A Sense Of Security.

Passwords provide a shield

Most of the past columns have tried to keep the technology covered to a simple, basic level. Sometimes, however, simple and basic is just not the right way to go.

Enough of the past columns have covered "easy" networking so that hopefully many of you have at least started to tie your personal computers together. At some point, however, you need to stop thinking about making the connectivity as easy as possible, and start thinking about how to keep your information secure.

The term "secure" means different things in various contexts. At stake in this assessment is how much damage will be done if information is looked at inappropriately, or can be altered or deleted. As the intrinsic value of the data increases, so must the steps that you take to protect it from unauthorized access or alteration.

Security doesn't have to be all-or-nothing, although it can be, if that will serve your needs. You can protect only certain pieces of information, if you wish, and even implement multiple layers of security.

Who's that knock'en?

The most basic security step you can take is to limit physical access to a particular personal computer or laptop. That seems obvious, but is generally completely overlooked when making up a security plan. If someone who is not authorized to use a particular machine can't get physical access to it, the chances of them being able to gain access to the information stored on it have just been reduced greatly.

Limiting physical access can be accomplished in a variety of ways. One is simply to make sure that doors to private offices are kept locked when the office is vacant, such as during lunch or after hours. Limiting access to your office facilities to only the people who belong there is another. If your offices are so large that a stranger will not instantly stand out, develop and use organizational IDs with photos on them, and require that they be displayed at all times within the office. Identify visitors with bright colored temporary IDs, so you can instantly tell if someone who does not work in your organization is in an area for which they do not have authorization.

This doesn't mean you have to be paranoid, but having strangers walking around where there is expensive equipment and/or sensitive data, is just not a wise thing to allow.

The next step is to require "Boot Access" to every computer that might house sensitive data, or that is connected to your office network. Just how elaborate you want to get with this is up to you. All versions of Windows permit you to set a password log-on to gain initial access.

You can set this in several ways. The easiest way is by clicking on the Network icon in the Control Panel, and setting the pull-down menu labeled "Primary Network Logon." If you are not using a network, you can set this to "Windows Logon: and the next time you boot up you'll be asked to enter your name and a password. This password can be changed at any time by clicking on the "Password" icon in the Control Panel.

If you are part of a network, you will usually use the setting labeled "Client for Microsoft Networks" rather than "Windows Logon."

Either way, you should observe proper password protocols when choosing, using, and changing passwords -- more on this in a moment.

Using Windows sign-on passwords is a good first step, but it does leave you still vulnerable to someone that knows their way around a computer. If your computer's BIOS is set to boot from multiple devices, using a start-up disk in the floppy drive can usually bypass the Windows log-on completely. Sometimes, interrupting the boot process using the F5 function key to boot into DOS can also bypass simple security.

The BIOS contained in read-only memory for most personal computer and laptops also offers password protection. You'll need to read your computer's manual to see how to access the BIOS; it's often a special key pressed as the system initially boots up. For most Compaq systems, this key is F10. For many other systems, it's F2 or holding down the Control, Alt, and "S" keys simultaneously. You'll have to page through the menus to find where to enable and set the password.

Using the password in the system's BIOS is more secure than Windows log-ons, and can be used to add another layer of security. It is still far from perfect. If you pull the small battery from the motherboard for several hours, the BIOS will probably lose all of its settings, including the password. And, if you lose or forget the password, that's exactly what you'll have to do to get into your own computer.

Going the extra distance

Good security usually involves adding multiple layers. There's no such thing as perfect security, but the more difficult you make it for unauthorized users to access sensitive information, the less likely it is to be compromised.

If the computer you are protecting is part of a network, Windows networking provides another layer of security. Under the same Network icon in the Control Panel where you set the log-on is a small box that's labeled "File and Printer Sharing."

If you don't want to allow anyone on the network access to your files, you can click on this box and you will be presented with a choice of whether to allow or not allow other users access to your files or printer. Click on the button that prevents access, and you'll have an additional degree of protection.

This network icon also has three tabs at the top, labeled "Configuration" (which is the screen we've been working in so far), "Identification" and "Access Control." If you click on the tab labeled "Access Control," you can set passwords for individual or group access over the network to specific drives, subdirectories, or even individual files on your computer.

Finally, specific applications also frequently provide their own embedded password protection. For example, in Microsoft Word 2000, you can password protect an individual file, which is handy if you want to restrict access to sensitive documents. To use this feature, simple use the "Save As" command in the File Menu, and under the Tools icon in the next screen that you're presented with, choose the "Save Options."

On the "Save Options" screen there's an area to enter and confirm a password. You can use one password to set access to the document, and a second, different password to permit or deny the ability to modify the document.

As you can see, password protection is pretty simple to implement, and using multiple layers of passwords can provide an increasing amount of protection and security. There are, however, some simple rules that you should follow in regard to using passwords.

The first of these is to never use a password that can be easily guessed, such as your name, the name of your dog, children, or partner, or similar data such as birthdays, social security numbers, and the like. The best passwords are combinations of alphabetic characters and numbers, like "5rudabaga67."

What is my ...

Don't write down your password where it can be easily found, like under a desk blotter, behind a picture, or on the inside cover of your DayTimer. We all suffer lapses of memory, so make arrangements with someone you trust in a different location to serve as "guardian" of you passwords, and offer to perform the same service for them. If you have a safe or lock-box, you may want to store your password list there for even easier access.

Good protocol requires frequent changes of all of your passwords. Just how frequently, again, depends on how sensitive you information is, and how vulnerable you judge it to be. Most security experts recommend that you change every password every few weeks, though most casual users resort to this practice much less frequently, or never change their passwords at all.

Finally, you should be using a different password for each level of security, and for each different application. Your Internet password should be different from your network or boot up passwords. And each of these should be different from each other, as well as from the passwords that you use to protect individual documents.

As you might imagine, this can lead to a plethora of passwords. And with the need to change passwords frequently, can be a major burden to administrate. In the real world, most users make some compromises, using the same passwords for multiple uses and applications. It's up to you to decide how many levels of security to implement, and how much more complex your data requires that you make access.

There is an alternative, however. Next month, some inexpensive hardware and software that let you use your personal uniqueness as a password will be examined.

Ted Needleman is the former associate publisher and editor-in-chief of Accounting Technology magazine. He is now a technology consultant and writer based in Stony Point, N.Y.