J.D. Fox Micro Resource Center
Links
Security Tools and Resources
The online security tools and downloads are for experienced systems administrators only! If you are using a computer that is part of a business network, please see your administrator if you have questions about computer viruses or other security threats. Your use of these tests on a computer or network you do not own may violate your company's acceptable use policies, and/or generate unusual traffic which could cause false alarms from in-place security systems. Even if you are a home user or a self-employed professional with a stand-alone computer, use of some of these tools may violate the acceptable use policies of your Internet access provider.
Therefore, in all cases, do not run any of these tests if you are not properly authorized to do so on the computer or network being tested.
Online Virus Scan
The anti-virus industry is still thriving, with many companies offering everything from major products that protect entire networks, to simple programs that run on a desktop or laptop computer to try to defend against malicious software. You can find numerous free web-based virus detectors as well, which are generally designed for the individual home user with no other anti-virus software installed. Of course, most of these are part of a marketing strategy to get you to purchase the full product for continuous protection.
ESET, the company that produces the sleek NOD32 anti-virus product, offers the best web-based virus scanner. After completing the scan, it will even clean the viruses for free. You also have the option for it to scan only, without making changes to your computer. The scanner runs through ActiveX if you use Microsoft Internet Explorer; for other browsers you must download and run an executable file.
Please keep in mind that running an online virus scanner, or even purchasing an anti-virus software product and subscription for continuous protection, do not by themselves comprise a comprehensive security solution for your computer or business network. Also, any anti-virus scanner can only contain so much built-in intelligence; it takes a trained, experienced IT professional to properly interpret the results of the virus scan to determine whether your computer is truly compromised (and not just a false alarm), and whether the cleaning action was successful in case of an actual infection.
The ESET scanner doesn't seem to catch rootkit viruses, like the common TDSS. If you still have problems after ESET declares you clean, try the free and amazing TDSSKiller from Kaspersky Lab.
TDSSKiller, the free rootkit remover from Kaspersky Lab
System Auditing
Gibson Research Corporation
Steve Gibson is a talented systems engineer whose site is loaded with information about personal computer security, as well as several clever tools for testing various aspects of your Internet connection. The site is probably a little heavy for the average user, but should be very interesting to any IT systems administrator.
The tests linked here are not recommended for the novice user. Some of them cover very complicated concepts, and, while the tests themselves are easy to run, you should have the results interpreted by a competent IT professional before making changes to your computer.
Belarc
Belarc Advisor scans your computer for various security-related software configuration issues. The free scan provides a tremendous amount of information about your computer. It is only for individual use on a single computer, however. If you are interested in deploying Belarc's commercial products to audit your business network, follow the links in the free audit report, or contact an IT service professional.
The free scan also provides a basic audit of your software licenses. Click here for more links relating to software licensing.
Belarc also offers a paid product for performing security management throughout your network, by combining the BelSecure module into their business network auditing package, BelManage. Click on the below link for more information.
Microsoft
The Microsoft Baseline Security Analyzer is a basic tool to get started evaluating and improving the security configuration of Microsoft products, such as Microsoft Windows Server.
DNS Vulnerability Test
Run this simple online test to see if your Internet connection is vulnerable to a flaw in the DNS system that was uncovered a few years ago. This particular flaw resides not in your computer, but in the DNS servers your computer relies on for your Internet connection to work properly. These DNS servers are either owned by your Internet Service Provider (ISP) or your business network. The flaw, if present, makes it possible for criminals to direct your computer to imposter web sites (such as one that looks exactly like your banking site) and collect your password when you try to log in.
The link below tests for the same vulnerability covered in the DNS Spoofability test at GRC, linked above.
Since this flaw was discovered back in 2008, virtually all ISPs have fixed their DNS servers, so any conventional home or business network should pass this test.
E-mail Encryption and Digital Signatures
If you wish to have someone send you encrypted messages through standard e-mail that only you can decrypt, or if you want to send a message that is technologically certified to have only come from your e-mail address without having been tampered with (for transmitting a contract, for example), then you need a digital certificate assigned to your e-mail address, also known as a Digital ID.
If your organization already has a Public Key Infrastructure (PKI) or you are not sure, then please see your IT systems or IT security manager for assistance. If you are an individual or your organization does not have a PKI, you can obtain a quality, trusted, inexpensive digital certificate using the link below for the purposes described above.
Industry Associations
Government Organizations
US-CERT (U.S. Department of Homeland Security)
Computer Security Portal - NIST (U.S. Department of Commerce)
Vendor/Platform Security Websites
Below are links to security information pages for various desktop, server, and mobile device operating system and major application vendors. The links displayed here are more generally for system administrators in a business environment rather than individuals or home users.
Microsoft Security TechCenter (TechNet)
Microsoft Windows Update (requires Internet Explorer)
Apple Security Updates (all products)
iOS Security (iPhone and iPad)
Fedora Security Advisories and Package Updates
VMware vSphere with Operations Management for Virtualization Security
The Intel site seems to have been misconfigured recently by Intel, which is why you may see a peculiar error message if you click on it.
Android Security
You may have noticed Google/Android missing from the above links for vendor/platform security. This is because Google does not maintain any web pages for Android security for systems administrators, only developers. For system administrators, here are some links from third parties on the kind of topics covered by other vendors in the links in the previous section.
First are articles from industry information sites from 2013, but still relevant.
Guide to Android Security Risks by InfoWorld (December 9, 2013)
Android Is Secure, Users Aren't by Lifehacker (October 16, 2013)
Here is a well-known user-friendly security app for Android-based mobile devices, to address the theses in the above two articles.