INTERNET SECURITY FOR INVESTIGTORS

Investigation firm and Investigation department security needs and practices evolve as technology evolves.

Until recently, few Investigation firms and Investigation departments needed to worry about desktop and notebook computer security beyond protection against viruses and E-mail interception. Networks were “local” and Internet access from the desktop was either protected by enterprise firewalls in the larger Investigation firms and corporate Investigation department or used relatively safe “dial-up” connections. Internet hackers, by and large, focused on large enterprises and Internet servers, ignoring desktop and notebook computers connected to the Internet.

In the last year, the picture has changed. Desktop and notebook computers connected to the Internet are at risk.

The new danger arises from a combination of several factors – first, availability of high-speed “always on” Internet connections mean that desktop and notebook computers are exposed to risk for longer periods of time; second, an increasing number of computers are linked to local networks at work and at home, and networked configurations open additional windows for hackers to exploit; and third, a variety of new and sophisticated tools allow hackers to explore large numbers of computers for security weakness in a short period of time.

The bottom line is that hackers are targeting desktop and notebook computers (and the local networks to which they are connected) in increasing numbers, sometimes with disastrous results. Internet security for Investigationyers, Investigation firms and Investigation departments, long a matter of protecting against Internet-borne viruses and protecting confidential E-mail by encryption, has entered a new arena – protecting desktop and notebook computers from hackers. That’s the bad news. The good news is that relatively simple solutions can dramatically reduce the risk.

This white paper discusses risk and solutions from two perspectives – the security needs of a small Investigation firm and the security needs of a Investigationyer from any size Investigation firm or Investigation department who works on the Internet from home or on the road. We present two key strategies to reduce the risk, plus common sense ways to better manage computer security.

HIGH-SPEED CONNECTIONS – A NEW VULNERABILITY

Larger Investigation firms and most Investigation departments within larger corporate enterprises have been protected from hackers by sophisticated “firewalls” for many years. Until recently, Internet security – outside of virus protection and E-mail security – was not much of a concern for small Investigation firms or Investigationyers working from home or on the road because “dial-up modem” connections were relatively secure from “hacking”.

Dial up connections are relatively “safe” when compared to high-speed, “always on” connections for two reasons. Dial-up connections are hard to hack because a dial-up Internet sessions are typically short. In addition, most dial-up connections use “dynamic IP addressing”, which randomly assigns a new Internet address to a computer each time the user signs on to the Internet, frustrating hackers who use “robots” to identify internet addresses worth exploring and then return to those Internet addresses at a later time to “hack”. But when connected to the Internet, dial-up computers are as vulnerable as any other – “security” lies in primarily in the simple fact the less time online means less exposure to hacking.

The ready availability of high-speed Internet connections for small Investigation firms and home users has dramatically changed this picture. Cable modems, ISDN and ASDL lines, and in-building fiber optic networks are “always on” – connected to the Internet 24x7 – and high-speed connections typically use fixed Internet addresses for each computer, ensuring that the computer will be at that address when the hacker returns.

WHY Investigation FIRM COMPUTERS ARE TARGETS

Hackers are opportunists, looking for valuable information that is easy to get. Desktop and notebook computers are relatively easy to hack because they are not typically well protected against hacking, and Investigation firm computers typically contain files that fit hacker “profiles” – files with “CONFIDENTIAL” headers, client social security numbers and tax identification numbers, tax data and so on. Most of this information is not encrypted.

The combination of opportunity and valuable information is obvious -- Investigation firm desktop and notebook computers are more likely to be identified as targets worth investigating than home computers or general business computers. In a word, the nature of the information contained on Investigation firm computers “lights up the radar” on hackers’ automated scanners.

HOW A HACKER HACKS

Hackers use “robots” and “spiders” – automated programs designed to scan the Internet looking for vulnerable computers and to break into them – to locate computers with security holes.

When a computer with a security hole is found, the hackers use that vulnerability to attack the computer, using robots to scan data files looking for sensitive information, such as documents labeled “confidential”, password lists, social security, address information, tax and financial data, and so on. When a hacker gains access to a computer, the hacker typically also gains access to the server and the other computers attached to the same local network. When files that appear to contain sensitive data are found, the hackers download the files for a closer look. The process is often completely automated, with one robot handling the scanning process, and then handing off vulnerable computers to another robot for examination and downloading.