Yesterday, someone told me their security was good since they only get infected by a few viruses each year.

Even a single infection means there is a possibility that their machines are already infected.

If one virus can get in, other undetectable viruses can too.

Unless security protections are very poor on a network or computer, visible virus infections are rare these days.

People who see virus infections need to act, including patching their Internet facing applications and enabling click-to-play. Those features already come with Windows and applications so there is nothing to buy or download. For more information, see foster institute dot come slash blog.

If you know someone whose computers on their network catch viruses, tell them the viruses are more like chest pain, not like the common cold. Infections are the sign of some greater damage that is about to, or already has, occurred.

The post Only One Virus is a Huge Problem appeared first on Foster Institute.

Google’s VirusTotal.com is an online service that checks websites for viruses using 54 antivirus products. Before you click – check that website!

FYI, the site also allows you to upload program files. The file is checked against all of the antivirus products too.

So, before you open a file, get a second opinion from Google by using Virus Total. Forward this to everyone you care about, including your IT Pro – and they may want to send it to everyone in the organization!

The post Know Before You Click appeared first on Foster Institute.

One big problem with Shellshock is that it is very easy for attackers to exploit a system. They tell a system, “Here is a program. Run it.”

Apple has not, as of now, released a patch for OSX. There is a new patch for Linux, but it does not completely fix the problem.

As an executive, even if you have limited IT experience, you can go to Google and enter this search phrase:
filetype:sh inurl:cgi-bin site:fosterinstitute.com
(replace Foster Institute’s web site with your own actual website)

Hopefully, Google will tell you that the search did not match any documents. However, either way, it is still possible you are vulnerable. Ask your IT Pros to make sure your web server does not use Linux.

Please forward this to everyone that you know if you want to help him or her be secure against the ShellShock vulnerability!

The rest of this document is more technical, intended for your IT Pros.

There is a patch, but the patch only solves part of the problem. To see if the patch is in place, you can execute the bash command:
env x='() { :;}; echo vulnerable’ bash -c “echo patch this system”
There will be an error message anyway, but if you do see the words “patch this system” displayed as output, then the patch hasn’t been applied.

Even after you apply the patch, as of the time of this blog posting, your system is still vulnerable. To demonstrate, issue this command:

env X='() { (a)=>\’ bash -c “echo date”

You will see error messages similar to:
bash: X: line 1: syntax error near unexpected token `=’
bash: X: line 1: `’
bash: error importing function definition for `X’
Then, to find out if you are vulnerable, look at the contents of the file echo by issuing the command:
cat echo
If the response shows the date, then you are vulnerable:
Fri Sep 26 02:07:16 UTC 2014

To learn more reference CVE-2014-6271 and CVE-2014-7169

Please post your comments below…

The post Shellshock: Check Your Web Server appeared first on Foster Institute.

What if there are virus infections on the outsider’s computer? What if those viruses infect your network?

What if the user performs an illegal behavior using the Internet? The police will come to your office looking for the perpetrator.  If you provide an unsecured wireless network, the suspect may have been outside your business in a truck in the middle of the night when he broke the law using your Internet access.

Take steps to control this including:

• Teach everyone in the organization how dangerous it is to connect unauthorized computers to the network – wired or wireless.
• If the executives agree to deny guest computers all together
  • Have a strong written policy that people sign saying that NO computers will ever be connected to the internet without the IT professional’s prior approval
  • Securely encrypt wireless networks (and if your IT professional still thinks WEP encryption is secure, have them search Google for WEPCRACK sometime)
  • Your IT professionals may choose to use other technology solutions that monitor for unauthorized connections and potentially deny them access such as http://www.laneye.com.
  • Encourage your guests to sign up for their own connections such as Verizon, Sprint, or AT&T broadband access. These connections can be used in almost all populated areas.
• If executives feel they must offer access to guest computers during conference meetings and/or other times
  • IT may implement a form of endpoint security that makes sure the connected laptop meets specific requirements (updates, anti-virus, etc) before being allowed to connect
  • IT may implement password security using, for example, RADIUS or Cisco authentication for guest computers.
  • Put any unprotected wireless access points on a hot tub timer so they turn themselves off automatically after an hour or two.

In addition, I see many IT professionals come up with the idea of signing up for a separate broadband connection such as a DSL or Cable link for the exclusive use of guests for Internet access.  Yes, this will help protect our network from the guest’s computer and is similar to connecting the guest computer to a DMZ so they are outside our firewall.  Keep in mind, however, that the risk is that if the guest (or a program on their computer) performs an illegal act, the police will trace the traffic back to your company either way.

The post Are employees or guests connecting unauthorized computers to your network? appeared first on Foster Institute.