I participate on a number of listservs and online forums where I always see questions from people about what they should do to protect themselves against the myriad threats to their computer security (this is often off-topic of the forum).  And most often, responses from anyone else follows the line of "I've used _________ and it seems to work good".  Almost no one actually does comparative analysis of various products, and almost no one just tells it like it is.  So I've started doing this on those forums, and here's what I'm telling folks.  The advice below is geared for most people who use a personal computer of the Windows variety, and that is a personal computer, not a corporate computer, nor a Mac.

There's a longer version below, but for most people, a short list works fine.  If you'll trust me, just do this:

1. Replace whatever you are using for computer protection with Norton Internet Security 2010.  It'll cost you $50-75, but once it's done, you can pretty much not worry from then on.  In a year, check back with me, and I'll let you know if there's a better product, but either way, only buy and use the latest version and keep it updated.

2. Use Microsoft Update and if you don't leave your computer on overnight, run it yourself at least once a month.  Take all critical updates and at least look at the recommended updates.  Also run Secunia's Software Inspector (either the OSI or PSI version) monthly and update any programs on your computer that it recommends.

3. Use a password on your Windows User account (and any other Windows User Accounts on your computer system).

4. Use Malwarebyte's free Anti-malware scanner to scan for malware on your system.  Do this every month or so after you've updated the program.

5. Buy yourself a small-size external hard drive (like the Western Digital My Passport 500gb drive) which doesn't need a separate power plug.  Every month or so, plug it into your computer and copy all your personal files to it.  If you can, don't overwrite the old files, copy to a new folder - you may not realize for months that you'd deleted a critical file you want to get back.

6. Secure your wireless network - with WPA if you can, or at least WEP.  And change the name (SSID) of the network and the password to access the control panel for the router and/or access point.

7. If you use an alternative to Internet Explorer (Firefox, Chrome, Safari, Opera, etc.), regularly check for and install the latest version and any updates to that browser.  This doesn't mean you don't have to update Internet Explorer also, continue to do #2 above.

8. Practice safe computing, yourself and anyone else who uses your computer.  Kids especially need to understand that there's stuff out there that will easily negate everything else you've done to protect the computer, and turn it into a paperweight.  Hiring someone to clean up spyware, malware and the like can cost you hundreds of dollars.

Here's an example of one post I made on a listserv (the listserve has nothing to do with computer security):

Subject: Protecting your computer and your internet

A few recent posts on this list-serv that discussed allowing attachments has prompted me to emerge, however briefly, from my status as a lurker.  Along with those posts were several near-off-topic posts talking about computer viruses and the like.  So this post is just a little more off-topic – it’s about your computer’s security.  

If your computer is government-owned or is a corporate/organizational computer that is managed by your employer, this note is not for you.  This note is for the millions of people who own a personal computer and don’t have a tech support department to help them.  And if you have a Mac, this note isn’t for you.  Sorry it’s a bit long, but the subject is not as simple as it used to be, and I am a bit passionate about this issue.  

First off, I am a personal computer professional and have been working with computer security over 20 years.  I have seen and dealt with literally thousands of security issues.  Second, I don’t receive any kickback or compensation for any recommendations I make.  And finally, these are my opinions, everyone is welcome to their own.  I base mine on comparative analysis and testing of the products I recommend, as well as the products I don’t recommend.   So here’s my advice: 

For the majority (in excess of 90%) of personal computer owners, the right way to secure your personal computer is with a high-quality, commercial security suite – and just the latest version they offer.  It costs $50-$75 a year, and is the easiest way to make sure your computer(s) is/are protected with the least work on your part.  If you think you are part of the 10% who should do something else, I suggest you rethink.

Every year, I test the major brands of these suites, and review tests made by other professionals in the field.  I recommend to my clients the top-rated suite, and just a one-year subscription.  After that year is up, I recommend to my clients the top-rated suite for that year – it may be the same brand, it may not be.  This year it is surprisingly Norton Internet Security Suite 2010.  Norton was on my “do-not-use list” for many years, but has finally made a product that works well and neither slows your system down, nor annoys you with pop-up warnings all the time.  I do not recommend any other products in the Norton/Symantec product line.   Other professionals in the field may have their favorites, and recommend them year after year.  I don’t.  I test and review tests every year, and my recommendations change as the products change. 

I base my recommendation on the product that does the best job overall in real-world situations, with current threats.  Some products may be better in specific areas, but I look for best overall protection, geared towards most computer users.  

Having last year’s protection suite is nearly as bad as not having one.  Computer security products must be always upgraded, as the ‘enemy’ is constantly getting these same products and testing them for vulnerabilities, reverse-engineering them, and finding ways to get around them.  If there is an upgrade available for your computer’s security product(s), then you can bet the effectiveness of the one you have on your computer now is pretty low.  

If $50-75 per year is too much money for you to spend, there are free alternatives, but you are trading a small amount of money per year for many hours of your time (plus time and effort it takes to get knowledgeable about how to use these programs).  Recognize that no one product will provide full protection.  Here are some products that will protect your personal computer if you would rather spend time instead of money (but I do not recommend you go this route):

1. http://free.avg.com/us-en/download-avg-anti-virus-free

2. http://www.zonealarm.com/security/en-us/zonealarm-pc-security-free-firewall.htm

3. http://linkscanner.avg.com/ww.sals-why-linkscanner.html

4. http://www.malwarebytes.org/ (download free version)

These vendors also sell security suites that provide more comprehensive protection for your computer.  I don’t recommend those as they don’t do as good a job all-around as the one I do recommend.  

Imho, the ‘free’ approach is highly risky for most people.  The reason is that it takes a lot more time to implement, and to keep up-to-date.  The fact is that almost everybody who uses a computer will not spend the time needed to make all these products work right.  After all, they want to spend their time using their computer!  

If you are at all concerned whether your computer is vulnerable to hackers, here are two sites which provide good, free vulnerability scans:

• https://www.grc.com/x/ne.dll?bh0bkyd2

• http://www.hackerwatch.org/probe/hitme.asp  

If your computer hasn’t been adequately protected, at this point you likely have lots of infections, malware, spyware, trojans, keyloggers, viruses, and other bad stuff.  Sometimes, the only way you'll know you are infected is that a) your computer is slowly and the hard drive runs alot even when you're not using it, or b) you get mysterious activity, popups appear, the computer looks different than when you last used it, you get odd or cryptic error messages, etc.  Both these behaviours can also indicate nothing other than 'Windows rot', but it's more likely something else.

And most protection tools, while good at preventing infections, aren’t as good at removing them after the fact.  If you are in this position, you need to first get, install, and update my recommended suite, and then use it to scan your system and remove infections.  Then, you need to get the latest version of Malwarebytes’ Anti-malware tool from http://www.malwarebytes.org - download, install and update it, then use it to scan your system and remove infections.  Now repeat the scans.  Depending on how bad your system is, you may need other tools and more in-depth scanning and cleaning.

Here are some other things you should know and do:

• If you’ve not been installing Windows Updates (or Microsoft Updates), then you may compromise your computer’s security, regardless of what else you do.

• If you use an alternative web browser (other than Internet Explorer), then you need to keep that one up-to-date as well, or you may compromise your computer’s security, regardless of what else you do.

•  If your Windows user account doesn’t have a password (used to log into Windows every time you start your computer), then you have certainly compromised your computer’s security.

• If you have a wireless home network and have not enabled WPA (or WEP) security, it’s not horrible unless you’ve neglected the other recommendations in this note.  The worst thing is that someone could use your internet connection to surf the web, or maybe print to your printer.  Be aware that wireless networks work line-of-sight, and someone with a specialized antenna/transceiver could tap into your wireless network from quite a ways away.  So if someone is using your internet connection to surf porn, or conduct hacker attacks, you may get an unpleasant visit from law enforcement.  So just enable security and be done with it.  And while you're at it, change the password of your Router and/or Access Point, and also change the name of your wireless network (SSID) - the hackers know all these default settings.

• Practice 'safe computing':  Don't visit risky websites, don't open email file attachments (few exceptions), don't click on email links, don't install programs from the internet (few exceptions), don't respond to spam, don't click on any popup ads or notices (other than to close them), don't let other people use your computer, don't ignore warnings from Norton or Microsoft, and don't ignore this advice!

 And finally, here are a few statistics, facts, and educated opinions for you:

• Over 146 thousand new computers a day are infected with viruses, worms, spyware or malware.

•  An infected computer is usually turned into a “zombie”, and churns out spam, sends out viruses, spyware or malware, and gets sold between hacker gangs like baseball cards.  The owner usually only notices the computer is a bit slower than it used to be, and never knows what’s going on in the background.

•  4 out of 5 computers in the USA have some sort of computer virus, spyware or malware.

•  Straightforward computer viruses are passé, blended threats are the hacker tool of choice now.  A blended threat uses various means to infiltrate your computer, with one method opening the door for another method, and layering junk on your computer to turn it into a zombie.  It may never involve an actual computer ‘virus’.

• A new computer without security protection that is connected to the internet can operate for only a few minutes before a hacker’s vast network of zombies and bot-nets discovers it, and starts to feed it viruses, spyware or malware.

• If you read this far (good for you!) and are wondering about the ‘your internet’ part of the subject line – consider that the internet is a globally-shared resource – and works as well as it does with the cooperation of billions of people who use it.  Only a few are ‘nefarious’, but they are harnessing millions of unwary computer users and leveraging this to have a real and negative effect on your resource.  Consider this when it takes a long time for a web page to pop up, or you have to clean out 90 junk emails from your inbox to read the 10 that you wanted.  If you have a computer, please don't let it become a zombie!

Last word:  Everybody’s got an opinion on this subject, and are welcome to them.  I have had to bite my tongue and not say “I told you so” so many thousands of times, it would be truly comical if it weren’t…just sad.

Want to read old issues?