I work in information security. For the last 5 years or so I have thought about computer security almost every workday. What I came to realize the weekend before last though was that I am not doing a good job of helping to bring some of that experience to my friends and family… and by extension any internet user who happens to type the right set of keywords into google.

The game has changed over the last couple years. It used to be that malware writers wrote worms and viruses to do harm. The goal was to destroy or to disable. For maximum effect it was government agencies and big corporations that were more heavily targeted. You as a computer user would usually know something was wrong because the way your computer worked changed. It would get slower or files would start being corrupted or the system would crash entirely. The biggest protection that a home user had was anonymity and scale. Why would a hacker write a virus to target your particular system when the potential effect would be so limited?

Now though that is no longer the case. Malware is big business. Organized Crime (mostly foreign) and even Government/Military sponsored cyber-attack units have turned this from games that script kiddies, college kids with new skills, and bored middle eastern programmers play into a multi-million dollar industry. Not only that but the goal has changed. No longer are malware authors content to write purely destructive code… now they want to be invisible so they can steal. The type of malware I see nowadays is everything from little secret applications that drive up advertising revenue by pretending to click on internet ads from your computer to trojans which secretly spy on you as you do your online banking.

With the potential windfall from identity theft the home computer as a target is suddenly front and center. That’s not to say there isn’t value in stealing and selling customer contact databases from big companies, or in scoring thousands of credit card numbers for identity theft from a big retailer isn’t also a target. No the difference now is that home users are just as useful a target to these new breed of info stealing hackers as the big companies are.

The only thing I have really written so far is on how to secure your connection to Google using a FireFox addon called CustomizeGoogle. Starting tomorrow though I am going to post more frequent thoughts, tips and guides on how to do a better job at home. My goal is to provide the kind of proscriptive guidance for those of you out there who don’t have time to really understand computer security but need to be secured for your own good.

We’ll see how that goes. If nothing else it will raise awareness of the issues.