Home Network Security

[Erik]

I have just finished setting up my home network, and everything is working well. I am able to share internet, files, and printers over the network. I am just worried a bit about security, as my brother isn't into security at all. I have installed Spybot, SpywareBlaster, AVG, and Sygate firewall on his computer. I am just worried that if he gets something it will try to transfer itself across the network and onto my computer. I have set the firewalls to allow all traffic fom my router. How much of a risk would I be at if I always leave that IP range open? I have in the past found Cool Web and other infections on his computer.

I am thinking that the greatest possible security feature possible would be to just block the IP range on my firewall, thus his computer wouldn't be able to see mine at all. Is this a bit overboard? He won't listen to me about security, and I don't feel like bugging him all the time about it. Would it be safe to keep the IP range open, and just keep my AVG, SPybot etc. all up to date to prevent getting anything across the network? Thanks in advance.

[PrntRhd]

What OS are on each computer?

You can block access to your PC using a decent software firewall, ZoneAlarm/Sygate/Kerio all are good with free versions.

Update his JVM to Sun Java to minimize trojans via that route.

[Erik]

My machine and my bro's are running Windows XP, and the other one is running Windows 98SE. I already have Sygate installed on my brothers machine and mine. Tried installing on the other (laptop) and had some errors that I need to work out. I will update to Sun Java, good idea.

In setting up the netwrok I needed to allow all traffic in the IP range 192.168.1.0 - 192.168.1.255 for the computers to be able to communicate. To do this I created a rule in Syagate allowing traffic on these IP's. Now my concern is that if this range is always left open it would be easy for something to transmit itself to my computer from one of the others. I could always, as I have it right now, just not allow these IP addresses. That way the other two computers can't contact mine, and no chance of getting an infection.

[John0904]

Good question.

What I did in your situation was to have one share folder on each computer and then made them Read-Only.

That way, files can't be moved or copied over to the other comuter from the infected one.

In theory, this is suppose to work. :) But I've never had a Trojan/virus to test this.

Any files you wanted to share would have to be place into the share folder and the other computer can access just that one folder. It can be copied or executed, but can not be deleted.

[Erik]

Good idea. Actually at the moment I am not sharing any files or folders from my computer, so I should be pretty safe there. The files that are being shared from the other computers are read only. I think that probably the biggest thing I could want to use as a shared resourse are the printers. I have a laser, and the other computers have photo printers.

I guess I could be pretty safe leaving the IPs open to the other computers, especially if I don't have any shared files, or read only shares. Then for added security I could always just block the IPs of the other computers and be just about 100% safe. Right?

[Variable]

Why are you worrying about virii if you have a good AV? IF your worried that AVG isn't good enough, then I suggest buying Norton AV. If you have a quality AV that is up to date and your brother does get infected, if the virus tries to infect your computer your AV will stop it. Thats what its for. IF you do not allow sharing of your machine it will be very difficult for you to become infected from his machine, unless its on a floppy.
Norton is very proactive atacking virii. I have seen it stop active virus atacks from a whole range of different scenarios. You could even clean his machine over the lan with your machine. If you have a router for your network make sure it is doing NAT and check and see if it can do firewalling too.


Variable