10 December 2008

Protect your computer from attack

•  •  •  •  •

Malicious software variations continue to grow at explosive rates.  The number of new viruses, worms and other types of "malware" detected in 2007 was double that for 2006.  New variations detected in 2008 will be more than triple that for 2007.  (Source: F-Secure)  Keeping up with these attacks requires multiple defenses, and it’s critical that those defense be complete and up to date.  That involves you. What protections does the campus have against malware? Anti-malware protections are deployed for the network as a whole, for server computers, and for "endpoint" devices like personal computers that access the network.  Protections include firewalls, intrusion detection/prevention systems and anti-virus software.

For your personal computer, the principal protective software is Symantec Endpoint Protection (SEP); you may know it by its older name, Symantec Anti-Virus (SAV).  Versions of SEP/SAV are available for both Windows and Mac computers.

How do I get SEP/SAV for my personal computer?

You can download SEP/SAV for your Windows or Mac computer from the Download Software section of Medical Information Technology’s web site.  The SEP/SAV software is licensed for both workplace (department-owned) and personally-owned systems.   There is no charge to UM employees or students for SEP/SAV.

Installation of the current version of SEP/SAV is required for computers used on the medical campus network.  The vast majority of campus computers have the current version installed already.  If your computer cannot run the current version, it must be replaced or upgraded (e.g., with additional memory).  Contact the Help Desk at 305-243-5999 or the Computer Store at 305-243-1189 for assistance.

How do these malware defenses work?

Some of these defenses rely on detecting the "signature" of malicious software - that is, the unique bit pattern of the computer code that constitutes the malware.  They may also look for the suspicious network communications and traffic patterns typical of malware - sometimes called "behavioral" detection.

While protective software is updated continuously, new malware variations disperse through the Internet so fast that it is not possible to rely on signatures alone; hence, the reliance on behavioral tools as well.

Is there anything else I need to know?

Even though the combinations of automated defenses are robust, your behavior is still critical.  By clicking on a link in an email or on a web site you can instantly infect your computer - and, very quickly, possibly infect other computers in the same part of the network - before the defenses have had time to react and isolate the infection.

Don’t click on a link unless you have complete confidence in the email or web site containing that link.  Make a habit of checking where a link is actually going - the address will typically display when you put your cursor on the link.  And never, ever, provide your Medical user-ID and password to a web site unless you are sure it is a UM site authorized to ask for those credentials.

More Information

• Thieves Winning Online War, Maybe Even in Your Computer (New York Times, 5 December 2008)
• F-Secure Security Threat Summary for 2008  (F-Secure, 2008)

•  •  •  •  •