Securing the Corporate Network — Two Simple Things Every PC User Can Do

Fredrick M. Avolio
Avolio Consulting

When I mention "network security," what do you think of? If we wanted to list the top network and computer security mechanisms, what would top your list?

Perhaps you think of Internet firewalls. They are popular, and have been a "must have" for Internet security since the early 1990s. Maybe you envision biometric devices that are coming into more common use: fingerprint scanners, face or voice recognition systems, and the like. Intrusion detection devices, like motion detectors sitting on our network, looking for problem or illegal behavior, are also interesting.

However, in the realm of security, the most important mechanisms are often the simplest, most mundane, and least expensive. For physical information security, for example, this might mean the obvious locking of desks and file cabinets. For electronic information security, two simple mechanisms will do much to help secure the corporate network from attacks and data theft.

Mechanism #1: A Screensaver
A screensaver!?

Bear with me a bit. I believe the FBI and industry studies that say that insiders commit most computer and network crimes. I believe Peter Tippett of the ICSA, when he says, "it is clear to us that the vast majority of inside attacks are ‘opportunity’ attacks where a machine, with the authority of the logged-in user, is used by someone else with the logged-in user’s privilege." (In other words, when a bad guy uses someone’s computer when he is away from his desk).

Given these beliefs, the simplest, easiest, and least expensive thing a PC user can do to help safeguard the corporate network and related data, is to put a password-protected screensaver in place on his desktop. The screensaver should have its timer set to 5 minutes or less. If someone has to break into a PC in order to use it as the base for an attack or for information theft, most of the time the attacker will pass by the PC.

Mechanism #2: Antivirus Software
You probably could have guessed this. But did you know that Antivirus (AV) software is so powerful in its application, that, according to experts, if only 25% of all PCs in an organization (of any size) have AV software correctly installed, configured, and running, on average three or fewer PCs in the entire organization are likely to get infected by a virus before that virus is detected? When we approach 100% coverage, the number of PCs infected falls to zero. Even a 50% coverage statistically leaves us with only an average of 1 infected PC in the whole company before the virus is discovered.

Do observe the caveat used: "correctly installed, configured, and running." We should configure AV software to run constantly "in the background." In other words, it runs all the time and silently, checking for viruses on every virus-prone file that you open and alerting you to viruses it discovers.

Again, quoting Tippett:

The single most important thing an organization can do to address the virus problem is to maximize the use of desktop based, full-time, background protection so that at least 50% of PCs have this kind of protection. Focusing on increasing the number of desktop PCs with full-time background protection is far more productive (in terms of total cost reduction) than any other thing a security manager can do to combat the virus problem.

Simple, Boring, and Inexpensive, Yet Effective
A password-protected screen saver on your PC. Antivirus software for your PC. These are simple, but very effective mechanisms available to every PC user. By making sure AV software is correctly installed and running, and by using a password-protected screensaver with a 5 minute timer, every PC user in the organization can help to dramatically improve the security of the company network and the privacy of the company data.