I read an article discussing how the U.S. government needs to step in to protect people from their computers and various Internet connected devices getting hacked into. Does this person also expect government to protect him from doing stupid things like going up into the mountains and then falling off a cliff? How about from being able to heat a pot of water to boiling and then spilling it on himself? Perhaps the issue is really ignorance and education is what’s needed. Unfortunately, the matter of ignorance runs deep to where there are so called computer consultants who shouldn’t even be setting up their own networks. Just the other day I was helping a friend with his system and found that the router he was connected to at an apartment complex required no login for full administrative access. Let’s look at the issues here:

1. Nobody set the administrative password before, or after, installing the router. There isn’t even a default password.
2. Either the router defaults to allowing remote administrative access or someone enabled it.
3. The router allows remote administrative access even without a password being set.

While the manufacturer can probably be faulted for allowing this scenario to exist, whoever installed this router should either gain an education in computer networking or find a new career. Where did the building manager find this IT person in the first place, and did they not wonder that there is no password required to log into their new router?

While the above scenario does happen frequently, it’s usually the end-users that create their own problems, from connecting their devices without the use of a (secure) router, to running a program that they just received in an email that said it’s funny and they should open it.

Here are some of the most important tips on how to keep your devices secure:

• Use a good NAT router on your home and office networks. Make sure it’s properly password protect and do not enable UPnP. For mobile devices such as laptops, be sure to have a good software firewall running.
• Keep your software updated, especially anything that either accesses the Internet or that you would use to open a document downloaded over the Internet.
• Learn what types of extensions are executables, such as .exe, .msi, .bat, .cmd, .vbs, etc. These should never be run unless you know you can trust them. This doesn’t just mean that they’re coming from a trusted source, but that you were expecting to receive it. Email and other sources can be spoofed.
• Always use secure protocols when a login is required. This means using TLS/SSL for accessing web, email or FTP sites. For web sites your browser will show it’s using https. You would need to check your email client to make sure TLS/SSL is not only enabled, but required. This often requires specific ports to be used.

Following the above basic procedures will go a long way towards keeping your systems secure. Don’t download software from any websites that you aren’t reasonably certain you can trust, and also make sure you uncheck all those boxes during installation that ask if you’d like to install additional software such as toolbars and system scanners.