The SecurityFocus Home User's Security Checklist for Windows

Windows

I am not running Windows as Administrator.
(Why shouldn't I run as Administrator?)

I picked a good password to log in to Windows: ____________________.
(What are some rules for good passwords?)

Windows Update

Windows Update is set to automatically download and install updates from Microsoft.
(How do I set up Windows Update to run automatically?)

I run Windows Update manually to download and install updates from Microsoft.
(How do I use Windows Update?)

I run Windows Update every _____ days.

If I use Microsoft Office, I check Office Update for updates.
(How do I use Office Update?)

Plus, I visit Office Update every _____ weeks.

I understand that Microsoft will never send out updates and patches, or announcements about updates and patches, via email. (What is phishing?)

Anti-Virus

I have anti-virus software installed and running.
(Why do I need anti-virus software?)

	My anti-virus software is made by this company: ____________________.
	My anti-virus software's title is ____________________.

My anti-virus software automatically updates itself.

	My anti-virus software updates itself every _____ days.
	My anti-virus software updates expire on this date: ____________________.

My anti-virus software automatically scans my computer for viruses.

My anti-virus software scans my computer every _____ days.

My anti-virus software automatically scans my IM (instant messaging) software.
(Why should anti-virus software scan IM software?)

I understand that some so-called viruses are actually hoaxes and I shouldn't worry about them. (What is a virus hoax?)

Internet

I've tested my computer's connection to the Internet.
(How do I test my computer's connection to the Internet?)

Email

I've configured my email program securely.
(How do I configure my email program securely?)

	If I use Outlook, I've configured it securely. (How do I configure Outlook securely?)
	If I use Outlook Express, I've configured it securely. (How do I configure Outlook Express securely?)
	I keep my preview pane closed. (Why should I close the preview pane?)

I know how to use email attachments securely.

	I have configured Windows to show all file extensions. (How do I configure Windows to show file extensions?)
	I never open attachments unless I am expecting them. (What are some good rules for opening email attachments?)
	I never open attachments that are programs (files that end with .bat, .chm, .cmd, .com, .exe, .hta, .ocx, .pif, .scr, .shs, .vbe, .vbs, or .wsf).

I never respond to spam, even to "unsubscribe".
(Why shouldn't I try to unsubscribe from spam?)

I understand that AOL, eBay, PayPal, my bank, and other Web sites related to my money will never send out requests for passwords, PINs, or other sensitive information via email.
(What is phishing?)

The Web

I've configured my Web browser (Internet Explorer, Netscape, Mozilla) securely.
(How do I configure my Web browser securely?)

I've tested my Web browser's security.
(How do I test my Web browser's security?)

I understand that advertisements on Web sites warning me that my computer can be hacked or fixed should be ignored; if I am concerned, I will ask someone knowledgable.
(What are fake Web ads?)

When I buy online, I make sure that sensitive information is entered only on secure pages (https).
(How can I tell if a Web page is secure?)

Anti-Spyware

I have anti-spyware software installed and running.
(Why do I need anti-spyware software?)

	My anti-spyware software is made by this company: ____________________.
	My anti-spyware software's title is ____________________.

My anti-spyware software automatically updates itself.

My anti-spyware software updates itself every _____ days.

My anti-spyware software must be manually updated.

I run my anti-spyware software every _____ days.

Personal Firewalls

I have a personal firewall installed and running.
(What's a personal firewall?)

	My personal firewall software is made by this company: ____________________.
	My personal firewall's title is ____________________.

I understand when to allow software to access the Internet and when to be suspicious.

If there is a problem, I understand how to shut down all Internet activity using my personal firewall.

Router

I have a router/firewall installed and I use it.
(Why should I use a router/firewall? )

I changed the default password on my router/firewall, to ____________________.
(What are some rules for good passwords?)

Additional concerns for wireless routers

I have a wireless router/firewall installed and I use it.
(Why should I use a router/firewall? )

I've configured my wireless router/firewall to use encryption (WEP or WPA).

	I'm using WEP, and my keys are ____________________, ____________________, ____________________, and ____________________. (What is WEP? How do I configure WEP?)
	I'm using WPA instead of WEP, and my key is ____________________. (What is WPA? How do I configure WPA?)

I've changed my wireless router/firewall's SSID or ESSID, to ____________________.
(What is an SSID or ESSID? How do I change my wireless router's SSID or ESSID?)

Miscellaneous

I know what Mac OS X and Linux are, and I understand that these both have dramatically fewer viruses and spyware issues. I know that some people might also argue that these operating systems have a better security record than Windows, but I'll leave that to the experts to debate. Thanks for mentioning them, but I'm still going to run Windows.
(What's Mac OS X? What's Linux?)

A couple of notes about the checklist. Yes, I know that I provided space for folks to enter their passwords. I thought long and hard about that, and it seems to me that the problem of lost or forgotten passwords, especially if it's a home computer with a limited user base, outweighs the problem of someone's wife or husband seeing a password. If it really bothers you, then don't fill those blanks in, or have someone fill in two copies of the checklist: one with passwords that is filed away in a safe place, and one without passwords that is posted on the wall next to the computer.