A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer
- Windows XP SP3 - fully patched at the time of compromise
- User runs under the "user" privilege and as such should not be able to modify system files
- Users computer had on-access virus scan enabled and the definitions were up-to-date
- Flash is updated in regular intervals through Group Policy
The user told me that the AV caught something a day previous to them discovering their personal bank account had been drained. They stated that computer was the only computer they've ever used to do online banking. They are not sure whether or not they logged into their web banking after the virus alert, but they did tell me they used the "auto-complete" feature of IE8 to save their credentials for the online banking.
My question is what else could we have done to secure this work machine? We don't have the staff power to effectively implement Software Restrictions and working without Java is not an option either as a lot of their online browsing requires them to use Java. As you can imagine I would like to ensure this never happens again and am open to whatever suggestions you all may have.
