Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer

  • Windows XP SP3 - fully patched at the time of compromise
  • User runs under the "user" privilege and as such should not be able to modify system files
  • Users computer had on-access virus scan enabled and the definitions were up-to-date
  • Flash is updated in regular intervals through Group Policy

The user told me that the AV caught something a day previous to them discovering their personal bank account had been drained. They stated that computer was the only computer they've ever used to do online banking. They are not sure whether or not they logged into their web banking after the virus alert, but they did tell me they used the "auto-complete" feature of IE8 to save their credentials for the online banking.

My question is what else could we have done to secure this work machine? We don't have the staff power to effectively implement Software Restrictions and working without Java is not an option either as a lot of their online browsing requires them to use Java. As you can imagine I would like to ensure this never happens again and am open to whatever suggestions you all may have.

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

Follow a proven hardening standard like NIST for example: http://csrc.nist.gov/itsec/SP800-68r1.pdf

Implement user awareness security training. http://www.sans.org/reading_room/whitepapers/awareness/importance-security-awareness-training_33013

Upgrade OS and applications. Although supported until 2014, it is unlikely that there will be another major service pack and several vulnerabilities currently exist that will likely go unpatched.

share|improve this answer
add comment

The most effective way to prevent any keyloggers would be the use of virtual machines.

Setting up a virtual machine that reverts to a clean state after every use should effectively prevent any malicious software from recording user activities.

Upgrade to a more current operating system. Windows XP, even fully patched has far too many vulnerabilities.

share|improve this answer
    
Thank you for your suggestion - Window XPs will be supported until April 2014 actually SOURCE : support.microsoft.com/lifecycle/?ln=en-gb&c2=1173 –  DKNUCKLES Jul 21 '12 at 3:00
    
@DKNUCKLES Oh, i must have missed that. Edited it out from my answer, but i still suggest switching to a more modern OS. –  Terry Chia Jul 21 '12 at 3:10
add comment

You can download one of the free browsers that delete cookies and erase history. Cookies cyber attacks are famous and this is not the first time it happends

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.