Advice for a novice: which defense strategy is appropriate?

Greetings,

First of all, congratulations to the people running this forum. From the point of view of a novice, just browsing without even asking questions enables to better understand this complex world of computers and internet, the benefits and the risks.

Second: sorry for a long post for such a simple matter! I figure if I ask this to someone just once, I'll avoid asking many anoying questions throughout the forum. I know there are people who like to ask others to save themselves the task of researching, and this can be frustrating, especially for advanced users. My intention is not to get someone to do the thinking for me here. On the contrary! Like any person who needs a solution I do my research. But recognizing that this isn't my field I've got to the point where I need proper advice.

I purchased a laptop 7 months ago. Only recently have I become aware of all the threats such as tracking cookies, network intrusion and key-logging (not to mention what other people are doing. This article posted here on the forum in case you missed it: https://www.wilderssecurity.com/showthread.php?t=229880&highlight=government+hacking).

Nothing has “hit” yet, but like everyone I wish to prevent rather than repair.

I've managed to understand the different levels of defense (critical-layering-personal), but somehow I need advice on how to get there.

Basically, I'm not trying to pose the question: "which is the best brand or product", because there's many threads in this forum which discuss tools and their pros and cons. Rather, I would appreciate a lot if someone could simply share some advice on what measures to take in the following scenario. Such as what one should be looking for in terms of a general defense system, in order to reach the following goals:

Desired protection

1. secure emailing. Went from Gmail to Hushmail, then read about Hushmail case...now looking for a new email address.
2. Prevention from computer/browser intrusion
   (am very interested in virtualisation. Still learning. I see many in this forum use a "sandbox". I'll check appropriate threads for this though).
3. Prevention of data being sent out unknowingly / programs communicating through internet for no valid reason (just put my hands on the EULAliser mentioned on this forum)
4. Leaving no trace while on the internet / “stealth” surfing
5. Protection for online transactions
6. Having no traces of internet activity left on the computer after browsing
7. Permanent deletion of unwanted files on the hard drive.

The following info might be useful:

Computer & OS

• Sony Vaio Laptop / 140GB memory on hard drive / 500GB externally
• Dual CPU / 2GB RAM
• OS: Windows Vista Home Premium / 32bit

Prorams

• Opera browser
• BitDefender Total Security 2009
• + Other protection & cleaning software (trial and open source). As mentioned, will refer to appropriate threads for comparison.

Network

• Private wireless network / WEP protection (manufacturer of router said higher encryption would conflict with Vista??)

What I use the computer for

• Regular internet research
• Frequent email
• Online banking / billing / purchasing
• Data & file downloads from internet (ex: pdf, torrents)
• No gaming

Voilà! My sincere apologies if I put more info than needed, but I saw in other threads that often people ask for detailed info on OS etc.

I look forward to getting the clearer picture. I hope any people with a similar scenario may benefit from a reply to this post.

I thank you in advance for your patience and for sharing knowledge.

Best regards.

 

Hello,

This may interest you:

Safe Web practices - How to remain safe on the Internet
http://www.dedoimedo.com/computers/safe_web.html

Mail security - Keep your inbox safe
http://www.dedoimedo.com/computers/mail_security.html

In general, this may sound boring but:

1) basic firewall (windows built-in is fine).
2) good browser (opera, firefox).
3) don't run files you are not fully sure of: like cracks, executables from people you do not trust, all sorts of free screensavers or whatnot etc.

And you don't need more. Seriously. The rest is fun, hype, education, perks, and hobby. You can run virtualization, sandboxing, anti-virii, this, that, whatever you like, but ultimately, it comes down to what you do. If you don't click on files without thinking, nothing will happen.

You will hear a lot about drive-by-downloads and such, but if you use opera, as you do, this is a non-issue for you. In general, any sort of remote execution threats rely on all sorts of vulnerabilities in software and the user clicking on stuff. Keep software updated, avoid "cooperating" with links and files that might be suspicious and you'll be fine.

Example: Someone you don't know sends you a file over skype. Very simple, don't open it. Someone sends you a link in email. Not sure? Don't click. You got a file that you don't know what it might be. Not sure? Don't click.

And so on. It can be very simple or very difficult. However you prefer it. Of course, you can start analyzing executables and digest email headers and hax the hexa of binaries and sniff tcp packets, but this is all perks. The basics is all about simple common sense similar to real life. Do you eat cookies given to you by stranges? No. So why click on a file you get from a stranger. If someone you don't know offered to give you a ride to somewhere, would you accept the invitation? No. So why click on such stuff in emails and on various websites.

That's it.

You'll see that security can be fun. But deep down, it's boring.

Mrk

 

Greetings,

Thanks for replying to my post(s), again.

Thanks for the useful links.

Your advice makes sense and seems down to earth. That's some good advice given that complete protection seems impossible. As you said: "make sure where we step like we would in day-to-day-life".

I appreciate the exchange.

Best regards.

TKH