RFC 2504

Users' Security Handbook

📅 published February 1999, from ietf

RFC 2504: Users' Security Handbook 🎀

okay bestie, so this is RFC 2504, the Users' Security Handbook 💅 It's an FYI document (FYI 34) in the Informational category, dated February 1999. The authors are E. Guttman (Sun Microsystems), L. Leong (COLT Internet), and G. Malkin (Bay Networks) 🫶 It's the companion to the Site Security Handbook. The title block doesn't list any RFCs it obsoletes or updates ✨

Status of This Memo 📝

this memo gives information to the internet community, and it does not specify an Internet standard of any kind 🦋 distribution is unlimited, so it can be shared freely 💖

Copyright (C) The Internet Society (1999). All Rights Reserved.

Abstract 🌸

the Users' Security Handbook is the companion to the Site Security Handbook (SSH) 💜 it's meant to give users the info they need to help keep their networks and systems secure, which is literally the whole point 😭✨

Table of Contents 🗺️

   Part One: Introduction . . . . . . . . . . . . . . . . . . . .  2
   1.   READ.ME . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.   The Wires have Ears . . . . . . . . . . . . . . . . . . .  3
   Part Two: End-users in a centrally-administered network  . . .  4
   3.   Watch Out! . . . . . . . . . . . . . . . . . . . .  . . .  4
   3.1.   The Dangers of Downloading  . . . . . . . . . . . . . .  4
   3.2.   Don't Get Caught in the Web . . . . . . . . . . . . . .  5
   3.3.   Email Pitfalls  . . . . . . . . . . . . . . . . . . . .  6
   3.4.   Passwords . . . . . . . . . . . . . . . . . . . . . . .  7
   3.5.   Viruses and Other Illnesses . . . . . . . . . . . . . .  7
   3.6.   Modems  . . . . . . . . . . . . . . . . . . . . . . . .  8
   3.7.   Don't Leave Me... . . . . . . . . . . . . . . . . . . .  9
   3.8.   File Protections  . . . . . . . . . . . . . . . . . . .  9
   3.9.   Encrypt Everything  . . . . . . . . . . . . . . . . . . 10
   3.10.  Shred Everything Else . . . . . . . . . . . . . . . . . 10
   3.11.  What Program is This, Anyway? . . . . . . . . . . . . . 11
   4.   Paranoia is Good  . . . . . . . . . . . . . . . . . . . . 11
   Part Three: End-users self administering a networked computer  14
   5.   Make Your Own Security Policy . . . . . . . . . . . . . . 14
   6.   Bad Things Happen . . . . . . . . . . . . . . . . . . . . 15
   6.1.   How to Prepare for the Worst in Advance . . . . . . . . 15
   6.2.   What To Do if You Suspect Trouble . . . . . . . . . . . 16
   6.3.   Email . . . . . . . . . . . . . . . . . . . . . . . . . 17
   7.   Home Alone  . . . . . . . . . . . . . . . . . . . . . . . 17
   7.1.   Beware of Daemons . . . . . . . . . . . . . . . . . . . 17
   7.2.   Going Places  . . . . . . . . . . . . . . . . . . . . . 19
   7.3.   Secure It!  . . . . . . . . . . . . . . . . . . . . . . 20
   8.   A Final Note  . . . . . . . . . . . . . . . . . . . . . . 20
   Appendix: Glossary of Security Terms . . . . . . . . . . . . . 21
   Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 31
   References . . . . . . . . . . . . . . . . . . . . . . . . . . 31
   Security Considerations  . . . . . . . . . . . . . . . . . . . 32
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 32
   Full Copyright Statement . . . . . . . . . . . . . . . . . . . 33

Part One: Introduction 🧚

okay so this doc is basically a guide for end-users on what they can do to keep their data and communication private, and their systems and networks secure 🔐 Part Two is for "corporate users" at small, medium, and large corporate and campus sites 🏢 Part Three is for people who administer their own computers, like home users 🏠

if you run a system or network, you can use this doc as the base for a site-specific users' security guide 💅 but you should read the Site Security Handbook [RFC2196] first, bestie, no skipping 🙈

there's a glossary in an appendix at the end that explains the network security terms for anyone who's new to them 📚✨

1. READ.ME 📖

before you get connected to the Internet or any other public network, you should get the security policy of the site you plan to use as your access provider, and actually read it 👀 a security policy is a formal list of rules that users with access to a site's technology and information assets have to follow 💅 as a user, you're obliged to follow the policy the decision makers and admins at your site created 🫶

the policy exists to protect a site's hardware, software, and data 🛡️ it spells out the site's security goals, what users can and cannot do, what to do and who to contact when problems come up, and generally tells you what the "rules of the game" are 🎮

2. The Wires have Ears 👂

it's SO much easier to eavesdrop on data networks than to tap a phone call 😳 any link between computers could be insecure, and so could any computer that data flows through 💀 all info passing over a network can be eavesdropped on, even if you think "No one will care about this..." (sis, someone will 🙈)

info sent over a network may be read by the intended audience and by other people too 👀 this can happen to personal email and sensitive stuff you access through file transfer or the Web 💌 check out the "Don't Get Caught in the Web" and "Email Pitfalls" sections for specific tips on protecting your privacy 🔏

your utmost concerns, first, should be protecting yourself from misuse of your computer account(s), and second, protecting your privacy 🫶

unless you take precautions, every time you log in over a network to any network service, your password or confidential info may get stolen 😭 it can then be used to get illicit access to any system you have access to 🚨 sometimes the consequences are obvious, like if someone gets into your bank account and you lose cash fast 💸 but non-financial services can be abused in pretty costly ways too 💀 and you may be held responsible if someone else misuses your account!! 😱

a lot of network services involve remote log in 🖥️ the user is prompted for their account ID (ie. user name) and password 🔑 if that info goes over the network without encryption, anyone can intercept and read it 👀 this isn't really a problem when you're using a "dial-in" service where you connect by phone and log in, say to an online service provider, because phone lines are harder to eavesdrop on than Internet traffic 📞✨

the risk comes when you use programs to log in over a network 🚩 lots of popular programs used to log in to services or transfer files (like telnet and ftp, respectively) send your user name and password, and then your data, over the network without encrypting them 😤

the precaution larger institutions, like corporations, usually take against password eavesdropping is one-time password systems 🔢

until recently, secure log in systems were way too complicated and expensive for home systems and small businesses 💸 but more and more products let you do this without fancy hardware, using cryptographic techniques 🔐 one example is Secure Shell [SSH], which is both freely and commercially available for a bunch of platforms 🌈 lots of products (including SSH-based ones) can also encrypt your data before it goes over the network 💖

Part Two: End-users in a centrally-administered network 🏢

here's the iconic summary of the most important advice from Part Two 💅

  • know who your security point-of-contact is 📞
  • keep passwords secret at all times 🤫
  • use a password-locked screensaver or log out when you leave your desk 🔒
  • don't let simply anyone have physical access to your computer or your network 🚫
  • be aware of what software you run, and be very wary of software of unknown origin 👀 think hard before you run downloaded software 🧠
  • do not panic 😭 consult your security point-of-contact, if possible, before spreading alarm 📢
  • report security problems to your security point-of-contact as soon as possible 🚨

3. Watch Out! 🚨

3.1. The Dangers of Downloading 💾

the internet keeps getting more and more free software, and that's one of the most attractive things about public networks 🌈 but you should still be careful, because some files can be dangerous 💀 downloading is the single biggest risk 😬

store every downloaded file so you'll remember where it (possibly sketchy) came from 🗂️ don't mistake a downloaded program for another program just because they have the same name 🙅‍♀️ this is a common trick to get users to run programs they think are familiar but could actually be dangerous 😈

programs can use the network without you knowing 👻 the key thing: if a computer is connected, any program can use the network, with or without telling you 🌐 for example:

You download a game program from an anonymous FTP server. This
appears to be a shoot-em-up game, but unbeknownst to you, it
transfers all your files, one by one, over the Internet to a
cracker's machine!

yikes, right?? 😭 many corporate environments flat out prohibit downloading and running software from the Internet 🏢🚫

that's the end of part 1 bestie, we're just getting started 🌈💖

3.2. Don't Get Caught in the Web 🕸️

Okay bestie, the biggest danger when you're web browsing is downloading files 😬. Web browsers can grab any file off the Internet, so check out "The Dangers of Downloading" 💅.

Web browsers are downloading stuff even when it's not obvious 👀. So the risk from downloading files can show up even if you never go hunting for files on purpose. Treat any file you've loaded over the network as possibly dangerous, even the stuff sitting in the web browser's cache 🫣. Don't run them by accident, because they could be malicious programs. (Remember, programs are files too! You might think you downloaded a harmless text file when it's actually a Trojan Horse program, script, etc. 💀)

Web browsers may download and run programs for you, either automatically or after you click something 🤖. You can turn these features off. If you leave them on, make sure you understand the consequences 🙈. Read the security guide that comes with your web browser, plus your company's security policy 📖. Downloaded programs can be risky to run on your machine, so see "What program is this, anyway?" ⚠️

Web pages often include forms 📝. Same as with Email, data sent from a web browser to a web server is not secure 😬. Several mechanisms have been created to fix this, most notably Secure Sockets Layer [SSL] 🔐. It's built into lots of web browsers, and it encrypts the data between the user's browser and the web server so nobody along the way can read it ✨.

A web page can look totally genuine and still be a forgery 🎭. It's easy to copy how a real page looks, and it's possible to mess with the network protocols that connect to the server you want, to trick your browser into an imposter 🥸.

SSL can help guard against that by checking whether a web page is genuine 🔒. When a 'secure' page has downloaded, the browser's 'lock' or 'key' will show it 🗝️. Double-check this! View the 'certificate' for the page you accessed. Each web browser has a different way to do this. The certificate lists the certificate's owner and who issued it. If those look trustworthy, you're probably OK 💖.

3.3 Email Pitfalls 💌

All the normal concerns apply to messages from Email that you could get any other way 📬. For example, the sender may not be who they claim to be. If Email security software isn't being used, it's really hard to know for sure who sent a message 😵. That means Email itself isn't a suitable way to conduct many types of business 💼. It's super easy to forge an Email to make it look like it came from anyone 🎭.

Privacy is another security issue to think about with Email 🔍. Email hops across the Internet from computer to computer. As it moves between computers, and even while it sits in a mailbox waiting to be read, others could potentially see it 👀. So think twice before sending confidential or super personal stuff by Email 🫣. You should never send credit card numbers and other sensitive data via unprotected Email 🚫. Check out "The Wires Have Ears" 👂.

To cope with this, there are privacy programs out there, and some are built into Email packages 🛡️.

Email forwarding is something lots of Email users love 💕, but it should be used very cautiously 🙃. Picture this scenario:

   A user has an account with a private Internet Service Provider and
   wishes to receive all her Email there.  She sets it up so that her
   Email at work is forwarded to her private address.  All the Email
   she would receive at work then moves across the Internet until it
   reaches her private account.  All along the way, the Email is
   vulnerable to being read.  A sensitive Email message sent to her
   at work could be read by a network snoop at any of the many stops
   along the way the Email takes.

Note that Email sent or received at work may not be private 🏢. Check with your employer, because employers may (in some instances) legally both read your Email and make use of it 👀. The legal status of Email depends on the privacy of information laws in force in each country 🌍.

Many mail programs let you include files in Email messages 📎. The files that come by Email are files like any other 🗂️. Any way a file can find its way onto a computer is possibly dangerous ⚠️. If the attached file is merely a text message, fine ✅. But it may be more than a text message. If the attached file is itself a program or an executable script, extreme caution should be applied before running it 🚨. See the section entitled "The Dangers of Downloading".

3.4 Passwords 🔑

Passwords may be easily guessed by an intruder unless precautions are taken 🕵️. Your password should contain a mixture of numbers, upper and lower case letters, and punctuation 🔢. Avoid all real words in any language, or combinations of words, license plate numbers, names and so on 🙅. The best password is a made-up sequence (e.g., an acronym from a phrase you won't forget), such as 2B*Rnot2B (but don't use this password!) 🧠.

Resist the temptation to write your password down ✍️. If you do, keep it with you until you remember it, then shred it! NEVER leave a password taped onto a terminal or written on a whiteboard 🚫. You wouldn't write your PIN code on your automated teller machine (ATM) card, would you? 💳 You should have different passwords for different accounts, but not so many passwords that you can't remember them 🧩. You should change your passwords periodically 🔄.

You should also NEVER save passwords in scripts or login procedures, as these could be used by anyone who has access to your machine 🙅‍♀️.

Be certain that you're really logging into your system 🧐. Just because a login prompt appears and asks for your password doesn't mean you should enter it 🙅. Avoid unusual login prompts and immediately report them to your security point-of-contact 🚩. If you notice anything strange upon logging in, change your password 🔄.

Unless precautions have been taken to encrypt your password when it is sent over the network, you should, if possible, use "one-time passwords" whenever you log in to a system over a network 🔐. (Some applications take care of that for you.) See "The Wires Have Ears" for more information on the risks associated with logging in over a network 👂.

3.5 Viruses and Other Illnesses 🦠

Viruses are basically unwanted pieces of software that sneak onto a computer 🐛. What the virus may do once it has entered its host depends on several factors: What has the virus been programmed to do? What part of the computer system has the virus attacked? Some viruses are 'time bombs' that only activate when given a particular condition, such as reaching a certain date ⏰. Others stay latent in the system until a particular afflicted program is activated 😴. There are still others that are continually active, exploiting every opportunity to do mischief 😈. A subtle virus may simply modify a system's configuration, then hide 🫥.

Be cautious about what software you install on your system 📦. Use software from "trusted sources" if possible ✅. Check your site policy before installing any software: some sites only allow administrators to install software, to avoid security and system maintenance problems 🛠️.

Centrally-administered sites have their own policy and tools for dealing with the threat of viruses 🏢. Consult your site policy or ask your systems administrator what the correct procedures are to stay virus free 🧼.

You should report it if a virus detection tool indicates that your system has a problem 🚨. You should notify your site's systems administrators, as well as the person you believe passed the virus to you 📣. It's important to stay calm! Virus scares may cause more delay and confusion than an actual virus outbreak 😮‍💨. Before announcing the virus widely, make sure you verify its presence using a virus detection tool, if possible, with the help of technically-competent personnel 🔍.

Trojan Horse programs and worms are often categorized with viruses 🐴. Trojan Horse programs are dealt with in the "What Program is This, Anyway?" section. For the purposes of this section, worms should be considered a type of virus 🪱.

3.6 Modems 📞

You should be careful when attaching anything to your computer, and especially any equipment which allows data to flow 🔌. You should get permission before you connect anything to your computer in a centrally-administered computing environment 🙋.

Modems present a special security risk 📟. Many networks are protected by a set of precautions designed to prevent a frontal assault from public networks 🏰. If your computer is attached to such a network, you must exercise care when also using a modem ⚠️. It is quite possible to use the modem to connect to a remote network while still being connected to the 'secure' net 😱. Your computer can now act as a hole in your network's defenses 🕳️. Unauthorized users may be able to get onto your organization's network through your computer! 🫢

Be sure you know what you are doing if you leave a modem on and set up your computer to allow remote computers to dial in ☎️. Be sure you use all available security features correctly. Many modems answer calls by default. You should turn auto-answer off unless you are prepared to have your computer respond to callers 📵. Some 'remote access' software requires this. Be sure to turn on all the security features of your 'remote access' software before allowing your computer to be accessed by phone 🔐.

Note that having an unlisted number will not protect you from someone breaking into your computer via a phone line 🙅. It is very easy to probe many phone lines to detect modems and then launch attacks 🎯.

3.7 Don't Leave Me... 🥺

Do not leave a terminal or computer logged in and walk away 🚶. Use password-locked screensavers whenever possible 🔒. These can be set up so that they activate after the computer has been idle for a while ⏳.

Sinister as it may seem, someone coming around to erase your work is not uncommon 😈. If you remained logged in, anyone can come by and perform mischief for which you may be held accountable 😬. For example, imagine the trouble you could be in for if nasty Email were sent to the president of your company in your name, or your account were used to transfer illegal pornography 🙈.

Anyone who can gain physical access to your computer can almost certainly break into it 💻. Therefore, be cautious regarding who you allow access to your machine 🚪. If physically securing your machine is not possible, it is wise to encrypt your data files kept on your local hard disk 🔐. If possible, it is also wise to lock the door to one's office where the computer is stored 🗝️.

3.8 File Protections

okay bestie, let's talk about files 📁✨ data files and directories on shared systems or networked file systems need real care and maintenance 💅 there are two categories:

  • Files to share 🦋 Shared files may be visible to everyone, or just to a restricted group of other users. every system does this differently, so learn how to control sharing permissions and implement that control without fail 🫶
  • Protected files 🔒 These are files that only you should have access to, but which are also available to anyone with system administrator privileges 👀 an example is the files tied to delivering Email. you don't want other users reading your Email, so make sure those files have all the necessary file permissions set accordingly 💌

3.9 Encrypt Everything

okay so there are also files that are private 🤫 files you don't want anyone else to access. in that case, it's prudent to encrypt the file 🔐 ngl this is iconic, because even if your network gets broken into or the systems administrator turns into Mr. Hyde 😱, your confidential information still won't be available.

encryption is also super important if you share a computer! like, a home computer may be shared by room mates who are friends but still want their Email and financial information kept private 🙈 encryption allows for shared yet private usage 🫧 slay.

Before you encrypt files, you should check your site's security policy 📋 some employers and countries expressly forbid or restrict the storing and/or transferring of encrypted files, so don't get caught slipping 🙅‍♀️

Be careful with the passwords or keys you use to encrypt files 🔑 locking them away safely not only keeps them from prying eyes, it helps you keep them secure too, because if you lose them, you lose your ability to decrypt your data as well!! 💀 it may be wise to save more than one copy. this may even be required if your company has a key escrow policy, for example 🗝️ that protects against the possibility that the only person who knows a pass phrase leaves the company or gets struck by lightning ⚡ rare, but iykyk.

Whilst encryption programs are readily available, the quality can vary wildly 🌈 PGP (which stands for "Pretty Good Privacy") for example, offers a strong encryption capability 💖 many common software applications include the capability to encrypt data too, but the encryption facilities in those are typically very weak 😬

you should not be intimidated by encryption software. easy-to-use software is being made available 🧚

3.10 Shred Everything Else

you would be surprised what gets thrown into the waste-paper basket 🗑️: notes from meetings, old schedules, internal phone lists, computer program listings, correspondence with customers and even market analyses 😳 all of these would be super valuable to competitors, recruiters and even an overzealous (hungry?) journalist hunting for a scoop 📰👀

the threat of dumpster diving is real, so take it seriously!! shred all potentially useful documents before discarding them 🍓

also, deleting a file does not erase it in many cases 😭 the only way to be sure an old hard disk doesn't contain valuable data may be to reformat it 💾

3.11 What Program is This, Anyway?

programs have gotten way more complex in recent years 🌸 they're often extensible in ways which may be dangerous. those extensions make applications more flexible, powerful and customizable, but they also open the end-user up to all sorts of risks 💅

  • A program may have "plug-in" modules. you should not trust plug-ins just because you're used to trusting the programs they plug into 🙃 For example: some web pages suggest that the user download a plug-in to view or use some portion of the page's content. consider: what is this plug-in? who wrote it? is it safe to include in your web browser? 🤔
  • Some files are "compound documents" 📄 this means that instead of using one single program, you'll need to run several programs to view or edit a document. again, be careful downloading application components! just because they integrate with well-known products doesn't mean they can be trusted 🚩 say you receive an Email that can only be read if you download a special component. that component could be a nasty program which wipes out your hard drive!! 😱
  • Some programs are downloaded automatically when accessing web pages 🕸️ while there are some safeguards to make sure these programs may be used safely, there have been security flaws discovered in the past 🙈 for this reason, some centrally-administered sites require that certain web browser capabilities be turned off 🛑

4. Paranoia is Good 🕵️‍♀️

okay bestie, listen up because this one is SO important 😭. Most people picture computer break-ins as some super technical bug that a hacker found, like a movie character typing at lightning speed. ngl, the truth is social engineering does a ton of the heavy lifting 💀. Talking people into helping them is often the easy stepping stone onto a protected system, especially when the attacker has no authorized access at all 🙈.

So what even is social engineering? In this context, it means gaining the trust of legit computer users until they reveal system secrets or help someone gain unauthorized access to their system(s), without even realizing it 😤. With that info or help, an attacker can break through security barriers with zero effort. Skillful social engineers can seem totally genuine while being full of deceit 🐍. iykyk.

Most of the time, these attackers work over the phone 📞. It's giving shield, because it hides their identity, and it also makes it easier to pretend to be someone with more chances of getting away with it 💅.

There are several types of social engineering. Here are a few of the most commonly used ones:

  • An attacker may pretend to be a legit end-user who is new to the system or just not very good with computers 💁‍♀️. This attacker may approach sysadmins and other end-users for help. This "user" might have lost their password, or can't get logged in and needs access urgently. Attackers have also been known to claim they're some VIP in the company and scream at admins until they get what they want 😤. In that case, the admin (or an end-user) may feel threatened by the caller's authority and give in 💀.
  • Attackers who call on the phone may never have even seen the screen display on your system 👀. Their trick is to keep details vague and get the user to reveal more info about the system. The attacker may sound really lost so the user feels like they're helping a damsel in distress 🥺. People often go out of their way to help, and then reveal secrets when they're off-guard 🙃.
  • An attacker may also take advantage of system problems they've noticed. Offering help is an iconic way to earn someone's trust 🫶. A frustrated user will be sooo happy when someone shows up to help. The attacker may come disguised as the systems administrator or a maintenance technician 🔧. The user thinks it's totally fine to reveal secrets to technicians, so the attacker gets valuable info. Site visits are riskier for the attacker because they can't make a quick getaway, but the payoff can be huge if a naive user lets them have direct access to the system 🎁.
  • Sometimes, attackers get into a system without any prior knowledge of system secrets or terminal access. It's like how you shouldn't carry someone else's bags through Customs: no user should key in commands on someone's behalf 🧳. Beware of attackers who use users as their own remotely-controlled fingers, typing commands on the user's keyboard that the user doesn't understand, commands which may harm the system. These attackers will exploit system software bugs and loopholes even without direct access. The commands keyed in by the end-user may bring harm to the system, open their own account up for the attacker, or create a hole to let the attacker in later 😭. If you're not sure about the commands you've been asked to key in, do not simply follow instructions. You never know what and where these could lead to... 👀

To guard against becoming a victim of social engineering, the big thing to remember is that passwords are secret 🔐. A password for your personal account should be known ONLY to you. The systems administrators who need to do something to your account will not require your password. Their admin privileges let them work on your account without you revealing it, so an administrator should not have to ask you for your password 🚫.

Users should guard the use of their accounts and keep them for their own use 💜. Accounts should not be shared, not even temporarily with systems administrators or systems maintenance technicians. Most maintenance work requires special privileges that end-users aren't given. Systems administrators will have their own accounts to work with, and they will not need to access computer systems via an end-user's account 🙌.

Systems maintenance technicians who come on site should be accompanied by the local site administrator, who should be known to you 🏢. If the site administrator isn't familiar to you, or if the technician comes alone, it's wise to call your known site administrator to check whether the technician should be there 📲. Yet lots of people skip this because it makes them look paranoid, and it's embarrassing to show they have little or no trust in these visitors 😳.

Unless you are very sure that the person you're talking to is who they claim to be, no secret information should ever be revealed to them 🙅‍♀️. Sometimes attackers are good enough to sound like someone whose voice you know over the phone, so it's always good to double check their identity. If you can't do that, the wisest thing is not to reveal any secrets. If you're a systems administrator, there should be security procedures for the assignment and reassignment of passwords to users, and you should follow those procedures 📋. If you're an end-user, there should not be any need for you to reveal system secrets to anyone else. Some companies assign a common account to multiple users. If you happen to be in such a group, make sure you know everyone in that group so you can tell whether someone claiming to be in the group is genuine 🫂.

Part Three: End-users self administering a networked computer 🏠

The home user, or the user who administers their own network, has many of the same concerns as a centrally-administered user. Here's a summary of the additional advice given in Part Three:

  • Read manuals to learn how to turn on security features, then turn them on 📖.
  • Consider how private your data and Email need to be. Have you invested in privacy software and learned how to use it yet? 🛡️
  • Prepare for the worst in advance 🌧️.
  • Keep yourself informed about what the newest threats are 📰.

5. Make Your Own Security Policy 📝

You should decide ahead of time what risks are acceptable, and then stick to that decision 🎯. It's also wise to review your decision at regular intervals and whenever the need arises. It may be wise to simply avoid downloading any software from the network that comes from an unknown source to a computer storing business records, other valuable data, or data that could be damaging if it were lost or stolen 🚷.

If the system has a mixed purpose, say recreation, correspondence, and some home accounting, you might hazard some software downloading 🎮. Just know that you unavoidably take on some risk of acquiring stuff which is not exactly what it seems to be 😬.

It may be worthwhile to install privacy software on a computer that's shared by multiple users 👯‍♀️. That way, a friend of a roommate won't have access to your private data, and so on.

6. Bad Things Happen 🚨

If you notice that your files have been modified, or you find out somehow that your account has been used without your consent, you should inform your security point-of-contact immediately 📣. If you don't know who your security point-of-contact is, try calling your Internet service provider's help desk as a first step ☎️.

6.1 How to Prepare for the Worst in Advance ✨

Okay bestie, prep is literally everything 🎀 Here's your checklist:

  • Read all the user docs, like, actually read them 📖 Make sure it's clear when services are running on your computer. If network services are turned on, configure them properly: set all permissions so anonymous or guest logins are blocked, and so on. More and more programs have networking features built right in, so learn how to set those up and use them safely 🔐
  • Back up your data 💾 This is always important. Backups are usually thought of as a way to keep your work safe if a hard disk dies or you accidentally delete a file. They're also critical for making sure data can't be lost in a computer security incident. One of the most vicious and unfortunately common threats from computer viruses and Trojan Horse programs is wiping a computer's hard disk 💀
  • Get virus checking software or security auditing tools 🛡️ Learn how to use them and install them before you connect to a public network. Many security tools need to run on a "clean" system so they can compare the present state with the pristine one, so some of the work has to happen ahead of time
  • Update your networking software regularly 🔄 When new versions of programs come out, it's smart to upgrade. Security vulnerabilities will likely have been fixed. The longer you wait, the greater the risk that a product's vulnerabilities become known and get exploited by some network assailant. Keep up to date! 💅
  • Find out who to contact if you suspect trouble 📞 Does your Internet Service Provider have a security contact or Help Desk? Look into this before trouble happens so you don't waste time figuring it out in the moment. Keep the contact info both online and offline so it's easy to grab 🫶

There are 3 ways to avoid problems with viruses 🦋:

  1. Don't be promiscuous 🙈 If at all possible, be cautious about what software you install. If you're unaware of or unsure about where a program came from, it's wise not to run it. Get software from trusted sources. Don't execute programs or reboot using old diskettes unless you've reformatted them, especially if those diskettes were used to bring software home from a trade show or other potentially security-vulnerable places. Nearly all the risk of getting infected by viruses can be eliminated if you're extremely careful about what files live on your computer. See "The Dangers of Downloading" for more details.
  2. Scan regularly 🔍 Give your system a regular check-up. There are excellent virus checking and security audit tools for most computer platforms available today. Use them, and if possible, set them to run automatically and regularly. Also install updates for these tools regularly and keep yourself informed about new virus threats.
  3. Notice the unusual 👀 It's not true that a difference you can't detect is no difference at all, but it's a good rule of thumb. Get used to the way your system works. If there's an unexplainable change (for instance, files you believe should exist are gone, or strange new files keep appearing and disk space is 'vanishing'), you should check for the presence of viruses.

You should take some time to get familiar with the computer virus detection tools available for your type of computer. Use an up-to-date tool (i.e. not older than three months) 🗓️ It's very important to test your computer if you've been using shared software of dubious origin, someone else's used floppy disks to transfer files, and so on 😭

6.2 What To Do if You Suspect Trouble 🚨

If you suspect your home computer has a virus, that a malicious program has been run, or that a system has been broken into, the wisest move is to first disconnect the system from all networks 🔌 If you have them available, use virus detection or system auditing software.

Checking vital system files for corruption, tampering or malicious replacement is super tedious to do by hand 🥱 Luckily, there are plenty of virus detection programs for PCs and Macintosh computers. There are also security auditing programs for UNIX-based computers. If you download software from the network, it's wise to run virus detection or auditing tools on it regularly.

If it becomes clear a home system has been attacked, it's time to clean up 🧹 Ideally, the system should be rebuilt from scratch. That means erasing everything on the hard disk. Next, install the operating system, and then all the additional software the system needs. It's best to install the operating system and additional software from the original distribution diskettes or CD-ROMs, rather than from backup storage. The reason is that a system may have been broken into some time ago, so the backed-up system or program files may already include some altered files or viruses. Restoring a system from scratch is tedious but totally worth it ✨ Don't forget to re-install all the security-related fixes you had installed before the incident. Get these from a verified, unsuspicious source 🫶

6.3 Email 💌

Be careful with saved Email, bestie 🥺 Copies of sent or received Email (or literally any file at all) stored with an Internet service provider may be vulnerable. The risk is that someone might break into the account and read your old Email. Keep your Email files, and really any sensitive files, on your home machine 🏠

7. Home Alone 🏡

A home system can be broken into over the Internet if the home user isn't careful 😬 Files on the home system can be stolen, altered or destroyed. And if the system gets compromised, it could be accessed again at some point in the future. This section covers the issues and makes recommendations for home users of the Internet 💜

7.1 Beware of Daemons 👹

A home system that uses PPP to connect directly to the Internet is becoming increasingly common ✨ These systems are at the greatest risk if they run certain kinds of programs called "services". If you run a service, you're basically making your computer available to others across the network. Some services include:

  • File servers (an NFS server, or a PC with 'file sharing' turned on)
  • An FTP server
  • A Web server

There are, in general, two types of programs that operate on the Internet: Clients (like web browsers and Email programs) and Servers (like web servers and mail servers) 🧚

Most software on home systems is the client variety. But server software is increasingly available on traditionally client platforms (e.g., PCs). Server software that runs in the background is called a "daemon" (pronounced dee-mon) 😌 Lots of Internet server programs that run as daemons have names ending in d, like inetd (Internet Daemon) and talkd (Talk Daemon). When they're set to run, these programs wait for clients to request a particular service from across the network 👂

There are four very important things to keep in mind about the security implications of running services on a home computer 🔥

  • First and most important, if a server isn't properly configured, it's very vulnerable to being attacked over a network. If you run services, it's vital that you're familiar with the proper configuration. This is often not easy, and may require training or technical expertise 🤓
  • All software has flaws, and flaws exploited deviously can be used to breach computer security. If you run a server on your home machine, you have to stay aware 👀 This takes work: you have to stay in touch with the software supplier to get security updates. It's highly recommended that you keep up with security issues through online security forums. See [RFC2196] for a list of references.

If security flaws in your server software are discovered, you'll need to either stop using the software or apply "patches" or "fixes" that eliminate the vulnerability. The supplier of the software, if it's a decent company or freeware author, will supply information and updates to correct security flaws. These "patches" or "fixes" must be installed as soon as possible 🚑

  • As a rule of thumb, the older the software, the greater the chance it has known vulnerabilities. That doesn't mean you should simply trust brand new software either! Sometimes it takes time to discover even obvious security flaws in servers 🕰️
  • Some servers start up without any warning 😱 Some web browsers and telnet clients automatically start FTP servers if they aren't explicitly configured not to. If those servers aren't properly configured themselves, the entire file system of the home computer can become available to anyone on the Internet. Yikes!

In general, any software MAY start up a network daemon. The way to be safe here is to know the products you're using 📚 Read the manual, and if any questions come up, call the company or email the author of the free software to find out whether using the product means you're actually running a service.

A home user running a remote login service on his home machine faces very serious risks 🚨 This service lets the home user log in to his home machine from other computers on the Internet, and it can be super convenient. But the danger is that someone could secretly watch the login and then be able to masquerade as the user whenever they like in the future. See "The Wires Have Ears" for precautions to take with remote log in 🎧

If possible, turn on all the "logging" options in your server software that relate to security 📝 You need to review these logs regularly to actually get any benefit from them. Also, logs often grow very quickly in size, so be careful they don't fill up your hard disk! 💾

7.2 Going Places ✈️

Remote logins give a user privileged access to physically remote systems from the comfort of their own home 🛋️

More and more companies are letting employees work from home with access to their computer accounts through dial-up connections 💻 As the convenience of Internet connectivity has led to lower costs and wide-spread availability, companies may allow remote login to their systems over the Internet. Customers of companies with Internet access may also get remote login accounts. These companies include Internet service providers and even banks 🏦 Users should be very careful when making remote logins.

As discussed in the "The Wires have Ears" section, Internet connections can be eavesdropped on 👂 If you plan to use a remote login service, check that the connection can be done securely, and make sure you use the secure technologies and features.

Connections may be secured using technologies like one-time passwords, secure shell (SSH) and Secure Sockets Layer (SSL) 🔐 One-time passwords make a stolen password useless, while secure shell encrypts the data sent over the connection. Check out "Don't Get Caught in the Web" for a discussion on SSL 🕸️ Secure services like these have to be made available on the systems you log in to remotely 🫶

7.3. Secure It! 🔒

Okay so, running your own home computer means YOU get to pick what software lives on it, which is kind of iconic. 💅 Encryption software protects your data. If you keep business records or other sensitive stuff on your machine, encryption helps keep it safe. 🔐 Say you ran a network service from home and forgot to set restrictions on a private directory. A remote user (authorized or not, yikes) could get into those files. If the files are encrypted, they can't read them. 🙈 BUT, and this is the big but, every kind of encryption on any system is only as good as its keys and passwords, so those need to be kept safe FIRST! 🗝️✨

8. A Final Note 🌸

This document gave you an intro and as much concise detail as it could fit. 🧚 Security issues go out of date super fast, and even though we tried to keep things general, the examples might not be relevant later on as the Internet and the computer industry keep growing. 🌈

Here's the vibe check: homeowners are now taking extra precautions, even if it's less convenient, to keep their homes safe in our changing world. Network users should do the same and not ignore security. 💖 It might be a hassle, but it's always better to be safe than sorry. 🫶

Appendix: Glossary of Security Terms 📖✨

Acceptable Use Policy (AUP)

A set of rules and guidelines that spell out, in more or less detail, what's considered appropriate use of systems or networks. 📋

Account

See (Computer) Account 👀

Anonymous and Guest Log In

Services can be available without any kind of authentication, no ID needed! 🦋 This is common with FTP for anonymous access, for example. Other systems have a special account called "guest" for access, and that account usually has its privileges restricted. 🙈

Auditing Tool

Tools that check computer systems or networks for their security status, or for how safe the services they provide are. COPS (Computer Oracle Password and Security analyzer) and SATAN (Security Administrator's Tool for Analyzing Networks) are famous examples. 🔍👑

Authentication

Authentication is the mechanism used to verify a user's identity. Usually the user supplies a name and a password as proof of who they are. 🪪

Centrally-Administered Network

A network of systems that belongs to one group of administrators who aren't spread out, but work from a central place to look after the whole network. 🏢

Certificate

Certificates are data used to verify digital signatures. A certificate is only as trustworthy as the agency that issued it. 🏛️ It checks a particular signed item, like an Email message or a web page. The digital signature, the item and the certificate all get processed by a mathematical program. If the signature is valid, you can say: "According to the agency that issued the certificate, the signer was (some name)". ✅

Clean System

A computer that has been freshly installed with its operating system and software from trusted distribution media. 🧼 The more software and configuration you add, the harder it gets to tell if the computer is still 'clean', or if it's been compromised by viruses, trojan horses or misconfiguration that lowers its security. 😬

Client

Depending on your point of view, a client can be the computer an end-user uses to reach services hosted on another computer, called a server. 💻 'Client' can also mean a program, or a part of a system, that an end-user uses to access services provided by another program. (A web browser is a client that accesses pages provided by a Web Server, for example.) 🌐

Compound Documents

A 'document' is a file containing a set of data. Files can have multiple parts: a plain document, an encrypted document, a digitally-signed document or a compressed document. 🎀 Multi-part files are called compound documents, and they may need a bunch of different programs to interpret and manipulate them. Those programs can run without the user even knowing. 👀

(Computer) Account

This describes the authorization to access a specific computer system or network. 🔑 Each end-user has to use an account, which most likely means a combo of user name and password, or some other way of proving that they're the person the account belongs to. 💖

Configuring Network Services

The part of an administrator's job about setting the conditions and details of network services, which control how the service is provided. 🛠️ For a Web server, that includes which Web pages are available to whom, and what kind of information gets logged for later review. 📝

Cookies

Cookies record information about a visit to a web site so the server can use it later. 🍪 A server can also receive cookie information from other sites, which can be a privacy concern. 😳

Cracker

A term for attackers, intruders or other bad guys who don't play by the rules and try to get around security mechanisms, or who go after individuals and organizations. 🦹

Daemons (inetd, talkd, etc.)

Processes that run on computer systems to provide services to other computer systems or processes. 🧚 Daemons are usually considered "servers". 🖥️

Decrypting

Reversing the encryption of a file or message to get the original data back so it can be used or read. 🔓

Default Account

Some systems and server software come with preconfigured accounts. These can have a predefined user name and password that let anyone in, and they're often there so people can log in easily at first. 😬 Default accounts should be turned off, or have their predefined passwords changed, to lower the risk of abuse. 🚫

Dial-in Service

A way to access computer systems or networks over a telecommunications network. ☎️ A computer uses a modem to call another modem, which then provides 'network access service'. See also: PPP. 📞

Digital Signature

A digital signature is created by a mathematical computer program. It's NOT a handwritten signature, or a computer-made picture of one. ✍️ It's more like a wax seal that needs a special stamp to make it, and it's attached to an Email message or file. The origin of the message or file can then be verified with the digital signature, using special tools. 🔏✨

Downloaded Software

Software packages retrieved from the Internet, for example using the FTP protocol. 📦

Downloading

The act of retrieving files from a server on the network. ⬇️

Email Packages

To communicate by electronic mail, an end-user usually uses an Email client, which gives them the interface to create, send, retrieve and read Email. 💌 Different Email packages offer the same basic functions but have different interfaces and sometimes special extra features. Some also have encryption and digital signature capabilities. 🔐

Email Security Software

Software that adds security through digital signatures, encryption and decryption, so end-users can protect messages and documents before sending them over a possibly insecure network. 🛡️ PGP is an example. 💜

Encrypting / Encryption

A mathematical process of scrambling data to protect privacy. 🌀 (Yes, the original spells it "scambling", but the vibe is the same! 😂)

Encryption Software

The software that actually gives end-users the ability to encrypt messages and files. PGP is one example. 🧁

End-User

A human being who makes use of computer systems and networks. 🙋

Files (programs, data, text and so on)

Files include user data, but also programs, the computer's operating system and the system's configuration data. 📁

File Server

A computer system that lets users with access share and work on the files stored on it, over a network. 🗂️

File Transfer

The process of moving files between two computer systems over a network, using a protocol like FTP or HTTP. 🚚

Fixes, Patches and installing them

When vendors find security vulnerabilities, they provide sets of files that have to be installed on computer systems. 🩹 These files 'fix' or 'patch' the system or programs and remove the vulnerability. Go install them, bestie! 💅

FTP (File Transfer Protocol)

A protocol that lets files move between an FTP client and an FTP server. 📤

Group of Users

Security software often lets you set permissions for groups of users, instead of individuals. 👯

Help Desk

A support entity you can call when you have a computer or communication problem. ☎️🆘

Internet

A collection of interconnected networks that use a shared set of protocols, called the TCP/IP stack, so the connected computer systems can communicate. 🌍🕸️

Key Escrow

Keys are used to encrypt and decrypt files. Key escrow is used to store keys so third parties can access the data in encrypted files. 🗝️👀 (Spicy! 🌶️)

Keys Used to Encrypt and Decrypt Files

To use encryption, an end-user has to provide some secret, in the form of data, usually called a key. 🤫🔑

Log In, Logging into a System

An action an end-user takes when they authenticate themselves to a computer system. 🚪

Log In Prompt

The characters displayed when you log into a system, asking for your user name and password. ⌨️

Logged In

If an end-user has successfully proven they have legitimate access to a system, they're considered logged in. ✅🎉

Logging

Systems and server software often can keep track of events. 📜 Events can be written out to a file called a log. The log can be read later, and it lets you identify system failures and security breaches. 🔎

Masquerade (see Remote Log In)

Anyone who pretends to be someone they're not in order to get into a computer account is said to be 'masquerading'. 🎭 They might give a fake user name, or steal someone else's password and log in as them. 😤

Network File System (NFS, file sharing with PCs, etc.)

NFS is an application and protocol suite for sharing files between clients and servers. 📂 Other protocols also give file access over networks. They offer similar functionality, but they don't interoperate with each other. 🙃

Networking Features of Software

Some software uses the network to retrieve or share data. 📡 It might not be obvious that the software has networking features at all! 👻

Network Services

Services that aren't provided on the local computer the end-user is working on, but on a server somewhere in the network. 🌐🧃

One-Time Passwords (OTP)

Instead of reusing the same password every time, you use a fresh one on each later login. 🔐✨

Passphrase 🎀

A passphrase is just a super long password. It's usually a bunch of words and symbols stuck together, which makes it way harder to guess. 💅

Password-Locked Screensaver 🌙

A screensaver covers up what's on your monitor. A password-locked one can only be turned off if the end-user types in their password. This stops someone from messing with a logged-in computer and keeps your current work hidden from nosy passers-by. 🙈

Patch 🩹

See "Fixes, Patches and installing them" 💖

Permissions 🗝️

Another name for the access controls that decide who can get into files and other resources. 🔑

PGP (Pretty Good Privacy) 🔏

PGP is an app package with tools for encrypting and digitally signing files on a computer. It's especially handy for encrypting and/or signing files and messages before you send them over Email. 💌

Plug-in Modules 🧩

Little software pieces that plug into other software, like web browsers, to give them extra features. ✨

Point-of-Contact, Security 📞

When there's a security breach or problem, lots of organisations have a designated point-of-contact. This person can alert others and take the right actions. 🚨

PPP (Point to Point Protocol) 🔌

PPP is the mechanism most end-users use to set up a network connection between their PC and their Internet service provider. Once they're connected, the PC can send and receive data to any other system on the network. 🌐

Privacy Programs 🕵️‍♀️

Another term for encryption software, one that really emphasises that it's being used to protect the confidentiality, and therefore the privacy, of the end-users who rely on it. 🛡️

Remote Access Software 📡

This software lets a computer use a modem to connect to another system. It can also let a computer "listen" for calls on a modem, in which case that computer is providing "remote access service". 📞 Remote access software might give access to a single computer or to a whole network. 🏠

Remote Log In 🚪

If an end-user uses a network to log in to a system, that act is called remote log in. 🌍

Security Features 🔍

These are features that protect a system or help end-users and administrators check how secure it is, for example by auditing it. 📋

Security Policy 📜

Organisations write a security policy to handle security issues, in the form of "do's" and "don'ts". These guidelines and rules are for users when it comes to physical security, data security, information security and content. For example, a rule might say that sites with sexual content should not be visited, and that copyrights should be honoured when downloading software. 🙅‍♀️

Server 🖥️

A server is a computer system, or a set of processes on a computer system, that provides services to clients across a network. 🫶

Shared Account 👯

A common account is one shared by a group of users, unlike a normal account, which only one user can access. If a shared account gets misused, it's very difficult or impossible to know which of the users was responsible. 😬

Sharing Permissions 📂

Lots of computer systems let users share files over a network. These systems almost always have a way for users to control who gets to read or overwrite those files. 👀

Site 🏢

Depending on the context, a site might mean computer systems grouped together by geographical location, organisational jurisdiction, or network addresses. A Site usually means a network under one common administration. 🗺️

SSH (Secure Shell) 🐚

SSH provides a protocol between a client and a server that allows encrypted remote connectivity. 🔒

SSL (Secure Sockets Layer) 🧁

This protocol adds security services to otherwise insecure protocols that run over a network. SSL is typically what web browsers use to encrypt data sent to and downloaded from a server. 🌐🔐

Systems Administrator 🧑‍💻

This is the person who maintains the system and has system administrator privileges. To avoid mistakes while they're not acting as an administrator, they should limit the time they spend acting as an administrator (as far as the system is concerned) to a bare minimum. ⏱️

System Administrator Privileges 👑

System administrators have more rights, meaning greater permissions, because their work involves maintaining system files. 💪

System Files ⚙️

These are the files on a system that don't belong to end-users, and they control how the system works. System files have a huge impact on the system's security. 🚨

Telnet 📟

A protocol that lets you log in remotely to other computer systems over the network. 🕰️

Terminal 🖥️

A "dumb" device connected to a computer system so that users and administrators can get text-based access to it. 🤖

Terms of Service (TOS) 📝

See "Acceptable Use Policy (AUP)". 💖

Threats ⚠️

The potential for an existing vulnerability to be exploited to compromise the security of systems or networks. Even if a vulnerability isn't known yet, it still counts as a threat by this definition. 👻

Trojan Horse 🐴

A program that secretly carries a way for its creator to get access to the system it runs on. 🎭

Virus 🦠

A program that copies itself onto computer systems by sneaking into other programs, secretly and with bad intent. A virus can get onto a computer system in a bunch of different ways. 💀

Virus-Detection Tool 🛡️

Software that detects and possibly removes computer viruses, and alerts the user about them. 🔍

Vulnerability 🕳️

A vulnerability is a weakness, a design flaw, or an implementation error that can lead to an unexpected, unwanted event. That event can compromise the security of the system, network, application, or protocol involved. 😱

Web Browser Cache 🗄️

This is the part of the file system used to store web pages and related files. It can reload recently visited files from the cache instead of fetching them from the network every single time. ⚡

Web Browser Capabilities 🌈

The set of functions a web browser gives the end-user, including the set of plug-ins available. 🧰

Web Server 🌸

A server program that gives access to web pages. Some web servers also give access to other services, like databases and directories. 📂

Worm 🐛

A computer program that replicates itself and spreads on its own. Unlike viruses, worms are meant to spread across network environments. 🌐

Acknowledgments 🫶

The User Security Handbook was a collaborative effort of the Site Security Handbook Working Group of the IETF. There were also others who made significant contributions. Simson Garfinkle and Eric Luiijf provided very helpful feedback on this document. The Glossary contribution by Klaus-Peter Kossakowski is much appreciated. 💜

References 📚

[GLOSSARY] Malkin, G., Ed., "Internet User's Glossary", FYI 18, RFC
           1983 August 1996.

[RFC2196]  Fraser, B., Ed., "Site Security Handbook", FYI 8, RFC 2196
           September 1997.

Security Considerations 🔐

This document talks about what computer users can do to make their systems more secure. It's literally the whole point, bestie! 💅

Authors' Addresses 💌

Erik Guttman
Sun Microsystems
Bahnstr. 2
74915 Waibstadt
Germany

Phone: +49 7263 911701
EMail: erik.guttman@sun.com


Lorna Leong
COLT Internet
250 City Road
City Forum, London
England

Phone: +44 171 390 3900
EMail: lorna@colt.net


Gary Malkin
Bay Networks
8 Federal Street
Billerca, MA 01821
USA

Phone: +1 508 916 4237
EMail: gmalkin@baynetworks.com

Copyright (C) The Internet Society (1999). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🌈

📦 where this page comes from