oo much or too little online security can lead to a world of trouble. Here's a solution.
Even if your PC contains no sensitive or personal information, it may still draw the attention of hackers and crackers. They seek to hijack innocent systems to use as staging areas or spam relays or to be "zombie agents" in denial-of-service attacks on other systems. (For an example, see http://www.msnbc.com/news/460824.asp?cp1=1).
Almost any hacker, cracker, or warez site offers tools that will make a law-abiding Netizen's hair stand up. For example, port-scanner tools can run through upwards of 10,000 IP addresses an hour, looking for any online system with an open and attackable port. It's astonishingly simple for a malicious hacker to simply point, click, and let the software run until it finds a vulnerable system.
With tens of thousands of miscreants on the prowl for vulnerable systems, any PC--even systems with dynamic IP addresses and intermittent dial-up connections, such as notebooks and non-networked PCs--can be vulnerable to attack.
Clearly, any system, networked or standalone, containing sensitive data or not, needs some level of protection from hackers other external threats, such as viruses, Trojans, and worms.
But how much protection is enough? How much is too much? Where along the broad spectrum between complacency and paranoia lies the perfect amount of protection?
The Extreme Views
At one extreme end of the spectrum are those who swear by single-layer defenses: They'll install a firewall running either on a connection-sharing server or on the local desktop and believe they're essentially immune to attack. Or they may similarly employ an external hardware or firmware firewall (such as in routers and gateways) and believe that systems on the protected side of the firewall are about as safe as they need to be.
Then there are those who inhabit the opposite end of the spectrum. They load up their systems with multiple firewalls and intrusion-detection and back-tracing utilities, perhaps in concert with an E-mail virus/attachment filter and a local antivirus scanner. After all, if one firewall or antivirus scanner is good, then two or three or four in concert must be better, right?
The trouble is, both extremes can get you into trouble.
The 'Single-Layer Defense' Fallacy
Let's first look at the single-layer defense argument. The problem here is simply that no product is flawless or foolproof or can protect you against all threats, as this reader recently discovered:
I've been using BlackIce [a desktop firewall] for around a year and a half. It's quite interesting to see how often I am "hit" and what people will try.
[Then] I purchased a Dlink 704 firewall/router. This model has a four-port hub built in and requires no extra software to install or change settings. With a flick of a switch on the back of the unit, you're on or off the Internet. Nice feature.
Last week, BlackIce on my primary desktop began flashing. I had someone breach my firewall and hit my machine! I'm glad I kept the BlackIce program installed. The intruder was, as far as I can tell, unable to access anything. --Blaine
While it's possible that Blaine's attack was a false positive--BlackIce is a good tool, but it has somewhat of a reputation for false alarms--it's also entirely possible it was real. Even an excellent hardware firewall can be misconfigured, spoofed, or otherwise made to fail.
In fact, security tools and techniques fail all the time, as you can see by visiting a good security test site such as the free and excellent DSLreports.com. The people who use the security tests there are, by definition, already conscious of online safety concerns and more proactive about them than most users. And yet, in both DSLreports' quick-and-dirty "port probe" and the far more detailed "full scan" sections, you'll see an array of astonishing real-life, real-time examples from the test results database that show PCs with wide-open services (potentially available to attackers) or even with full access to the testers' local disks and printers.
These kinds of problems are much more likely to happen with a single-layer defense than with multiple layers because, in the former, any single point of failure will fundamentally compromise your security, perhaps disastrously. In contrast, with multilayered defenses, a problem with any one security layer won't necessarily affect the other layers.
5 Top Federal Initiatives For 2015As InformationWeek Government readers were busy firming up their fiscal year 2015 budgets, we asked them to rate more than 30 IT initiatives in terms of importance and current leadership focus. No surprise, among more than 30 options, security is No. 1. After that, things get less predictable.
Join us for a roundup of the top stories on InformationWeek.com for the week of December 7, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program!