Computer Security for the Home and Small Office 146
| Computer Security for the Home and Small Office | |
| author | Thomas C. Greene |
| pages | 405 |
| publisher | Apress |
| rating | 9 |
| reviewer | Andrew Murphy |
| ISBN | 1590593162 |
| summary | No secrets means that open source software, when it survives, tends toward robustness -- so it can help even if you run a closed-source operating system. |
The book covers popular OSs replacements for Windows applications and utilities; it explains vulnerabilities; it offers practical setup information for both Windows and Linux to harden a system and make it extremely difficult to attack.
The Preface describes the book in general terms. The Introduction explains firewalls and their limitations, and explains how to install Mozilla to limit email and http exploits and spam.
Chapter One debunks the malicious-hacker mythology and shows that most so-called hackers are only script kiddies who are easily thwarted with commonsense tactics.
Chapter Two explains malware, spyware, bad system configurations, and the scores of other routes to system exploitation and privacy invasion that firewalls and antivirus software don't address. It includes a step-by-step guide to simplifying and hardening a system. Most importantly, it offers a useful guide to turning off unnecessary services and networking components for both Windows and Linux, and setting sensible user permissions, and is liberally illustrated with screen shots.
Chapter Three offers a good breakdown of social engineering and phishing scams, and how to defend against them.
Chapter Four is about using common tools, like Ethereal, Netstat, PGP, etc. It explains how to monitor an Internet connection to spot software secretly reaching out or phoning home to remote servers; how to monitor your system for signs of malicious processes; and how to use PGP and GnuPG to encrypt sensitive files and Internet correspondence. This is one of the best introductions to using encryption available anywhere.
Chapter Five explains how to eliminate all traces of Web activity from your computer and defeat forensic recovery of stored data; how to surf the Web anonymously using an encrypted connection and defeat remote monitoring; how to set up and use SSH (SecureShell) to conceal both your identity, and the data content of your Internet sessions from all third parties, including your ISP. The many hiding places of sensitive or incriminating data are revealed for both Windows and Linux users.
Chapter Six explains the advantages and disadvantages of migrating from Windows to Linux; why Linux is easier to configure for security, and why it's better suited to less technically-inclined users; how to judge whether Linux is right for you, and the issues you should consider before migrating. The author is clearly biased towards Linux, but he understands that most users will stick with Windows. Hence the emphasis on tools that run on Windows.
Chapter Seven is a catchall essay explaining security from an anecdotal point of view. There were places where it got a bit tedious, but the idea is to look at security as a process or a frame of mind, not a specific series of computer settings. The material in this section is informative in only a general sense. The real configuration information comes in chapters Two, Four, and Five.
There are several indexes with useful information on firewalls, ports, Trojan activity, sources of information, and more. Most of this information is conveniently located and linked at the author's website, BasicSec.org
Overall, the book is exceptionally well written for a tech manual. The author is a good writer and his prose flows nicely. The book is highly readable, and even witty in parts. I found myself laughing aloud on several occasions. The author has the art of The Register's irreverent presentation. I enjoyed reading it. But it is not perfect, so I give it a 9 out of 10.
My biggest criticism is that the book shifts back and forth from practice to theory and back again. It's good that readers learn the reasons for the (very sensible) procedures and settings listed; but I felt that the book was organized wrong. This is a minor issue, and the book remains exceptionally useful; but instead of interlacing the various parts, theory and practice might better have been separated in two distinct sections. It's difficult simply to flip to a section of this book and learn what needs to be done: there is a lot of theoretical talk between each practical item. It's very good talk, and very instructive talk, all right, but I would have preferred that it be located in a particular place. I would rather not have to read the entire book through in order to tweak my system for good security. Unfortunately, the author has structured the book so that a read-through is necessary.
Overall, this book will tell professionals what they need to do, and novices everything that professionals ought to know, but probably don't. It's in plain English, so no one should worry that they can't grasp it. You can make your computer, or your network, very hard to attack, whether you use Windows or Linux. This book will show you how in excellent detail. You've got to read the whole thing, unfortunately -- but it will work nicely for you, casual user and sysadmin alike.
You can purchase Computer Security for the Home and Small Office from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.
i'll be buying several copies... (Score:5, Interesting)
And save your breath about whether or not it's my job to answer such questions. I probably don't work where you do.
something missing here... (Score:5, Interesting)
While I agree that novices probably ought to know a lot of the topics covered, there is something fundamentally missing when many (most?) novices still barely realize they have an alternative to using Windows. I interface with lots of people who basically think you have two choices - owning "a computer", or owning "a Mac" (as though owning a Mac wasn't a real computer).
The bigger problem, aside from addressing security problems, is educating the general public that they have choices, and there are different security impacts based on your choices. We live in a world where hundreds of thousands of Windows users don't even know about Windows Update, which is arguably the simplest thing you can do to avoid security vulnerabilities (yeah, yeah, I know sometimes they introduce problems through WU, but Microsoft seems to fix half a dozen "critical" security flaws per month).
So what novice out there is going to even take note that there's a book that covers security problems/issues and offers fixes for problems they're not even aware of?
Re:The problem with security books for the home us (Score:4, Interesting)
To whom? This sounds like a totally elitist attitude to me! I consult for a number of small business owners that depend on their computers for business. When things are explained to them so that they understand (none of this "Just do this and shut up" crap) I have never had one of them that insisted on practicing unsafe computer acts again. I suspect that more of the problem lies in presentation than in stubborn/stupid computer users!
Remember; ignorance can be cured, stupidity can't!
Re:This book should be open source (Score:4, Interesting)
I didn't start this, they already had classes set up which I started helping out with, but I *did* create the class on security for average folks.
Just be prepared to supply a bit of free tech support
Re:Average user? (Score:5, Interesting)
By out-of-touch, I mean he has no idea what an average user is, or what they're willing to do. Ethereal is next to useless as a security tool, it's a great tool for troubleshooting complex networking setups, but a box with XP Home that dials into AOL is hardly a complex network.
They might as well suggest the "average user" set up an elaborate honeynet.
A security book for the average user probably could fit on both sides on an index card, hell one side: Know what a firewall is and how to configure it. Know not to run executable code unless you trust the source. Keep your machine up to date, and scan for viruses reguarly.
That's about it, at least, thats about all I'd expect out of an average user, and that's about all I'm willing to do myself. I've never cracked out ehtereal to "secure my box". Thats ridiculous.
The "dont run executables" is a tricky one under Windows, because it's no longer clear to the average user what's executable or not. It used to be simple: files that end in
Not that it's easier for the average user to know in the unix world, where they have to "ls -l" to see if the executable bit is set.
Re:The problem with security books for the home us (Score:2, Interesting)
Insecurity = identity theft, loss of property or information, and probably cancer
Well, you also have to consider that for all of the screaming privacy/security insanity on Slashdot, that security isn't important to most home users. Of course people get fucked over, but not everybody running unpatched Windows 98 is fucked. Even if a large % of users have backdoors, etc. installed, what % of those users have something worth stealing? It comes down to if the extra time, money and effort in securing a computer is really worth it to them.
Re: The book is missing "dummies" in the title (Score:2, Interesting)
No, they don't. They just don't (and/or don't want to) understand all the inner workings of technology they use every day.
Considering that most of these people have to use computers at work on a daily basis, and probably use them at home at least every few days, isn't refusing to learn about the technology, by definition, lacking common sense?
Me no want to read book... (Score:0, Interesting)
*shudders*
Why can't they be more like Dell and have a 1 sheet poster with cute pictures telling us how to setup our computer?
Honestly, the majority of computer users -- Joe6Pack&SoccerMom (TM) -- are stupid. They don't read the manual to a machine that is more complex than their automobile.
We're not asking the normal user to be an expert in rebuilding their engine or to understand how a transister works...but seriously. Read a few books and learn where the hell the gas/brake/power button is located and what double clicking/opening programs/start menu/interet means.
Maybe it's M$'s fault for not providing an Operating System where flaws/problems/features don't cripple the non-savvy user.
Too bad no one makes a computer system for the non-savvy...something easy where there aren't 500 holes that need to be patched before you connect it to the internet...what did you say, Apple? Macs? Oh, I take that back then.
Re: The book is missing "dummies" in the title (Score:2, Interesting)
To use my car analogy again, the owner needs to know how to check the oil, tranny fluid, washer fluid and how to drive it safely. They don't need to know how to replace the drive shaft.
I think the government needs to regulate for safety, which, in computer terms, basically = security. The government should regulate Microsoft, Apple, SCO, etc. They should regulate AIM, Yahoo, Gain, etc... When you have Wind...erm...I mean Security Holes on your machine, you can fall victim to something like identity theft or, you could be used in part of a larger attack on another server.
I think most users would be "safe" and happy to leave replacing HD's or upgrading RAM to the "mechanics". The users who want to learn, well, it's much like a car - get in there and do it.