US-Cert report on spyware
US-Cert has published a report on spyware, http://www.us-cert.gov/reading_room/spyware.pdf, a 15-page document that includes an overview, definition and examples of different types of threats. Starting on page 10 defensive measures are outlined, emphasizing education and awareness. It notes that social engineering is a major means of distributing spyware by tricking users into downloading and installing malware. The recommended defensive measures include the following:
- Don't trust unknown or known high-risk sources.
- Read the fine print.
- Pay attention when installing applications.
- Keep operating systems and software patched.
- If you are running Windows XP, install Service Pack 2.
- Use trusted anti-virus and anti-spyware tools.
- Alternative internet applications
- Browser configuration.
If I had to pick the single most important recommendation in the list, it would be to keep your operating system and software patched, including updating Windows XP to Service Pack 2. A lot of spyware and malware is being spread through exploits. Much of this can be prevented by keeping Windows updated and avoiding high risk sources, as stated in the first recommendation. Porn sites and sites with illegal content, cracks, hacks and warez, are usually the worst offenders. Lyrics and wrestling sites are also known offenders. The report includes references that are also excellent sources of more information.