1

I see a lot of posts about how to protect your precious computer, but what is it that we are trying to protect?

Note: Before you flame me, I'm not trying to ask a stupid question. I just see many not knowing what it is that the full consequences can be of not protecting your computer

On with the question...

What threats out there is it that we have to protect ourselves from? Spyware that would steal our credit-card information, our social security number or something else? These things are at risk even if we built ourselves a fortress at home. Especially in the light of the recent Equifax breach (these breaches seems to happen all the time), it hard to see how we could avoid losing sensitive data just by securing our home computers.

Dont get me wrong, I fully understand why we would want to protect our servers, business computers and other business-sensitive hardware & software. I'm all for enhanced security and best practices here. But the home computers I think is quite a different story.

For many people, most of our data is saved online, in the hands of cloud-services. Services that have rollbacks and the possibility to restore the individual files to a previous version. Even if my entire computer and my cloud-data was encrypted from some kind of ransomware, I would be able to just roll back to a previous version of either the computer or in the cloud select a previous version of my files.

Are we instead primarily speaking of securing that my computer does not end up in some kind of a bot-net? Making sure that my device is not used to hurt others? In that case, I think our personal computers are the least problem? We are seeing more and more IoT attacks with our intelligent toasters trying to DDOS someone.

Bottomline, what is it that we want to defend ourselves from? What is the case for the person who remembers to take a backup up his data?

7
  • 4
    One response: your banking login credentials. That's one thing that is not disclosed to anyone and will do real harm to you and your family if disclosed.
    – schroeder
    Oct 21 '17 at 19:58
  • 2
    It's not that you won't lose sensitive data if your home computer isn't compromised, it's that you will lose sensitive data if it is.
    – timuzhti
    Oct 22 '17 at 4:06
  • 1
    The most educative article I saw on the subject (a picture in fact, as an image worth thousands of words), from Krebs On Security blog: The Scrap Value of a Hacked PC. Oct 23 '17 at 16:46
  • Consider this: Someone installed a key-logger in your system. This is just one of many examples.
    – Ugnes
    Oct 23 '17 at 21:48
  • 1
    i'm given +1, as when i'm trying to rise awareness among some of my non-technical friends, some of them has similar altitude.
    – user902383
    Oct 24 '17 at 9:54
9

Four threats to data:

  • distortion
  • destruction
  • disruption
  • disclosure

Sure, you can do a threat impact analysis and determine that the data on your computer is not worth the effort to protect it. That's called a Risk Analysis and more people should go through that process.

And sure, you can determine that some data already has many layers of protection against some threats and that data is protected to a level that you are comfortable with.

But, most people are not aware of just how precious the data on their computer actually is, and most people do not think of all the data that they should when doing these analyses (like login credentials).

Consider also the monetary and time costs to recover from some of the attacks above, even if they are protected. You are protected with identity theft protection? Great! How long and how many other costs will be incurred if your driver's license and SSN are stolen? Are you ok with those costs, too?

All these things need to be considered when you consider protecting your computer (and mobile devices, and home network, and router, etc.). You might conclude that you do not need as much protection as another, and that's fine. The important part is not that you have the same level of protection as everyone else, but rather that you understand and accept the risks. Because most people will not go through that process, experts simplify it all down to baseline protections that everyone should have. If you want to have less protection than the baseline, then make sure you understand what you are doing.

3

I'd suggest you read this Ars Technica article about ratting. Some highlights:

"Man I feel dirty looking at these pics," wrote one forum poster at Hack Forums, one of the top "aboveground" hacking discussion sites on the Internet (it now has more than 23 million total posts). The poster was referencing a 134+ page thread filled with the images of female "slaves" surreptitiously snapped by hackers using the women's own webcams. "Poor people think they are alone in their private homes, but have no idea they are the laughing stock on HackForums," he continued. "It would be funny if one of these slaves venture into learning how to hack and comes across this thread."

Women who have this done to them, especially when the spying escalates into blackmail, report feeling paranoia. One woman targeted by the California "sextortionist" Luis Mijangos wouldn't leave her dorm room for a week after Mijangos turned her laptop into a sophisticated bugging device. Mijangos began taunting her with information gleaned from offline conversations.

2

There are any number of reasons, but people store information on their personal computers that they don't store online. My computer, for example, has my tax records and banking information. While I suppose the tax records and banking information do exist on computers other than my desktop, there haven't been any known compromises of the IRS's servers or of any of the few sites that have access to my bank account numbers.

Additionally, I have a variety of expensive software licenses which someone could steal the keys for and start using making a nuisance for me to make use of software I own and trying to re-establish ownership of the license. I have a gaming account (World of Warcraft) which has several thousand dollars worth of asset in it if gold farmers were to steal the credentials.

Some people have private images or videos that they would rather not have leaked.

There are any number of pieces of sensitive data on a personal computer that either don't exist on the web or can not be bound as tightly to you without having your personal computer as a central linking point.

Additionally, your PC acts as a way to quickly compromise many of your different accounts. A compromised PC means that any account you log in to from it can then be compromised. While your credit card info may be occasionally leaked in large scale breaches, it's often only one of your cards at a time and the large scale breach results in notification being sent out and cards getting refreshed. If your desktop is compromised, it's a small scale breach that may compromise all of your accounts simultaneously, making a much larger problem to clean up and one that won't be as likely to have a large company with a full time IT staff to notice it and take corrective action, so the amount of damage that can potentially be done is much higher.

In short, just because information may be vulnerable in other locations doesn't mean it isn't worth protecting when it is all together in one place. It may be possible for the data to be compromised still, but it's a lot more work to piece it all together and try to avoid detection by large organizations than being handed it all in one place, with no protection and no oversight.

2

This is a complement to the excellent schroeder's answer that explain why you should think twice before stating that no data on your computer requires protection.

Even if all your data was stored in the cloud - BTW, this opens other threads, because now you must trust your ISP (network part) and your storage service - you should still protect your terminal computer. Because it is the piece that you use to access your remote data. If it gets compromised, all data accesses through a compromised computer can be spied which may lead to disclosure of your in-cloud data, without the storage itself being directly compromised.

And a compromised computer could clutter your backups without letting you a way to notice it: logs say everything is Ok, data comparison shows no error, but recovery of removed data just recovers nothing.

Said differently, if your computer get compromised for a long time, none of the good old security measure (good passwords on remote sites, backups) will be able to protect your data for Confidentiality, Integrity nor Availability.

0

Here is a short answer that should be reason enough: endpoints are what hackers use to get to servers.

For those systems not connected to servers, having your identity stolen or your information used to do something illegal has long-term, extremely destructive implications. Often it's guilty until proven innocent, which is at the very least stressful. Even if you are helped, it can take days or months or even years to recover what was stolen and revert your status back to where you were before you were attacked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.