Terry's Computer Tips - Newsletter
October 21, 2007

Volume 3, Number 19 — Sunday, October 21, 2007

Part 1 | Part 2 

4.  Securing Your Wireless Network - Securing Your Wireless Router

You've bought your wireless router. You've plugged in the Ethernet cable to the cable modem or DSL modem. You've probably installed the software (that came with your wireless router)on your notebook or desktop that will connect wirelessly.

You might even have followed the directions in the router's manual — whether you did or didn't you've discovered that you now have a working Internet connection via your new wireless system.

All is right with the world; nothing to do now except surf the net, right? Wrong!

You need to secure your wireless network so that it doesn't allow anyone but your family (or your co-workers, whichever is appropriate) to access the Internet — and the other computers on your network — via your router.

You need to secure the wireless network so that your router won't even talk to unknown computers. If you allow others to use your wireless connection to get to the Internet, it's your IP address that will show up in anything that they do (share music? spam? download porn?).

The first step is to hook your computer (or a computer) directly to the router using an Ethernet cable. Even for a wireless network, this is a necessary requirement for the initial configuration — almost every time you change a security setting for the wireless connections, you will lock out your wireless computer until you change its settings. Sometimes that will require you to either reboot (the easy way to solve the problem) or to issue several ipconfig commands in a Windows command window. By hooking up with the wired connection, you prevent getting disconnected over and over.

The second step is to change the SSID from the default SSID. The SSID is the identifier for that wireless network and is set in the router's configuration settings (which you access via your web browser). The default SSID for a Linksys wireless router is "Linksys," although you can change yours to anything you like.

From the client computer, such as a notebook, you see the SSID when you telll Windows to View Available Networks, then you select the network to which you will connect by selecting the SSID. So, the reason you change the SSID is to make sure you're connecting to your network.

You can set your router not to broadcast the SSID or to broadcast it. However, there's not a lot of security benefit to hiding the SSID.

The next thing you should do is to set the router to respond only to specific MAC addresses. Each networking device (network card, router, wireless "card", etc) has its own unique MAC address. So, we tell our router not to listen to anyone's but ours.

Once we've changed our SSID and set our MAC address filter on the router, we're ready to set the encryption.

With the Linksys WRT54G that I use, the encryption methods (which it calls Security Modes) are:

• Disabled
• WPA Personal
• WPA Enterprise
• WPA2 Personal
• WPA2 Enterprise
• RADIUS
• WEP

Each of these has individual settings pertinent to that type of encryption (e.g., WPA and WPA2 allow you to pick AES or TKIP+AES; WEP allows you to pick 64-bit or 128-bit encryption).

Of course, you set the key you want to use for your encryption (the long password). One of the nice things about WPA and WPA2 is that you can type words. All too often with WEP, you may be able to type the password key into the router, but you'll have to read the hexadecimal result and type that into your wireless computer.

Which type of encryption should you use?

Your choice should be WPA2. If it's not available, use WPA. Both will give you significantly better encryption than does WEP.

If you're not in a business setting with corporate-type security hardware, you won't have the necessary systems to use the Enterprise versions of WPA or WPA2 or the RADIUS system, either.

WEP is your last choice! While WEP was the acronym for "Wired Equivalent Privacy," it is anything but that. With today's computers memory and speed, someone can crack your 64-bit or 128-bit encryption in hours.

You should use WPA2, if it is available in your router and in your operating system. If WPA2 is not available, WPA should be your choice.

If you've got an old Windows 98 or Windows Me system, you're only going to be able to do WEP. The real problem is that you can only have one type of encryption on your network — and if you've got another type of wireless device (e.g., a printer), it may only be capable of WEP encryption.

Now, most wireless routers have excellent sections on how to set up and secure the network. I recommend that you follow the instructions — on day one — this isn't something to put off until later.

5.  My Computer Security Software Recommendations

Anti-Virus

For your anti-virus needs (and, yes, you do have anti-virus needs!) I recommend anti-virus software from Trend Micro (PC-cillin Internet Security, if you want a combination package) or ESET (NOD32, my choice).

I'm glad to see that Trend Micro has taken a major, user-friendly step with their PC-cillin Internet Security 2007 by licensing it for up to 3 home users. (You can also get a 3-year license.) TrendMicro provides an easy-to-use product that is from one of the big names in the anti-virus world.

I'm often asked about several other popular anti-virus or anti-virus combination packages. Yes, I realize that they are not in my recommendation list. "Enough said..."

My personal choice is the ESET's small, fast NOD32 anti-virus program, which offers a FREE 30-day evaluation license. I consider NOD32 to be the cream of the crop in anti-virus protection. Unlike some of the others, ESET offers multiple-year licenses also, including updates to the program in the multiple-year license.

Many antivirus programs will offer you an anti-virus signature subscription renewal when your subscription renews. I strongly recommend against this option. Vendors routinely improve the capabilities and speed fo the programs also.

If you update only the signatures, you miss any program improvements. Fortunately, NOD32's subscriptions include both program updates and signature updates.

Read more about anti-virus programs on my web site.

Related articles:

• Anti-Virus Programs and Online Scanners
• Free Online Antivirus Scan
• NOD32 Anti-Virus Review - A Look at NOD32

Firewall Software

If you get the PC-cillin Internet Security package above, you are covered from a firewall point of view.

While the Windows XP firewall is much better than no firewall at all, don't count on the Windows XP firewall to meet your needs. You need a two-way firewall, which the Windows XP firewall is not!.

The Windows XP firewall does not control outbound communications originating from your computer — and you should want to have control if adware/trojans/spyware or even commercial products want to talk to the Internet.

Do you want Windows Media Player to call home every time you play something? It does! Do you use the Search function in Windows Explorer to find things on your hard drive? Did you know that every time you search, Windows Explorer talks to Microsoft — I didn't know that when I ran ZoneAlarm, but the Sunbelt Kerio Personal Firewall flags that for me, and I can stop or allow it to happen.

Many other programs call home when you run them, too.

If you don't get either of the above multi-function packages, I recommend my choice for a firewall program is Sunbelt Personal Firewall.

You can try the full-featured "paid version" of Sunbelt Personal Firewall free for 30 days — after that, you can register it or, if you're using it on a home non-business computer, you can let it revert to the free, lesser-function license. Sunbelt Personal Firewall is $19.95 (with discounts for multiple computers!) for a non-expiring license for the program and includes one year of their updates subscription.

Related articles:

• The Internet Versus You
• Do I Need a Firewall Program?
• Sunbelt Personal Firewall Review

Anti-Spyware / Anti-Adware Software

CounterSpy, from Sunbelt Software, has received many kudos from the computer press for its always-running and periodic full system scans. It is also my personal choice for my PC's and my family's PC's.

Sunbelt released their CounterSpy v2 in early February and I promptly updated my computers to it. Version 2 greatly improved CounterSpy's performance and reduced its load on the computer when it was scanning.

Recently (late July, 2007), Sunbelt released v2.5 of CounterSpy, which again both improved CounterSpy's performance against malware and reduced its impact on system resources and responsiveness when its scanning.

Related articles:

• Fighting Against Spyware & Malware
• CounterSpy Review

Anti-spam Software

In today's Internet world, the question is not "if" you will get spam, but "how much will you get?"

I use and now I recommend POPFile as my first choice for handling spam. POPFile sits on your computer, between your email program and your ISP mailbox, and handles emial as it downloads.

POPFile uses a different approach to handle spam than some other programs do — it does nothing to reduce spam. It is designed as an email classification tool — you train it to recognize spam and any other type of email that you want to classify. These classifications can help you sort your emails into appropriate folders in your email program.

Sunbelt Software, who makes the anti-spyware program CounterSpy (which I use and recommend) and the firewall that I use and recommend (Sunbelt Kerio Personal Firewall) also has a well-regarded, award-winning anti-spam program called iHateSpam for Outlook and Outlook Express. Since I don't use Outlook or Outlook Express for email, I haven't tried iHateSpam.

Mailwasher Pro is my first choice to handle spam before it ever gets into your computer's Inbox. Mailwasher Pro uses on-line Realtime Black Lists mail servers sending spam recently, "training" by you of what you think is spam, and your own "friends" and "blacklist" lists.

Mailwasher Pro can even bounce spam messages, as if your email address was not valid, although the usefulness and appropriateness of this is questionable. There is a free version called "Mailwasher," but it omits the functions that I consider critical for this purpose -- such as safely previewing the emails safely before they ever get to your email inbox.

Cable/DSL Router

If you have a cable modem or a DSL modem, you need to have another layer of inexpensive protection between you and the Internet. A cable/DSL router isolates your computer from direct connection to the Internet. Your computer can easily request your email, web pages, etc. through the router. The responses come back to the router and are smoothly routed to your computer. But, someone on the Internet side of the router can not initiate a connection to your computer — they can only respond to your request.

Even if you only have one computer to connect to your cable or DSL modem, I recommend that you purchase and use a cable/DSL router because of the protection it can give you against attempts to attack through some flaws in Windows itself.

A router isolates your local network, whether it is only one computer or several, from the Internet by actually making it a separate network. The router gets the "public" IP address and handles all your outbound communications and the responses to them. But, it blocks computers on the Internet side from being able to initiate communications with your computer! This will prevent you from falling prey to many worms that try to attack security holes in Windows itself.

For a wireless router, I recommend the Linksys WRT54G wireless router. I'm using the relatively new version 6 of this router.

If you don't want wireless, I recommend the Linksys BEFSR41 wired router. Either way, based on my experience, I recommend Linksys routers for price, reliability and Linksys' habit of releasing updated firmware for their products..

See these related articles:

• Wireless Security
• Wi-Fi Hotspots and Computer Security
• Wireless Networking Problems & Wireless Networking Security