Re: Confidentiality of information in my system ..

"Minto" <axmukher@xxxxxxxxx> wrote in message
news:1160659359.772916.237030@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I have been hearing in the news that Windows XP is having a few flaws
which Microsoft is trying to patch up.

It's not news, but all large software, including all operating system
software, has flaws. What's probably more important is how the people
administering the systems secure them (or don't). This is why

How do I know that my system has
not been compromised already? I am storing all sorts of confidential
data like credit card numbers and passwords in my system, so naturally
I am very concerned. Also, I have other confidential information that I
would not like to share with others.

There's a saying that the only secure computers are those not connected to
networks. As well, anyone who can get physical access to your machine can
be assumed to be able to take any data from it.

If you have a concern for security, educate yourself (there is a lot of
information, much highly technical, on this topic), and if you are
uncertain, move (not copy) that data to media that is not shared, does not
always have to be attached to the PC (like on CD/RW or an external drive you
can disconnect) and that others don't have physical access to. Turn off
any un-needed file sharing and install a NAT router. And change your
passwords regularly.

A word regarding XP Pro encryption: this is effective, but is tied to the
user account credentials. Once you're in the account, the data is
unencrypted. And should the account be changed from outside, such as a lost
password being reset by the administrator, if the credentials weren't
exported and verified, the data is permanently lost.

Is there any way to confirm that my system has not been already
compromised?

Pretty much only by watching for misuse of your information.

If you think there is the remotest chance that this has happened,
immediately change all the passwords and credit card numbers.

Doing so will not only prevent misuse by instantly invalidating all the old
information, but will trigger detection activities when and if the old
information is used. Just be sure it isn't *you* that accidentally uses
the old information - this can be rather embarassing.

Regularly changing passwords is a very basic security measure. Many people
do not do this.

I have anti-virus and firewall installed, but maybe they
are not good enough??

They help, but do not absolve you of responsiblilty for your data. Do not
consider them as complete or impenetrable security solutions.

HTH
-pk



.

Relevant Pages

  • [NEWS] UTStarcom B-NAS 1000 and B-RAS 1000 Security Flaw
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... with known passwords. ... Issanni 1000) One account is approximately equal ... Management user with limited write privileges ...
    (Securiteam)
  • Re: Account lockouts
    ... for reusable passwords and the AAA infrastructures that rely upon them? ... In that context, account lockout policy -- duration, threshold, lockout ... > cracking attacks. ...
    (microsoft.public.security)
  • Re: On password expiration
    ... If you are very concerned about the security of the system, ... forcing your users to change their passwords every X number of days is ... been dormant for X numbers of days, an account lockdown policy to ... organizational policy prohibiting employees from writing down their ...
    (microsoft.public.security)
  • Re: Deleting Admin Account
    ... administrative level account to change the Type of the Admin account ... created to a limited account (or create yourself a third account - non-admin ... The built-in administrator cannot be changed from the administrative level, ... You should password protect (with different passwords would be best) each ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Blank Passwords, Complex Requeirements and Problems...
    ... The account would then have: 544 = normal account with "Password Not Required" bit = on ... wellKnownObjects: B:32:6227F0AF1FC2410D8E3BB10615BB5B0F:CN=NTDS ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... As far as i know, the Win2003 AD never had a "free" Default Domain Policy to allow that, the DDP is the Default since the initial build of th AD. Ok, let's say that an Admin disabled temporarily th DDP for a few moments and allowed certain accouns to be created with blank passwords. ...
    (microsoft.public.win2000.active_directory)