Security and the Internet

1. Basic Protection

1.1 Physically protect computer equipment.

• Physical access to a computer is the most direct way of getting hold of the information stored on it. It can also be the easiest way to discover how to gain remote access at a later date.
• Portable computers are at particular risk. Consider restricting the information held on them and make employees personally responsible for their own laptops.

1.2 Design your network architecture to control security risks as far as possible.

• Use passwords to restrict inappropriate access across the network (see 2).
• Focus on high-risk information and systems eg confidential and financial information.
• Standardise the configuration of your PCs. Use as few different types of operating system and application as you can.
• As far as possible, isolate or protect computers with direct access to the Internet from the rest of the network. But remember that the benefits of networking computers, to allow employees to share information and access the Internet, often outweigh the security risks.

1.3 Control any point of entry through which viruses or other problem material could enter your system.

• Make sure any material entering your system is automatically checked for viruses.
• Run a regular virus scan of the entire system.
• Keep virus-protection software up to date.

1.4 Create a robust back-up system.

• Set up a procedure for taking regular partial and complete back-ups.
• Store back-ups off-site. Keep them away from heat, moisture and magnetism.
• Have a different tape for each day of the week. Replace tapes every few months.
• Conduct regular tests to make sure you can restore data from your back-ups.
• Make contingency plans for disaster recovery. For example, what would you do if both your system and your back-ups became infected by a delayed-action virus?