Step 7: The last one :-) Update and Patch

Page Index:
SP3 for Windows XP
Updates for more Microsoft software
Microsoft update notifications
Keep Firefox and Thunderbird up to date
Keep your other programs up to date

The need to patch security holes is much more urgent than it was in the past. The bad guys know where to attack as soon as a patch is announced. And they are determined to succeed.

Job One: update Windows XP to SP3

Start by updating XP to SP3 if you want any security at all. Newer computers already have SP3 installed. (If you're still using Windows 98, don't expect to keep it secure at all.)

Access to the new "Windows Firewall", "Security Center", networking wizards, and other features will show up in the "Control Panel" after you install SP3 for Windows XP [Start > Control Panel]. It took me a while to find them. I expected to still see them in the Start menu -- silly me.

After you install SP3, be sure to use the new "Security Center" to turn automatic updates on. It has become too important to patch Windows promptly, rather than rely on your memory and motivation.

Updates for other Microsoft software

Microsoft Update supersedes Windows Update. It includes updates for most internet-facing Microsoft software like Outlook Express and Windows Media Player. It also includes updates for, maybe surprisingly, Microsoft Office, including Word. They're all tangled together with Internet Explorer too. Microsoft Update requires IE6 or IE7 (running in Administrator mode).

You'll find *tons* of information about updates for all kinds of Microsoft software at their excellent new security site. Also, see the next item.

Microsoft update notifications

Microsoft -- or any other sensible organization -- will *never* send software updates by email. Fake email messages are an easy and effective way to attack computers. Any message that purports to be a security update from Microsoft is bogus. Just delete it! Always go directly to the Microsoft website if you want to check to be sure.

On the other hand, Microsoft will send you update notices for Windows, Internet Explorer, Outlook Express and other programs if you ask. You can sign up for these notices with just your email address. They will direct you where to go at the Microsoft website from your browser to learn more and get the patches.

Caution

It's best to back up at least your documents before you upgrade Windows. Sometimes updates or upgrades just don't work out. You can be left with problems you can't correct, or even a computer that won't start. If you're running Windows XP, you'll probably be OK if you have a recent System Restore Point though.

Keep Firefox and Thunderbird up to date

You can have Firefox check for updates. From the Firefox menu, use Tools > Options > Advanced > Software Update > "Periodically check for updates" > and check the boxes for both "Firefox" and "My Extensions and Themes".

Check for updates to Thunderbird at the product page.

Keep other programs up to date

You need to keep more than just Windows and other Microsoft software updated. You won't have a strong defense unless you keep other programs patched.

It has become as important to keep not just Windows, but most of your programs updated. Microsoft has worked hard to make Windows less of a sitting duck. As a consequent, cyber criminals have switched half of their attacks to programs that they find are vulnerable.

They are attacking programs that connect online — browsers, email clients, security software, instant messaging programs, media players — and also programs that open attachments — Word, Excel and PowerPoint, Adobe Reader, photo viewers, etc.

Many programs have an item in the menu under "Help" -- something like "Check for updates" -- where you can do just that. Sometimes there is only a link to the main Web site, but you can check for updates when you get there

Another good way to learn about updates for your software is to go to the website for each program. I recommend that you do it at least once a month. There are also several websites that announce updates.

Update: Secunia now offers a [free] "Personal Software Inspector" (PSI). Use it to scan all the installed applications on your PC to find out which programs have important updated or are missing security patches. It is very thorough and gives you great info to help you find the updates that you need. You do need to download and install the Secunia PSI, but it's well worth the trouble. [Secunia Forum]

SANS Institute has very comprehensive information on security threats and solutions, including updates and patches.

You need to keep your security software up to date as well. Most of these programs offer automatic updates, which you should enable. [step 4]

Limit program rights

For the ultimate protection, run your internet-facing programs with limited rights. This will neutralize most present and future threats, because your internet-facing programs will not be able to carry out attacks against your computer.