The Personal Computer

The PC is so vulnerable that user awareness and training are of paramount importance to assure even a minimum degree of protection. PC vulnerable areas include:

Access control

Considerable progress has been made in security management and technology for large-scale centralized data processing environments, but relatively little attention has been given to the protection of small systems. Most PCs are single-user systems and lack built-in hardware mechanisms that would provide users with security-related systems functions. Without such hardware features (e.g., memory protection), it is virtually impossible to prevent user programs from accessing or modifying parts of the operating system and thereby circumventing any intended security mechanisms.

PC floppy disk drive

The floppy disk drive is a major asset of PC workstations, given its virtually unlimited storage capacity via the endless number of diskettes that can be used to store data. However, the disk drive also provides ample opportunity for sensitive government data to be stolen on floppy disks and for computer viruses to enter the network from literally hundreds of access points. This problem is severe in certain sensitive data environments, and the computer industry has responded with diskless workstations designed specifically for LAN operations. The advantage of diskless PCs is that they solve certain security problems, such as the introduction of unauthorized software (including viruses) and the unauthorized removal of sensitive data. The disadvantage is that the PC workstation becomes a limited, network-dependent unit, not unlike the old “dumb” mainframe terminals.

Hard disk

Most current PCs have internal hard disks ranging from 1 to 2 gigabytes of online storage capacity. Sensitive data residing on these hard disks are vulnerable to theft, modification, or destruction. Even if PC access and LAN access are both password protected, PCs with DOS-based operating systems may be booted from a floppy disk that bypasses the password, permitting access to unprotected programs and files on the hard disk. PC hardware and software security features and products are available to provide increasing degrees of security for data on hard disk drives, ranging from password protection for entering the system to data encryption. “Erasing” hard disks is another problem area. An “erase” or “delete” command does not actually delete a file from the hard disk. It only alters the disk directory or address codes so that it appears as if deletion or erasure of the data has taken place. The information is still there and will be electronically “erased” when DOS eventually writes new files over the old “deleted” files. This may take some time, depending on the available space on the hard disk. In the meantime, various file recovery programs can be used to magically restore the “deleted” file. There are special programs that really do erase a file and these should be used for the removal of sensitive files. A companion issue is that the server may have a copy of the sensitive file, and a user may or may not have erase privileges for the server files.

Repairs

Proper attention must be given to the repair and disposition of equipment. Outside commercial repair staff should be monitored by internal or company technical staff when service is being performed on sensitive PC/LAN equipment. Excess or surplus hard disks should be properly erased prior to releasing the equipment.

PC Virus

PCs are especially vulnerable to viruses and related malicious software such as Trojan horses, logic bombs, and worms. An executing program, including a virus-infected program, has access to most things in memory or on disk. For example, when DOS activates an application program on a PC, it turns control over to the program for execution. There are virtually no areas of memory protected from access by application programs. There is no block between an application program and the direct usage of system input/output (disk drives, communications, ports, printers, screen displays, etc.). Once the application program is running, it has complete access to everything in the system.

Virus-infected software may have to be abandoned and replaced with uninfected earlier versions. Thus, an effective backup program is crucial in order to recover from a virus attack. Most important, it is essential to determine the source of the virus and the system’s vulnerability and institute appropriate safeguards. A LAN/WAN is also highly vulnerable, because any PC can propagate an infected copy of a program to other PCs and possibly the server(s) on the network.

LAN Access

Access Control

A password system is the most basic and widely used method to control access to LANs/WANs. There may be multiple levels of password controls to the LAN and its services, to access to each major application on the LAN, and to other major systems interconnected to the LAN. Conversely, some system access controls depend heavily on the initial LAN log-on/password sequence. While passwords are the most common form of network protection, they are also the weakest from a human aspect. Studies by research groups have found that passwords have many weaknesses, including poor selection of passwords by users (e.g., middle names, birthdays, etc.), poor password administration (e.g., no password guidance, no requirement to change passwords regularly, etc.), and the recording of passwords in easily detected formats (e.g., on calendar pads, in DOS batch files, and even in log-on sequences). Group/multiuser passwords lack accountability and are also vulnerable to misuse.

Dial-In Access

Dial-in telephone access via modems provides a unique window to LANs and WANs, enabling anyone with a user ID, password, and a computer to log into the system. Hackers are noted for their use of dial-in capabilities for access, using commonly available user IDs and cleverly guessing passwords. Effective passwords and log-on procedures, dial-in time limitations and locations, call-back devices, port protectors, and strong LAN/WAN administration are ways to provide dial-in access control.