SUMMARY | Hacking Exposed 5th Edition

After writing this chapter, we simultaneously wanted to breathe a sigh of relief and to embark on years of further research into Internet user hacking. Indeed, we left some highly publicized attacks on the cutting room floor, due primarily to inability to keep up with the onslaught of new attacks against Internet end users. Surely, the Internet community will remain busy for years to come dealing with all these problems and those as yet unimagined. In the meantime, remember our "12 Steps to a Safer Internet Experience," which we'll reiterate here in summarized form:

Deploy a personal firewall, ideally one that can also manage outbound connection attempts. The updated Windows Firewall in XP SP2 and later is a good option.
Keep up to date on all relevant software security patches. Use Windows Automatic Updates to ease the burden of this task (see http://www.microsoft.com/athome/security/protect/windowsxp/updates.aspx for more information).
Run antivirus software that automatically scans your system (particularly incoming mail attachments) and keeps itself updated. We also recommend running the antiadware/antispyware and antiphishing utilities discussed in this chapter.
Configure the Windows "Internet Options" control panel (also accessible through IE and Outlook/OE), as discussed in this chapter.
Run with least privilege. Never log on as Administrator (or equivalent highly privileged account) on a system that you will use to browse the Internet or read e-mail.
Administrators of large networks of Windows systems should deploy the aforementioned technologies at key network chokepoints (for example, network-based firewalls in addition to host-based firewalls, antivirus on mail servers, and so on) to more efficiently protect large numbers of users.
Read e-mail in plaintext.
Set the kill bit on unneeded ActiveX controls.
Change Windows default configurations.
Configure office productivity programs as securely as possible; for example, set the Microsoft Office programs to "Very High" macros security under Tools Macro Security.
Don't be gullible. Approach Internet- borne solicitations and transactions with high skepticism.
Keep your computing devices physically secure.