Schneier on Security

Chapter 12. Computer and Information Security

Safe Personal Computing

Originally published in CNet, 9 December 2004

Iam regularly asked what average Internet users can do to ensure their security. My first answer is usually, "Nothing—you're screwed."

But that's not true, and the reality is more complicated. You're screwed if you do nothing to protect yourself, but there are many things you can do to increase your security on the Internet.

Two years ago, I published a list of PC security recommendations. The idea was to give home users concrete actions they could take to improve security. This is an update of that list: a dozen things you can do to improve your security.

• General: Turn off the computer when you're not using it, especially if you have an "always on" Internet connection.

• Laptop security: Keep your laptop with you at all times when not at home; treat it as you would a wallet or purse. Regularly purge unneeded data files from your laptop. The same goes for PDAs. People tend to store more personal data—including passwords and PINs—on PDAs than they do on laptops.

• Backups: Back up regularly. Back up to disk, tape, or CD-ROM. There's a lot you can't defend against; a recent backup will at least let you recover from an attack. Store at least one set of backups off-site (a safe-deposit box is a good place) and at least one set on-site.

  Remember to destroy old backups. The best way to destroy CD-Rs is to microwave them on high for five seconds. You can also break them in half or run ...