Information Technology (IT) is strongly committed to providing all university students, faculty, and staff with a safe, stable, virus-free computing environment. Towards that end, IT recommends the following "best practices" for browsing the Web and ensuring your computer is free from viruses and other malicious code.

1. First and foremost, install an antivirus solution and keep it up-to-date. An annual subscription usually only costs around $40 or so – unless you are a university student, faculty or staff member. Then it is FREE!
   
   IT offers FREE McAfee VirusScan (for Windows PC users) and Virex (for Apple Macintosh users) to all students, faculty and staff. Previously, only students were able to download the free version of McAfee. Now faculty and staff can enjoy the same virus-protection benefit as students.
   
       Download a FREE version of McAfee antivirus software
   
   
2. Along with installing antivirus protection, ensure your computer’s operating system is up-to-date by regularly installing security patches and updates. If you can, ensure that your computer’s auto-update feature is turned on (particularly for Windows XP users). This will ensure that your computer will automatically attempt to update its operating system whenever it is connected to the Internet. On-campus machines are updated at least once a month, usually on a Tuesday afternoon around 3 pm.
   
   You should only download patches and updates from known authorized Web sites. For instance, Windows XP users should only download patches from http://windowsupdate.microsoft.com.
   
   
3. Your Web browser should be of the latest version and should be capable of using at least 128-bit encryption for secure communications. Many Web browsers are available for free download, such as Microsoft Internet Explorer 6 and Mozilla Firefox, both of which are fully supported by IT.
   
   When visiting a secure Web site, always look for a little lock icon in the bottom-right corner of your Web browser, which indicates a secure, encrypted connection. Also, the URL in the address field for the browser will start with "https" instead of "http". The extra "s" lets you know that it is a secure Web site.
   
   
4. Disable plug-ins and configure security settings to not run Java applets, JavaScript/VBScript, ActiveX controls, etc. without prompting you for permission first. Many Web-based exploits can compromise a computer’s security if you automatically allow every script to run when a page loads. If you need to have a plug-in for a particular activity, enable it temporarily for that activity only and then disable it again. If you are unsure about how to do this, contact the IT Help Desk at 573-341-HELP or stop by the IT Walk-in Center and an IT analyst will be happy to walk you through the process.
   
   
5. DON’T click links in an email or Instant Message. Some links can take you to pages that will automatically load malicious code onto your system (such as a bot, which can enslave your computer to another computer’s will). Copy and paste links of unknown origin to your browser instead of clicking them.
   
   Another technique is to hover your mouse over the link in the message. If the tool-tip does not match the link in the message, then don’t click on it (this is not a surefire method as tool-tips can be "spoofed", but can be used to easily check if a link is valid or not).
   
   
6. If more than one person uses your computer for Web surfing, or you do not have a screen saver with passwords, do not save passwords to Web sites. In other words, if you normally allow your Web browser to save passwords and someone else has easy access to that computer, then you need to stop.
   
   This is particularly important when using Computer Learning Center (CLC) machines. If you use a CLC machine for Web browsing and forget to logout for some reason (it happens all too frequently), then the next person who uses that machine for Web browsing will be able to access your online accounts if you store your passwords in the Web browser’s cache.
   
   
7. If your computer stores sensitive information, don’t browse the Web. In the business environment, computers that are used to hold classified data should not be used for Web browsing at all. Indeed, in many cases those computers are isolated from the general network and can only access a very limited number of systems. This helps limit Web-based attacks to computers that don’t contain sensitive information.
   
   
8. Consider using different Web browser for different activities. In some cases it may be a necessity. For instance, Windows Update will only run through Internet Explorer (IE). If you normally use Firefox for Web browsing, you will still need to use IE in order to update a Windows-based machine. Here is another example: A recent IE exploit made it possible for a hacker to collect information such as passwords typed into banking Web sites using a software key logger. Because of this hack, it is more prudent to use an alternative browser for visiting sites that require authentication (such as a banking site or any Web site that may require you to enter in credit card information).

If you have any questions about these items or would like some assistance with configuring your Web browser for maximum security, please contact the IT Help Desk at 573-341-HELP or submit an online Help Request.

Additional Links

• http://www.windowsecurity.com/articles/Web-Browser-Vulnerabilities.html -- several of the items above were taken from this page.