
File/Music Sharing Programs
If not configured, maintained, and operated properly, file sharing programs may be the cause of numerous problems:
- They may share sensitive information stored on your computer with the whole world
- They may share copyrighted information stored on your computer exposing you to serious fines, legal problems, and/or action by JMU offices such as Judicial Affairs, Human Resources, and JMU IT.
- Security defects in the software may allow others to take control of your computer
- They may expose you to malicious files
USB Portable Storage Devices
There are large numbers of malicious programs circulating that will infect such devices or allow such devices to infect computers to which they are connected. USB devices include USB keys, USB disk drives, cameras, and digital picture frames. Risk reduction measures:
- Do not plug or allow others to plug unknown or untrusted USB devices of any type into your computer, particularly if the computer processes or stores sensitive data. On Windows computers, hold the shift key down while inserting the device and continue holding it down until windows tells you the device is ready. This will disable any autorun functionality. You may need to double click the folder to view the contents and, if trusted, open individual files.
- Use caution when plugging your USB device into an unknown or untrusted computer. If the device has a write protect switch, use it. If the device contains sensitive data, do not plug it into unknown or untrusted computers at all.
Linux/Unix
|
