Attacks are surprisingly common. Virus or worm outbreaks large enough to make the news happen nearly every week and many, many more go unreported except at the Web sites of antivirus software vendors. Corporate firewalls routinely log thousands of probes by hackers every day.

What makes this all the more frustrating is that every time you learn to defend against one kind of attack, hackers seem to come up with new and more creative ways to send spam; hack into your network; spread viruses, worms, and Trojan horses; and perpetrate fraud and destruction of all kinds. And if hackers on the Internet aren't enough to worry about, you also have to worry about your own network users deliberately or inadvertently causing damage.

Although this perpetual onslaught can overwhelm you and make you feel like you're fighting a losing battle, the reality is that with some basic precautions, you can defend your network against the vast majority of threats.

Have a plan
Start by making a security plan. Generally, the larger the network you're administering, the more formalized the plan should be. For a very small network with a dialup connection, the entire plan can be to keep the virus software updated and not to open any suspicious e-mails. A large enterprise network may require a complex, well-choreographed, thoroughly documented plan implemented after a formal risk assessment and analysis of the network.

Your security plan should include:

Education
The first line of defense against security threats from the Internet is education and common sense. Keep on top of the latest hoaxes and viruses and make sure your network users know about them. Teach your network users to be suspicious of and report anything that doesn't look "right."

Be sure network users know never to reply to or forward spam. Hoaxes and scams run rampant across the Internet. Any e-mail that promises money, asks for personal information, asks you to forward or respond to something, or tells you something bad will happen if you don't respond should always be deleted. Reputable companies do not e-mail unsolicited software patches, letters asking for credit card information, or links to Web sites that ask for personal information.

Network users should also not open any unexpected e-mail attachments. Ideally, you should install an antivirus program at your gateway to keep them from ever showing up in the first place; however, a virus filter isn't foolproof. No one should ever open an attachment from anyone they don't know or even an unexpected attachment from someone they do know. Some viruses mail themselves and look like an e-mail from a familiar person.

Warn your network users about bad neighborhoods on the Internet. If they start poking around on sites that offer pornography, gambling, and too-good-to-be true (It just fell off the back of a truck, really?) deals, they're more likely to be exposed to viruses and scams. Although you can use a firewall to deny users access to dubious sites, it's virtually impossible to filter out all of them so network users should be aware that dangerous sites are out there.

Access policies
Be aware that security breaches happen "at home," too. Anyone with network access can steal or damage your data or networking devices. No amount of firewall protection is going to save a server if someone steals it. Take the time to look at who has access to what, keep essential network devices under lock and key, and implement password access to sensitive data.

Software protection
An important line of defense for your network is antivirus software. Buy a well-known brand and update it often. There are two major types of antivirus software: scanners and checksummers.

Scanners, the most popular variety of antivirus software, scan your hard drive or scan each file in real time as it's accessed. Scanners work by comparing files to known viruses. They're easy to use but must be kept up-to-date with the latest virus information to remain effective.

Because viruses change files, checksummers look for these changes to find signs of infection. They have the advantage of detecting unknown viruses that a scanner can't detect; however, they also have trouble distinguishing between legitimate change and a virus infection. Another marked disadvantage of checksummers is that they can only detect infection after it happens-they're useless for virus prevention.

Most antivirus software from major vendors is primarily of the scanner type, some adding checksummers for maximum effectiveness. There is no such thing as ideal antivirus software, and different products have different strengths and weaknesses. For the most effective protection, it's a good idea to use more than one antivirus program.

Antivirus software should be installed at the gateway-where your network meets the Internet, at the server level, and at the desktop. The software at the gateway screens out most infections before they get into your network. Regular scans of hard drives on servers and desktop PCs should pick up the rest. Software on desktop PCs should also be set to scan portable media in order to nab viruses that arrive, not through the network, but on diskettes and CDs.

Firewalls
A firewall controls traffic between two networks. The most common application for a firewall is to control traffic between a private network and the Internet in order to intercept outsiders trying to break into the private network. A firewall exerts this control by applying rules to information-primarily IP addresses and port numbers-found in incoming network packets.

The word firewall is most often used to describe a freestanding firewall appliance that provides intelligent, port-based security, although some low-end firewalls are software based. Services such as NAT, provided by a broadband router, are often also referred to as firewall services.

Hackers probe computer networks for open ports looking for a way in. Your goal is to make sure that unused ports are blocked and that your network only accepts legitimate requests for service. This is where a firewall comes in.

The firewall blocks unwanted traffic while letting through the traffic you want. It makes decisions that allow or deny access to services and ports on your firewall.

If your network includes Web servers, FTP servers, or mail servers that are regularly accessed from the Internet, it's a good idea to isolate these public servers from your private network in a DMZ. A DMZ is a separate network that's home for your public servers.

Both users from the Internet and users from the secure network may access servers in the DMZ. Traffic may not travel from the Internet or DMZ directly to the secure network without first going through a proxy server (usually a firewall appliance).

The dual-homed gateway firewall serves as a secure point of control between these two network segments and the Internet, intercepting all traffic between the Internet and your secure site and screening all services and access through proxy servers on the firewall.

This kind of firewall has the advantage of being both simple to set up and very secure. Many firewalls are specifically designed to support the dual-homed-gateway configuration and offer a convenient way to set up a DMZ, even in a very small network.

Dual-homed gateway firewalls tend to be rather inflexible, but they have the advantage of being easily managed by nearly anyone with basic networking skills. This makes them a popular choice with administrators of small-to-medium-sized networks who must have an e-mail and a Web server open to the Internet while at the same time protecting a secure, private network.

Backup and recovery
It's easier and less expensive to prevent problems before they happen, but even in well-defended networks, you have to assume that eventually the unthinkable will happen-destroyed or lost files, equipment failure, or outright theft-to bring you down.

Back up your files on a regular basis so if your network is invaded, you can replace corrupt or infected files with your backup copies. With regular nightly backups, even the worst disaster will never cause the loss of more than a day's data. Backup copies should always be stored on hard media in a separate location-NOT on a server connected to the network.

Have a plan to cover unexpected disaster. In the case of a virus infection, you should have a clear plan for disinfecting PCs and restoring data. If anything is absolutely mission critical, you should even have a plan in place for quickly replacing hardware that goes offline for purely mechanical reasons.

To talk to Tech Support, please call us at 055 451 70 71 or use our free of charge Callback Service.