CPRC

Operating System and Updates:

Keep your operating system up to date.

Operating systems, like Windows XP and Macintosh OS X, are made up of countless parts with different functions ideally working in harmony. That some of these parts should be less than perfect is inevitable. But when a problem leaves a hole in your machine's defenses, it is extremely important to patch it as soon as possible. This is best accomplished by using built-in automatic update features through the Windows Security Center in Windows XP, Automatic Updates control panel in earlier versions of Windows, and the Software Update application in Macintosh OS X under System Properties. Keep in mind that your machine may need to be restarted after you update

Windows Update is a program used to update the Windows operating system.  If you do not install the critical Windows Update files immediately after they are released, your computer will be compromised by a worm that takes advantage of vulnerabilities in Windows. The easiest way to make sure you do all the necessary updates is to set your computer to download the updates automatically.

Instructions for setting Windows Update to download updates automatically

For Detailed Instructions please visit: http://www.columbia.edu/acis/security/articles/data/windowsupdate.html

Configuring Windows XP with Service Pack 2 for Automatic Updates

1. First, go to the Control Panel. This can be reached by clicking on the Start button, most often found at the bottom left of your screen, and choosing either Control Panel or Settings and then Control Panel.
2. Choose Security Center. This will show up regardless of your Control Panel display choices.
3. When the Security Center appears, look to the bottom section, under Manage security settings for: and choose Automatic Updates.
4. If your machine stays on all night, choose Automatic. If not, choose Download updates for me, but let me choose when to install them. If you choose the second, you must be on the lookout for warnings appearing on the taskbar calling for your attention. When you are informed that updates are ready to install, you must do so.
5. Click OK at the bottom of the window to finish.

Configuring Windows XP for Automatic Updates

1. First find the My Computer icon. It will be either on the desktop or in the Start menu (reached by clicking on the Start button, most often found at the bottom left of your screen).
2. Click with the right-hand mouse button on the My Computer icon and then click with the left-hand mouse button on Properties. This should bring up a window called System Properties.
3. In the System Properties window click on the tab labeled Automatic Updates, located near the top of the window.
4. Click to place a check mark in the box labeled Keep my computer up to date.
5. Then in the Settings section, choose Download the updates automatically and notify me when they are ready to be installed.
6. Click OK at the bottom of the window to finish.

Configuring Windows 2000 for Automatic Updates

1. Click with the left-hand mouse button on the Start button (most often found at the bottom left of your screen), select Settings and then Control Panel.
2. Double-click with the left-hand mouse button on the Automatic Updates icon.
3. Click to place a check mark in the box labeled Keep my computer up to date.
4. In the Settings section, choose Download the updates automatically and notify me when they are ready to be installed.
5. Click OK at the bottom of the window to finish.

Every time Windows finds new updates, you will see a notification message in the lower right-hand corner of the screen that new updates are ready to be installed. Do not ignore the Windows update message! Just say yes and allow the installation to proceed. After the installation is complete, you will be prompted to close down and restart your computer.

For Macintosh Users:

These days Macintosh users do not have nearly as many virus problems as Windows users, but you still need to take proper precautions to keep your computer safe. You can read about the built-in security features of OS X on Apple's Web site.

• Don't ignore Software Update when it wants you to install updates on your Macintosh, especially security updates.
• Turn on OS X's built-in firewall.
• Select a secure password for your Macintosh that is different from the password you set on your UNI.
• Download Symantec AntiVirus (for free!) and set it to update automatically. You will need your UNI and password to do this.
• Scan for and remove any viruses found on your computer.
• Remember to bring original CDs for your OS and applications. CUIT cannot supply you with these items.
• Develop a strategy for backing up your files regularly. Apple's online Knowledgebase has information you may find useful.
• Educate yourself about safe computing practices

For more information please visit CUIT’s website: http://www.columbia.edu/acis/support/sec-checklist.html

Updating software programs To update a specific program, there's usually a "check for updates" option under its Help menu or you can search the company's web site. You may also be prompted by the software when it opens or closes if an automatic update feature is enabled.

Am I Logged in with Administrative Rights? To check your login rights on a Windows XP computer, right-click on the Start button in the lower left corner of your computer screen. If you see an option to "Open All Users", you have administrative rights and should change your login via the Control Panel - User Accounts option, or contact the IT group that manages your work computer to advise them. If you only see "Open", you are not logged in as an administrator. Windows Vista and Macintosh systems will prompt for an administrative password before installing a program or changing advanced settings on a computer. If you are prompted for an administrative password but did not intend to install or change computer settings, do not enter one!

More about updates and patches:

• Microsoft updates are categorized by the severity of any security risk they patch, if they are released for this purpose. It is very important that updates marked critical be installed as soon as possible to protect your computer and data from malicious people or programs. Even if you are running other security programs such as antivirus, antispyware and firewalls, an exploit related to a critical upgrade could cause problems on your computer. Details regarding individual Microsoft updates can be found at: http://www.microsoft.com/athome/security/update/bulletins/default.mspx
• Microsoft releases most of its updates and patches on the second Tuesday of every month. If your Windows Update feature is turned on you should receive these automatically.
• Microsoft Service Packs are large bundles of upgrades and patches. Since they must make a number of changes to the Operating System, it is a good idea to back up your data before installing a Service Pack.
• OS and program updates are often not actually required to continue running the computer or program, some may add features that don't necessarily care about. If you do not have the time to find out why the update was released, it is best that you install it anyway in case it fixes a security issue.

Email Security:

Email will always be targeted as a means to attack computers and access data, since it can be the fastest way to trick the computer user. The three major email security issues are outlined below, with instructions on to how to recognize and handle any problematic messages or attachments that show up in your inbox.

• Viruses Opening an email attachment is still one of the most common ways that computers can become infected with a virus. Always take these precautions when you receive an email with a file attached:
  • Do not open the attachment unless you are 100% positive that the sender intended you to have it. - Viruses often spread themselves by using the email account on a computer they infect. - Viruses can "spoof" or mimic an email address so it appears to be coming from someone you know.
  • Be especially wary of any messages that have nonspecific text. - Messages with vague subjects such as "Here's that file you requested" should not be trusted. - A message that addresses you by name shouldn't be trusted either, since this can be determined from someone's address book or other means. - Content stressing urgency is often an attempt to keep you from being cautious. This is often used for phishing scams as well as a way to spread viruses and other malware.
  • Before opening any email attachments, save them on your computer and then scan them with your antivirus software. - Saving an attachment does not put your computer at risk, just make sure you do not open it before scanning. - To scan a file with Columbia's Symantec AntiVirus, right-click on the file's icon (command-click from a Mac) and select "Scan for viruses".
• Phishing Email messages that urge you to click on a link to change your password, verify account information, or otherwise give out personal information should not be trusted. These phishing messages often look as if they come from a valid company, but the sites they take you to are phony and can be used for identity theft. After a huge increase in phishing scams over the past few years, businesses that offer online accounts rarely ask for this type of account related information in an urgent email message. If you suspect that you've received a phishing message but are concerned about the online account it references, go to the company's main site by typing their web site address into your browser directly (for example, "www.ebay.com" or "www.citibank.com") rather than using a link within the email. For more information please see CUIT Security's page on Phishing Scams and Spam.
• Spam Columbia's mail servers are programmed to block as much spam as possible, but spammers constantly update their methods of bypassing spam filters to flood your mailbox. It may not be possible to stop any spam from hitting your account, but here are some things you can do to cut back on the amount you receive:
  • Use a "throwaway" email address to sign up for freebies or create an account on web sites. Many sites that require an email address for you to access information or download free programs don't necessarily care about protecting your privacy. Use a free yahoo, hotmail or other account in these instances instead. Once an email address is "out in the wild", your chances of receiving spam increase exponentially.
  • Use spam filters on your email program and account. - Almost all email programs have settings you can adjust to detect spam or junk mail. Configuring them can vary from program to program, so it's best to check the Help menu for detailed information. - You can set filters for your Columbia account by logging into the myUNI site and selecting the "Email Filters" link, or click here for detailed instructions on setting filters.
  • Don't open or reply to junk mail or spam. - Spammers increase the likelihood of making money from their junk messages if they're able to verify that they've reached active email account. - Simply opening a message can notify a spammer that your account is valid. The message can contain an image that isn't requested from the spammer's server until you open it, or set a cookie, or run a script within the message. Many email programs now have these features disabled by default, but it's a good idea to check the program's setting - or just delete any spam without opening it. - If you reply to a message with the intention of opting out of what appears to be an email list, you can end up getting more spam. Don't opt out or unsubscribe unless you're sure you subscribed in the first place, or know and trust the institution that sent you a list message.

File Sharing Programs

Most filesharing networks are used for moving large amounts of content that people can't legally have without a purchased copy. Getting caught receiving or distributing copyright protected content by its owner could mean a lawsuit, and would definitely not go over well with your dean or your department.

Although no one at Columbia is monitoring the content of what is uploaded and downloaded through its network, it's very easy for copyright owners and their agents to join the filesharing network and collect that information themselves.

The programs and networks themselves present security risks. The programs often come packaged with spyware, and the networks are congested with viruses pretending to be popular songs or movies.

For more information on Computer Security contact Abhishek Joshi (212) 851-2229 or email aj2358@columbia.edu.  You can also visit CUIT website: http://www.columbia.edu/acis/security/users/filesharing.html