TIPS & TRICKS: Improve the Security of a New Computer

Often, I field questions about how to protect a computer, especially when it's brand new. I've often given customized advice to people, depending on their current environment. But, I get the questions enough that I considered composing a document that outlines this information.

Fortunately, I have (and, so have you) paid for someone else to compose this document for us:

http://www.us-cert.gov/security-publications/ten-ways-improve-security-new-computer

This federal government site has a wealth of information, including this well-written document, on how to secure your computer from the bad guys. There's lots of ways to protect your new computer from getting compromised, but this document provides a great baseline for everyone to follow.

Besides the steps outlined in this document, I would also add that setting up a new machine is a perfect time to also setup a solid backup solution and consider encrypting the hard drive in your computer, especially if it's a notebook that gets lots of miles.

TIPS & TRICKS: Browser and Other Security Tests

With all the recent 0-day exploits and other vulnerabilities making news, I thought it would be helpful to have some resources to test out your environment.

First, browser security checks:

• http://www.isjavaexploitable.com
• https://browsercheck.qualys.com

Next, router and computer security checks:

•  Use ShieldsUP! and the Instant UPnP Exposure Test at this site: https://www.grc.com/

As always, security is like an onion. A well secured computing environment will have lots of layers. These tools are another layer of protection.

TIPS & TRICKS: Google Chrome, Windows 7, and Last Window Placement

If you know me, you'll know that I routinely use private browsing all the time. I don't care to have the browser remember any of my personal data or what sites I've visited. If I really wanted to remember something, then I will bookmark or blog the page. This means that when I use Google Chrome, I'm using its Incognito mode all the time.

One drawback to Incognito is that it also doesn't remember the screen location of the last window you used. In other words, I want the Incognito Chrome window to open in the same place on my screen every time I open a new window. This is actually a good feature because Incognito's purpose is to remember NOTHING. This should also include locally stored settings like screen location.

To get the window to open in the same place, just open a normal Chrome window, move it to the place you want it, close that normal window. Next time an Incognito window is opened, it should open in the last location where the normal window was closed.

Happy Computing.

TIPS & TRICKS: Denying Access to Browsers for Specific Users

Had an interesting request about denying internet access to a particular user account on a Windows machine. This exercise showed me again that is usually more than one way to accomplish something. The first hurdle was that this needed to be done on different versions of Windows. It was already done on a Windows XP machine via NTFS permissions. I had to find a way to do it on Windows Vista Home Premium and Windows 7 Enterprise.

On Windows Vista Home Premium (HP), the process was actually fairly easy. Windows Vista HP has Parental Controls in it, which helped us accomplish our goal. Specifically, it was the Vista Web Filtering tools built-in to the Parental Controls. First, turn on the Parental Controls found in Control Panel. Next click through to the Web Filtering tool and enable the sites allowed option. The key to make this work is to make sure to NOT list any sites to be allowed. This will block all connections via a web browser. What's more, I tested this through Firefox in the account controlled by Parental Controls as well and it worked too.

Windows 7 did away with the Web Filter tools in Parental Controls. Had to find another way to do it. A Google search yielded the path of using a proxy address to control the flow. The nice thing about this solution is that proxy configurations are now user-specific, which means it only affects the one user and not all users. Here are the steps:
1. While in the user account that needs to be limited, setup a proxy server address in Internet Options > Connections > LAN settings. I used 127.0.0.1.

2. Log out and login to an account with administrative access.

3. Launch Local Group Policy Editor (gpedit.msc).

4. Under User Configuration > Administrative Templates > Windows Components > Internet Explorer > Browser Menus, enable the Tools menu: Disable Internet Options... menu option. This will disable access to Internet Options from Internet Explorer.

5. In the same window for Local Group Policy Editor, go to User Configuration > Administrative Templates and click on Control Panel.

6. Open the option for Hide specified Control Panel items and enable it. Then click on the Show button.

7. In a blank field under the Value column, type in Microsoft.InternetOptions. This disables access to the Internet Options area from the Windows Control Panel.

8. Hit OK, OK, and close out the Local Group Policy Editor.


A few pertinent notes here: we were only concerned with blocking browser access. There are, of course, other ways to get connected, but that's a task for another day. Also, these machines were not joined to any domain, only setup as stand-alone machines. Finally, the locking out of Internet Options at the Internet Explorer level and the Control Panel level is effective for all users, unlike the proxy setting that only affects the one user. Also, always make sure to test before deploying.

Update (2012_02_02): Before locking out Internet Options, check this setting. In Internet Options > Connections > LAN Settings, make sure to uncheck Automatically detect settings. This ensures that the proxy settings are used every time (Thanks to my colleague, Erin for pointing this out.)

Happy Computing.