The threat of online security: How safe is our data?

As Information Technology becoming more important in our life for providing services like general knowledge, transactions and gaming, it has since became a target for many threats. Viruses and hackers has been long became a threat to computer softwares and internet tools create doubts about the credibility of companies that provided services with those tools. Many reports have been lodged regarding data losses, account cloning, phishing and so forth are all due to expanding of cyber criminals.

Criminals might use traditional method of stealing a computer and access through the datas to obtain relevant informations that benefited them or more high tech way of stealing the datas through computer languages softwares like SQL, C++ or many more. Those without authorized keylock are of course more vulnerable to stolen datas reported because it enables anyone to accessing it. This is why many organizations provide intranet services requiring the users to use their ID and passwords often alphanumerical to create more secured environment from data theft. From my opinion, these are not enough because even with a secured password, still there are hackers that may log in and steal the datas like what has happened to many clone credit cards reported during the 2001 to 2002 from Malaysian banks. Thus, it is recommended that organizations that operated web based to have SSL encrypted as a matter of trust to users.

Online downloading is often an area to spread viruses and is a favorite target for hackers to insert spywares. Such sites are mostly porn sites and unapproved downloading sites because they did not include certificates authentication. Easily a hacker can place malicious worms in the softwares fro downloads by users. As a result, program failures often reported due to the worms like trojans and other bugs. Furthermore, some viruses are too powerful it can crack into important documents and steal the datas.

Therefore, it is more important that we learn how to safeguard our data. These are important steps to secure our computer from data theft:

First, User Account is more important to unable unauthorized people to log in your computer. First method of preventing data duplication and theft. It is also recommended that for different users, you create different accounts if the organization is large.

Second, it is important to ensure what anti virus are you using and is it firewalled to disable unwanted programs to penetrate into our computer. Anti virus must be updated and properly licensed to avoid breakdowns. It is recommended that you use latest Anti Virus such as AVG 8.0 rather than older versions because more functions are added and stronger to protect the computer systems.

Third, scanning the computer is essential. Regular scan is recommended to avoid unauthorized data to be stored that probably contained virus or corrupted files in the storage. I'm sure more computers are provided the Rootkit Revealer software that can detect malicious activities in the computer. Remember to scan pendrives or disks before opening to avoid virus contained files

Fourth, try to avoid unused software or programs because they might be corrupted if no longer used. Uninstall them if those programs are no longer necessary in use.

Fifth, Windows Update is recommended to be turned on. Important updates can help protect the computer from attackers so that they have disadvantage to known vulnerabilities.

Sixth, put up your rules as guideline so that there will be no unwanted activities on your computer systems. As example, UTAR put up a signboard that warned on step by step shutdown of computer. Children Safe Online is also a guideline to data protection and also adopted by Live Messenger such as Family Care software.

Next, you are recommended to use password and manage the authorization on important datas. This is useful if your computer are used openly by many parties. To safeguard the data, you may set the security level, hide the folder, encrypt or manage password.

Lastly, what is more important is not to give out important informations like Personal ID, PIN number and account informations especially when doing online transactions. Make sure the websites you've visited contained approved licensed and certificates such as VeriSign stamp in http://www.maybank2u.com/. Some websites provide trust because of SSL encryption in it.

Related link(s):
http://www.wisegeek.com/what-are-the-primary-online-security-threats.htm
http://www.guard-privacy-and-online-security.com/

The application of 3rd Party certification program in Malaysia

One way to control threats from active content is to use digital certificates. A digital certificate is an attachment to an e-mail message or a program embedded in a Web page that verifies that the sender or web site is who or what it claims to be. In addition, the digital certificate contains a means to send an encrypted message (encoded so other can’t read it) to the entity that sent the original web page or e-mail message. In a case of a downloaded program containing a digital certificate, the encrypted message identifies the software publisher and indicates whether the certificate has expired or is still valid. The digital certificate is a signed message or code. Signed code or messages provide proof that the holder is the person identified by the certificate. The idea behind certificates is like that if the user trusts the software developer, signed software can be trusted because, as proven by the certificate, it came from that trusted developer.

Digital certificates are used for many different types of online transactions, including e-commerce, e-mail, and e-funds transfers. A digital ID verifies a Web site to shopper and optionally, identifies a shopper to a Web site. Web browsers or e-mail programs exchange digital certificates automatically and invisibly when requested to validate the identity of each party involved in a transaction.

Digital certificate for software is an assurance that the software was created by a specific company. Digital certificates are issued by a certification authority (C.A). A CA can issue digital certificates to organizations or individuals. A Ca requires entities applying for digital certificates to supply appropriate proof of identity. Once the CA is satisfied, it issues a certificate.

Certificates are classified as low, medium, or high assurance, based largely on the identification requirements imposed on the certificate seekers. The fees charged by CAs vary with the level of assurance provided; higher levels of assurance are more expensive.

Two of the most commonly used CAs are Thawte and VeriSign, but other companies such as Entrust and Equifax secure also offer CA services. The digital certificate for Amozon.com was issued by VeriSign.

VeriSign is an American company based in Mountain View, California that operates a diverse array of network infrastructure, including two of the Internet’s thirteen root nameservers, the generic top-level domains for .com and .net, one of the largest SS7 signaling networks in North America, and the RFID directory for EPCGlobal. VeriSign also provides a variety of security and telecom services ranging from digital certificates, payments processing, and managed firewalls to mobile call roaming, toll-free call database queries and downloadable digital content for mobile devices. The company groups all of these functions under the banner of 'intelligent infrastructure' services.

The company's former payment processing service was sold to eBay in 2005.

Related Links:
1.http://www.verisign.com/
2.http://en.wikipedia.org/wiki/VeriSign
3.http://registrar.verisign-grs.com/whois/

A review on a post on Internet Security from my E-Commerce Blog

This review is for the e-commerze blog post titled “Organisations Not Doing Enough to Secure Data” It can be noticed from the e-commerze blog post that supposedly a new survey shows organizations are not doing enough to prevent data breaches related to IT and the loss of “sensitive” data. It is true indeed that organizations hold a steadfast responsibility in safeguarding data. However, they cannot be blamed outright for the lack of data breaches prevention. It must be noted that to prevent data breaches is not an organization’s duty alone. Every other users are also responsible for this.

We must take into consideration that hackers nowadays are getting smarter and are finding more ways than other to hack and steal valuable data. It is not an easy task to step up the data breaches prevention because it involves a huge amount of money to be carried out effectively. Everyone’s cooperation is a valuable contribution towards fighting these cyber criminals and combat data breaches.

The figures shown in the post might be shocking for some but that is the truth and we have to accept the fact sooner or later. For example, a total of 94 percent of respondents reported having no visibility into how many e-mail messages containing confidential or private information were leaving their organization each month or believed that some leaks were occurring. This ignorance causes hackers to act more bravely and take their chance when no one is lurking around.

How To Safeguard Our Personal And Financial Data

Password-protect your access - Use a strong password or pass-phrase to protect access to your data.

Limit transportation and transmission of data - Refrain from transporting or transmitting sensitive/confidential data if you don't need to do so. For example, don't allow your sensitive/confidential data to be sent via email or removed on a USB stick unless there is a clear need. When you do transport or transmit it, ensure that it has an appropriate level of security.

Limit physical access - Whenever possible, store sensitive/confidential data on devices that are physically secured. Allow only authorized individuals access to those devices, and monitor access to those devices whenever possible.

Temporary data storage - If you need to store sensitive/confidential data temporarily on a memory stick, laptop, or other device, remove that data from the device when you have finished. Ensure that data has been completely erased and not just deleted. Be sure to only use the method or tool your organization has approved.

Use and maintain anti-virus software and a firewall - Protect yourself against viruses and Trojan horses that may steal or modify the data on your own computer and leave you vulnerable by using anti-virus software and a firewall. Make sure to keep your virus definitions up to date.

Regularly scan your computer for spyware - Spyware or adware hidden in software programs may affect the performance of your computer and give attackers access to your data. Use a legitimate anti-spyware program to scan your computer and remove any of these files.

Related links :

http://www.msisac.org/awareness/news/2007-03.cfm

Phishing: Examples and its preventation methods

Phishing is the process of attemptingto criminally and fraudulently obtain sensitive information, by acting as a trustworthy entity in an electronic communication. PayPal, eBay and online banks are common targets. Phishing is typically carried out by e-mail and often directs the user to visit a Web sitea where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is falsified and set up only to steal the user’s information.

For example, 2003 the increasingly in a phishing that users received e-mails supposedly from eBay claiming that the user’s account was about to be suspended unless he clicked on the provided link and updated the credit card information that the genuine eBay already had. Unfortunately, up to 20% of unsuspecting recipients may respond to them and thinking they were actually being contacted by eBay and were subsequently going to eBay’s site to update their account information. This is because the e-mail looks official, and finally users being cheated and resulting in financial losses.

There are several different techniques to prevent or protect against phishing. One strategy to prevent phishing is to train users to recognize phishing attempts, and to deal with them. Users can be trained to have their suspicion aroused if the message does not contain any specific personal information. In addition, users can take steps to avoid phishing attempts by slightly modifying their browsing habits. When contacted about an account needing to be "verified" (or any other topic used by phishers), it is a sensible precaution to contact the company from which the e-mail apparently originates to check that the e-mail is legitimate. Alternatively, the address that the individual knows is the company's genuine website can be typed into the address bar of the browser, rather than trusting any hyperlinks in the suspected phishing message.

Another popular strategy to prevent phishing is to maintain a list of known phishing sites and to check websites against the list. Microsoft's Internet Explorer 7 brower, Mozilla Firefox 2.0 and Opera all contain this type of anti-phishing measure. Firefox 2 uses Google uses anti-phishing software. Opera 9.1 uses live blacklists from Phish Tank and GeoTrust, as well as live whitelists from GeoTrust. Some implementations of this approach send the visited URLs to a central service to be checked, which has raised concerns about privacy. According to a report by Mozilla in late 2006, Firefox 2 was found to be more effective than Microsoft's Internet Explorer 7 at detecting fraudulent sites in a study by an independent software testing company.

Related Link:
1.http://en.wikipedia.org/wiki/Phishing
2.http://www.antiphishing.org/
3.http://www.webopedia.com/TERM/p/phishing.html
4.http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci916037,00.html