Beware You Are Being Lulled Into A False Sense of Security

There are people who exploit your lack of knowledge on a subject, to convince you that your safety (security) is assured in their hands. This becomes a “false sense of security” when:

• the person is ignorant on the subject themselves
• the person knows that it is not true and chooses to hide that fact from you
• the person wishes to maintain control over you
• the person convinces you that there is a danger that does not exist, or grossly exaggerates the danger, to help put their actions in a warped perspective

This subject covers so many areas in our lives, over recent times, that I thought that I would cover just one, in this article and then publish more in the coming months.

Home Computer Security Practices

This article is aimed at people who do not have a university computer science degree.

I will attempt to explain in layman’s terms, what your danger is and then what is being peddled by some of the largest software companies. Then you can make informed choices when you sign the next “Terms and Conditions” or “Software Licence Agreement”.

Domestic Broadband Connecting Devices

For most home users, your broadband company will supply you with a “Gateway Modem/Router”. In 2023, these single devices have at least these 4 distinct functions:

1. A modem to communicate with your internet service provider
2. A router (converts your public internet address to a private address)
3. A firewall
4. A WiFi access point

The computer that you connect to this device has at least two distinct functions built-in:

1. A firewall
2. A processing engine to run programs (operating system, such as MS Windows, Apple MacOS, Linux, Android, etc.)

OK, the term “firewall” appears in both places, so I should be doubly safe? It turns out that the “router” function serves as another firewall, so you logically, have a minimum of 3 “barriers” to the internet in every home installation. Great, I’m extra safe!

Believing this is a false sense of security, so I’ll explain why.

Firewall – Myth – Strength Does Not Matter

When you watch movies, or listen to software vendors talk, you could be led to believe that it is possible to design, or build, stronger firewalls. This is not the case. The software firewalls in use today have remained relatively unchanged since 1993. In fact, in 2023 you can rest assured that firewalls built into most equipment, work exactly as designed. They all bock, or allow, network traffic under program control.

Imagine that you are inside a room with solid walls and the only way in, or out, is via a single door. If the door is locked, you cannot leave the room and nobody can come in. This is what a firewall that is “closed” looks like.

Our desire to access the outside world, at will, has brought with it a fundamental weakness to an otherwise perfect firewall. We now need to open the firewall door to let you out. Since it is not much use trying to communicate with something in the outside world, without letting you hear their replies, we only allow traffic back into our firewall when we have initiated the question. This is managed by the firewall automatically.

Domestic Firewalls – Effectively One Way Traffic Only

Since the firewall manages this automatically, almost all domestic firewalls are simply set up to allow you full access to anything in the world and only allow access to your PC from external world sources, where the traffic was initiated by your PC, either by you running an application, or by your operating system doing something autonomously. So now we have a firewall opening up at the request of operating system or an program running on that operating system, and then closing automatically. Additionally, if there are multiple firewalls in a home system as described above, they all operate independently and in exactly the same way. For this reason, each does not change the overall strength of protection you get from only one firewall, running in your broadband modem/router.

To get an overview of the amount of firewall openings that are made, consider these typical functions for a home user. For illustration, I have only included two of the possible operating systems and only listed the most basic of all functions. There are obviously a lot more of both in use today.

From this table, you can see that the weakest point in the system is not the firewall, rather it is the programs that are allowed to run on your PC. This also includes the operating system itself.

On your system, there are programs that you initiate and are fully aware of, and then there are those that are run, without your knowledge, by your operating system and then there is possibility of additional malicious software.

Easy-of-Use Always Conflicts With Security

As, a general rule, if a software product is easier to use, security is reduced, or even removed. Consider how easy it is to use your phone if you have no lock on the home screen. Consider how easy it would be to do your banking, if you did not have to enter a password. We all enjoy ease of use and both the companies that offer it and the cybercrimals know this.

The More “Openings” In Your Firewall, The More Exposed You Become

As soon as software applications are added to an operating system that communicate to the outside world, for example to collect information and send it to Microsoft, Apple, Google, Facebook, Samsung, Sony, etc. you should understand that the “conversation” is initiated from inside the firewall and therefore access is automatically allowed back into your PC from those companies. This is by design!

Now the level of risk for abuse of your PC from the outside world, increases for every application on your PC that attempts to initiate a “conversation”. Remember, the firewall just does what it’s told.

Closed Source Software – Understanding Risk

Any software that is hidden from public view is called “closed source”. Conversely, any software that is in public view is called “open source”. Everywhere you look on the Internet you will see the pros and cons of using either of these to manage commercial and non-commercial software. This article is not going to try to convince you what is better or worse. Just understand this:-

If the software is closed source, you do not know what is does, what it allows, what it does not allow, what it sends to the software company, or its third parties. This is the essence of what fosters your “false sense of security”.

Secondly, their is no functional difference between, the closed source application software running as part of your operating system and any malicious software that was accidentally installed by you. Again, the firewall, diligently does exactly what it is supposed to do. The firewall will not help you, as it is correctly allowing two way communication to occur as a result of a request originated from inside the firewall.

Make Your “Sense of Security” Based on Reality

Protecting Yourself From Yourself

Now we have another serious casualty from the desire for convenience versus the need for security.

If you are able to install software on your PC, you must have full privileges to modify any aspect of of what is running on your PC and must have read/write access to all of your storage devices.

All operating systems have this requirement.

Now we come to what sets the mindset apart from people who promote “secure computing”, to those that promote “easy computing”. It is only a mindset, as most operating systems can potentially offer identical levels of security, or trade it off for convenience.

Microsoft came from an era where their platform was promoted as “easy to use and nothing gets in the way of getting the job done”. This made those systems such easy targets for malicious activities.

Linux come from it’s Unix origins with the opposite view:- “people make mistakes, security needs to be good enough so that a mistake does not affect themselves and never affects other people”. Needless to say, Linux has never had the easy-to-use label.

A lot has changed over the last 40 years in both platforms but only small changes have been made to both major platforms to head in the other direction, but even now, the sales pitch is the same and you (the home user) are still the weakest link in the system.

Your Solution For 2023

For all of the reasons outlines above, I would recommend only the following solution. Remember it is general guideline and your specific circumstances may necessitate choosing other options.

1. Replace MS Windows with Linux. You need to stop indeterminate data flow between your operating system and Microsoft and it’s third parties.
2. When you install Linux, choose any USERNAME you like, but when requested to give that user a very strong password, consider that is the weakest link. Create a password using a sentence, rather than a single word and add special characters in that sentence. Make it at least 15 characters long. To keep the system “convenient”, for home use, by all means, turn off the screen lock and also have automatic login. Both of the convenience features suggested above assume that you do not have strangers entering the room you have your PC in.
3. Never click on a link in your browser, that has a domain name that you do not recognise. This includes emails that have HTML “web formatted” messages.
4. Never install any program at the request of a person you do not know and trust (by phone, internet, or otherwise). This has become a recent practice for cybercriminals in their quest to take over your PC, using standard readily available remote desktop software. Remember that this type of software works explicitly ensure the communication is initiation is being initiated from within your PC.
5. Only install open source software on your new Linux system. Remember, you want to be sure that you understand exactly what’s on your new system is going to send to the world through out firewall. You want to manage the risk.
6. Double check that the firewall component of your Linux system is enabled. All “workstation” installation that I am aware of, do this by default.
7. Make sure that have the latest manufacturer’s firmware updates applied to your broadband modem/router. Look up the device model and only install it from the manufacturer’s website.
8. Keep your new Linux installation updated, at least once a week, if you have chosen the “manual” update option.
9. Consider changing the settings of the broadband supplier’s modem/router to disable all ports which directly allow access to the router from the wide area network (WAN). This will prevent remote support from them, but will tighten security even further, at no cost. (You can always, re-enable it if you really need them to get into your system)
10. Change the “admin” password on your broadband supplier’s modem/router.

Keep in mind that Linux is not more secure than Microsoft Windows, when incorrectly used or configured. If you set it up so that you have full administrative privileges at all times while using the PC, then you are just as much at risk of malicious attacks, as anybody running MS Windows. The instructions above, protect you against yourself, as much as from others that want to do you harm.

If you do everything in my proposed solution, you should have a heightened sense of online, and computing, awareness and should no longer be lulled into a false sense of security.