Trouble with Key-loggers

Came in this morning, opened my email, and discovered that one of my users had fallen prey to a key-logger. While no corporate accounts were accessed, only her personal email, it is nevertheless disturbing. Increasingly we find ourselves using public facilities to access the internet, and many internet features are secured with weak passwords.

In our case, here at ESSC, we are also protected with Passfaces, which can and does defeat key-logging. Additionally, outside of some executive accounts for GotoMyPC, we live behind a very strict firewall.

It’s those accounts that presented a security hole, since the users would remain logged in to our network for ease of access when connecting via GotoMyPC, skipping the security of Passfaces and therefore leaving us vulnerable.

To fix this issue we are requiring those who have GotoMyPC accounts to set their workstation to require a password on waking the screen saver.

To do this the user first needs to right click on a blank area of the screen, which will open a pop-up menu. Selecting “Properties” from the pop-up menu will open the Display Properties dialog box.

The user can then click on the Screen Saver tab, select a screen saver (it will not work without a screen saver selected) and put in the length of time before the screen saver is activated. If the checkbox labeled “On resume, password protect” is checked, then the user will be required to log back into our network whenever the screen saver activates itself.

This solves our GotoMyPC issue since the faces in the Passfaces grid cannot be hacked by a key-logger.