Category Archives: Site Security

Antivirus Software…Educate Yourself

Today’s computer users are for the most part unaware that their computers come prepackaged with Antivirus Software that they can use to keep their computers safe from things like malware, spyware and even those nasty little viruses that seem to find their way onto a computer no matter what you do. Even those that are aware such software exists on their machines rarely know how to utilize them. I have often wondered, especially since most computers come with a limited trial version of a paid program, whether or not the companies that publish these programs want their users to have any success when using their applications.

All to often Antivirus Software is, for the average user, difficult to operate and is often left un-updated due to a general lack of education and knowledge about the product. In order to keep these programs functional they need to be updated on a regular basis so that they can detect and remove threats as well as keep your computers safe from things like zero day attacks and whatnot. Sadly a user aware that they do have such applications at hand find that updating the program is far to complex and will therefore allow the program to remain out of date, rendering the program useless.

This causes users to encounter and have multiple problems with viruses and the ever annoying spyware that’s always waiting to infect an unsuspecting, and unprotected computer. In extreme cases some of these people will become victims of data file theft or in a worst case scenario, identity theft. It is for these reasons that one can only hope that antivirus programs become easier to use at some point in time.

As a person who fancies himself tech savvy I’d like to see antivirus software become much more user friendly if for no other reason that to give me a break from the monotony of ridding family members computers of infections. This has consumed more than just a few weekends of my time and I’d like to see something get published that has an easy to navigate user interface and updates just as easily. I’d also like to see publishers begin polling average people to determine what their true level of computer knowledge is. It is my opinion that this would allow them to see very clearly just how difficult it is to use some of these antivirus programs.

There is another side of me that believes partial blame must lie with those who buy computers. You don’t buy a car before you know how to drive or even before you have plans to learn to drive. I’d like to see this same rule applied to the world of computers, especially since they have now become common place in the home. It is very rare that I see anyone, even my own family members ask for help in learning how to operate a program, or with desire to learn more about their machines and how to keep them safe.

In actuality I’m surprised by the languid approach both sides have taken as threats to computers and private information is so high these days that there is rarely a day when you don’t read about some type of new threat or about someone who had their files and/or their identity stolen. Let’s face it if you’re operating a computer without being at least semi-proficient with an antivirus application you’re going to be in trouble. Even if your identity is never stolen you will likely still encounter all the problems caused by spyware and malware. In most cases your computers processing power and memory will be eaten up by these nuisances and causes you many a headache.

If you’re a computer novice or find that you’re just not to comfortable around things like antivirus programs then take the time to educate yourself so that you can protect not just your machine but your data and files as well. If you’re on the other side of the fence and are a publisher of antivirus software find ways to keep the high level of functionality you currently have all the while keeping in mind that not everyone who uses your products are going to know what they’re doing. Easy to use and comprehensive security measures are the way to go.

Proper Data Security And Storage Methods (Page 1 of 2)

The PCI DSS (Payment Card Industry Data Security Standard) requires that any merchant who accepts, processes, stores, transmits sensitive credit card information must do everything possible to protect and guard that data. Proper data security and storage, however, can be a difficult thing to do in-house.

Data security and storage comprise a major portion of the PCI DSS and is also a necessary part of maintaining trust with your customers. In an age where personal information is a valuable commodity, customers need to know that their transactions are secure and you have a priority on guarding their personal data.

The third requirement of the PCI DSS states simply: “Protect stored cardholder data.” This may be a simple thing to say, but that doesn’t necessarily make it an easy thing to implement, nor does it downplay the importance. There are quite a few individual security controls that are required before you can say that you have created the proper data security and storage environment.

The first step is encryption. If you must store sensitive information on your own system you must encrypt it. This is a basic step because if a criminal intruder should happen to bypass all the other security measures that are in place, all they will find on your system are strings of random gibberish that are useless without the encryption key.

The next step is to limit the amount of cardholder data on your system. This includes only keeping the data that is absolutely necessary for legal, business, or regulatory purposes. When you don’t need it anymore, get rid of it. The less you have that is worth stealing, the less of a target you become. There are also a few things you’re not allowed to store at all. These include the full contents of any track from the magnetic stripe (like the card verification code or PIN verification value), or the three or four digit validation codes or personal identification numbers.

Of course, even if you’ve taken the steps to electronically protect data by encrypting it, there’s still the possibility that someone inside the company could steal or wrongfully employ the encryption keys. For that reason, the third requirement of the PCI DSS also mandates protecting those keys against misuse and disclosure.

Access to these keys must be restricted to the fewest number of people possible. These keys must also be stored in as few places as possible. Backups are, of course, necessary, but if you end up backing it up in too many places, you’re likely to forget where they all are, or accidentally place one where someone with criminal intentions can get a hold of it.

Requirement numbers seven, eight, and nine also deal with limiting physical access to cardholder data. These mandate that you restrict access to this data by to business need-to-know, and that you assign unique IDs to each person with computer access. These are measures that help ensure that you can trace the source of your problem, should a breach occur.