Protection From   External and Internal Threats

Answers

1. False

Without password startup protection, an intruder may be able to copy data from your computer's hard drive. While it seems a nuisance to use IDs and passwords every time you start your computer, that minor hassle is worth it when compared to the possibility of having critical business and personal data stolen or deleted by an intruder.

Using your computer's default, administrator account leaves it vulnerable to viruses. Information security specialists often advise using two logins -- one as administrator with full access and another that allows only restricted access. For your daily tasks, you would use the restricted access, which gets you into only those programs you need to work. This helps add protection from the threat of bugs entering your PC, being triggered, and performing whatever malicious tasks they were designed for. You would use the administrator login for adding programs or software purchased from a legitimate and reliable vendor.

2. False

For one thing, UPS batteries generally last just a few years and suppressors become less effective as time passes. At the very least, your company should conduct regularly scheduled inspections and tests, and replace any faulty or weak equipment. UPS batteries are designed basically to allow systems to be shut down safely when power is lost.

"The methods that will most effectively minimize the ability of intruders to compromise information security are comprehensive user training and education. Enacting policies and procedures simply won't suffice." -- Kevin David Mitnick, computer security consultant and author of The Art of Deception,  who served five years on charges related to computer crimes.

3. False

While virtual private networks (VPNs) offer an extremely high degree of protection and are adequate for remote access using a personal laptop, they do not provide protection from threats posed by publicly accessed computers. Computer security specialists report that public networks, such as those in conference hall lounges, are prone to vulnerabilities. As a result, an employee could unwittingly send a virus through your company's VPN.

4. False.

Employees could be violating copyright laws and exposing your business to legal liability. In addition, viruses can piggy back media files to enter your company's network and can even be disguised as media files. Moreover, media files can be quite large and bog down your organization's network. The bottom line: A lax approach toward enforcing the company's AUP can prompt employees to become casual with regard to that policy and other company guidelines as well.

5. False.

IT employees can easily plot ways to take advantage of their knowledge of your company's technology and security. They could plant technological time bombs that detonate after they have left the enterprise and cause major damage, create super passwords that can be used to block access to administrative functions, and make changes that leave the network vulnerable or unusable. Your company should have detailed policies and procedures for the termination of IT employees to prevent last minute scrambling and to enhance the overall security of its network.

6. True.

WPA and wired equivalent privacy (WEP) encryption protect only the link between the remote computer and the point of access. There must be more encryption beyond the access point and through the network path. Specialists recommend adding such encryption as secure sockets layers (SSL) VPN, or secure HTML (SHTML) to bolster security.

7. False.

Antivirus programs may often be in competition, slowing down the network, potentially interfering with each other's purpose, and even delivering false positives when they scan for intrusive software. One antivirus software program is sufficient, but be sure you keep it updated.

8. False.

Years ago, WEP was cracked by hackers. But these days, the encryptions have become more effective and the ability to compromise WEP is far beyond the skills of most hackers. If your network includes older equipment you may have no choice other than to use WEP because in order to use the more complex and secure WPA encryption, every computer on the network must be compatible with it. WEP is not as secure as WPA but it is better than nothing at all. If a security audit shows that your enterprise is a potential windfall for hackers, consider upgrading to equipment that can use WPA.

9. False.

This would be tantamount to issuing a public challenge to invade your organization's system. No matter how airtight you think your security is, no system is absolutely safe from being cracked open. Avoid publicizing your business's high-end security and becoming an irresistible target.

10. True.

The common computer scam of phishing involves sending e-mails that appear to be from a trusted and legitimate source, including an employee or an organization that you do business with. The e-mails direct you to a link that, in reality, take you to legitimate-looking sites that are actually Internet hubs where Trojans or other malicious programs can automatically be installed on computers. Phishing schemes can also involve corporate espionage when they attempt to gain customer information, trade secrets and other confidential data.

Despite the fact this scam has been around for some time, businesses continue to be targeted. For example, executives at AirTran Airlines reported they were sent messages seeking to get them to reveal confidential corporate information, as well as attach malware to their computers. The e-mails got through a filter placed on the airline's computers but was caught by team members and software designed to look for out-of-the-ordinary behavior.

Before clicking on any link in an e-mail, always verify that the individual or company actually sent it. Don't follow directions in an e-mail until you are convinced it is genuine.

There is more to a contingency plan than keeping the network and computers running. In addition to taking the above steps, consider lighting, HVAC systems and other elements that are necessary for a functioning workplace, as well as compliance with laws and regulations.