Home network security

Home network security is an issue whose urgency and relevance keep growing as ever new types of malware and other attacks appear. Ransomware attacks are clearly among the most dangerous phenomena of recent times. Underestimating this kind of security can sometimes have literally fatal consequences. How can you do the most for your home network?

Security first

When working on a network – even a home one – you can never be too careful. You need to protect not only the device you are working on at the moment, but also the surrounding devices and the network as a whole. It is always necessary to prevent unwanted data loss or the infection of individual computers and mobile devices on the given network.

Since the creators of all kinds of harmful software do not sit idle and keep producing new and better tools to attack your devices, it is extremely important not to neglect keeping up to date with the software that protects you from attacks, as well as keeping your operating systems up to date.

Computers running Windows have a built-in system firewall. A firewall, literally a "fire wall", acts as a kind of security barrier through which data can pass only under predefined security conditions. The system firewall in the OS is a fairly reliable tool, but it can never prevent the user from allowing and running a harmful service if they decide to do so themselves.

Today a firewall is also a built-in part of many home routers, some of which are affordably priced. In the Czech Republic, the most significant home product is the Turris Omnia. The project of the domain administrator CZ.NIC is a device equipped with the Turris OS system. Every router can check for attacks from the internet online, using logic running in a remote security centre. The system can even lure in a remote threat – one that carries out automated probing of internet connections, looking for security holes and opportunities to break into devices on home networks – by planting a bait in the form of tampered code. The hacking script lured in this way is redirected to the project's security centre. This method of protection is called a Honeypot, a pot of honey, and the lured threats are thoroughly described and the defence against them is delivered online to all other devices connected to the network. Such artificial intelligence, the work of Czech engineers, is being copied all over the world. It is very reliable. Due to smaller production volumes, the Turris Omnia is a little more expensive than quality products from established mass manufacturers. There are also established brands of home routers on the market that offer the option of setting up a firewall, but they lack the advantage of automatic threat learning and more advanced system logic.

It can be said with certainty that security and monitoring of network traffic with a quality home router and an updated operating system is sufficient for all responsible users. 
When setting up a home network, it is also a good idea to strengthen its protection by granting different access rights to its users. The inexperience of children, for example, and their curiosity can do truly great damage, so it is worth paying attention to appropriate measures. It is also essential to teach all family members the basics of safe work on the internet.

When doing ordinary work on a computer, tablet or smartphone, there is not much reason to switch off the protection of the operating system and the network. If any software asks for permission to communicate through your firewall, count to twenty first and during that time consider whether it is possible to trust the program and whether it really runs only the services and requests only the permissions it needs for its work. By far the largest share of security incidents is caused by the user. There is a rule of caution. A large number of users still happily click on a tempting offer to win the latest iPhone, and all they then have to do is install a tiny program on their computer. You would never do that? But attackers are often cunning and keep improving their methods. Be careful also when browsing websites for adults or downloading software, such as cracks for running illegally obtained applications, and beware of websites that require you to download specific software before you can view them. If you follow the rule of caution, you have nothing to fear. And serious content providers and website operators are interested in the highest possible security and in trustworthy content and software.

And what do the attackers gain from it? Harmful code itself can work very covertly and may not even threaten you directly. Professional spies and hackers often simply take over your computer and use it to disguise their own activity within a completely different system. It is a kind of game of hide-and-seek. They attack covertly, but their activity can be noticed, for example, by a slowdown of the computer or of the whole home connection. A completely different kind of attacker scans stored data. Some look for saved passwords or cryptocurrency wallets, while others look for a way to take over the entire file system and, if they succeed, encrypt it. This type of harmful software is called ransomware.

Ransomware, from the English ransom – a payment demanded for release, takes control of the file system of the stored data when it breaks into a system, and encrypts it. And if you want access to your files back, the malware is happy to ask for payment details, after which you receive a key and restore the files. This phenomenon of our time was invented in Russia, and Russian hackers are excellent experts in this field. Thanks to the constant work of security organisations and companies dealing with data protection, there are fortunately plenty of means to protect yourself against such attacks. And in the event of a successful ransomware attack, there are entire databases of decryption keys that security experts publish after cracking one or another variant of the harmful code. Storing important data in a secure cloud is also a good solution.

Risks of an unsecured Wi-Fi network from unwelcome guests in the neighbourhood

Adequate security for your network must in any case be an absolute matter of course. Try to think of the individual security measures as bricks from which you build a wall that no unwelcome visitor can get through. One side of such a fortress is checking connections to the wireless part of the network itself.

The basis is WEP or WPA security, which we will discuss in more detail later in this article. Do not underestimate this security, and do not choose simple, easily broken passwords and keys for the sake of convenience. It need not end simply with a neighbour connecting to your Wi-Fi.

Anyone who gains unauthorised access to your unsecured network can monitor its traffic, gain illegitimate access to its internal elements and obtain information that only you should have access to. Many computers store not only login details for various email services or social networks, but also financial and personal data or photos that could be misused. In extreme cases your communication may even be monitored, or your online identity may be misused to commit criminal activity.

An unsecured Wi-Fi network can also expose you to DNS attacks, for example, where the perpetrator, using special malware, can steal your login details for internet banking and other sensitive information.

Put simply, by inadequately securing your home network, you turn your Wi-Fi not only into an easily accessible hotspot, but also into an open door to your household – with everything that comes with it.

Updating PCs and Macs

We already mentioned the need for all software to be up to date in the introduction to this article. The developers at all technology companies work hard to make their software as secure as possible. They uncover various gaps and close them in the latest updates. That is why it is important to keep your computer constantly up to date.

Fortunately, computer updates are nowadays largely an automated affair, or a task you can easily automate. Computers running
Windows include the Microsoft Update platform. It is an online extension of the operating system, thanks to which your computer will always be in an up-to-date state.

Updating requires an internet connection. In the Start menu, click Control Panel -> System -> Automatic Updates, or click Performance and Maintenance -> System -> Automatic Updates. You can find further useful information on this web page.

You can update Apple computers by clicking the Apple Menu at the top of the screen -> App Store, where at the top of the application window you click "Updates". Automatic updates can also be set up by clicking Apple Menu -> System Preferences -> App Store, where you tick the option to download automatic updates.

How to secure your mobile device

The main rule is not to download unverified software and not to visit dubious or suspicious websites. If you use internet banking on your mobile device, log in to it exclusively through the relevant app, not through the web interface, where an ordinary user has no way to detect any redirection
or to verify that the site is genuine.

A phone also needs to be secured against physical unauthorised access. Always set a unique gesture or a hard-to-guess numerical code and, on phones that support it, unlocking with a fingerprint.

Also secure access to your accounts on your mobile phone – where possible, use two-step or two-factor verification. And don't forget to back up your data regularly.

Data on phones running Android can be secured also by encryption, which you turn on in Settings -> Security -> Encrypt device. In this way data can be encrypted not only on the device itself, but also on an external SD card.

You can also protect your Android device against viruses and other harmful software
with classic antivirus protection and a firewall, which is offered, for example, by Avast.

If you are a standard user, it is also advisable to install applications and other software exclusively from verified sources. You activate this in Settings -> Security -> Unknown sources.

Should the worst happen and you lose your Android phone or it is stolen, wipe it remotely as soon as possible, using the online tool Device Manager.

The basic protection of an iOS device is a passcode lock and, on iPhone 5S and newer, Touch ID, i.e. fingerprint security. Do not sacrifice security for convenience by setting a simple four-digit code. You can set up Touch ID and the passcode lock in Settings -> General -> Touch ID and Passcode (on iOS 11, Settings -> Touch ID and Passcode lock). In Settings -> Touch ID and Passcode you can also set the option to automatically erase all data after ten failed attempts to enter the numerical passcode.

It is also important to keep control of the information shown on the lock screen of your iOS device. You can manage this data and notifications in Settings -> Control Centre, Settings -> General -> Touch ID and Settings -> Notifications.

In Settings -> iCloud -> Find iPhone, you can activate the Find iPhone feature, which lets you locate your device on a map if it is lost or stolen, play a sound on it, erase it remotely or set a message for anyone who finds it.

Don't forget to back up your device regularly, either to iCloud or via iTunes to a connected computer.

Securing your home Wi-Fi router

TIP: Want to change your Wi-Fi password? Either call us or read the article How to change your Wi-Fi password.

As we mentioned in the introduction to the article, an insufficiently secured router can open the gate to your home network, computers and other connected devices for anyone. Every new router or other access point is insufficiently secured by default, and it is up to you to take the trouble to change the passwords.

After installing a new router, you can set the name of your network (SSID) and set a password with strong security. In some cases the network can be hidden completely, so that it does not appear in the list of networks to unverified devices. If you hide the network, you will have to enter its exact name and password to connect other devices. Routers usually come with installation CDs or manuals, which tell you when to change the password for managing the router and, above all, how to encrypt the network. On the underside of the device you should find a specific IP address at which the settings can be changed – for ASUS routers, for example, this is usually 192.168.1.1.

Another important step is allowing access to the network only to verified devices. In addition to setting a password, you can secure this by allowing access to specific MAC addresses, or alternatively by blocking specific MAC addresses.

You can find a device's MAC address in Windows by clicking Start -> All apps -> Search, where you enter Command Prompt. Then type the command "ipconfig /all" into the command prompt. A MAC address is a twelve-character code, which is usually found in the field labelled "Physical Address".

On Apple computers, click the Apple Menu at the top of the screen -> About This Mac -> System Report.

It is important to encrypt the router using WPA, or ideally WPA2. Once you set the password, the network is encrypted, and with WPA2 encryption no unauthorised person can really connect to it without knowing the password.

Which home device has the best security?

When choosing a router for a home network, the main criteria should be not only connection speed or coverage range, but also security. As far as encryption is concerned, of the trio WEP, WPA and WPA2, WPA2 is considered the safest, and within the encryption protocol, AES is the most secure method.

In conclusion

Installing a home network is a matter where security should never be underestimated. Every step needs careful consideration, from choosing the router to choosing the network name and password. It is also important to familiarise not only yourself but also all household members with the rules of safe internet use. Microsoft has published some further tips on the portal of the Bezpečný internet project, bezpecnyinternet.cz.

We also recommend reading one of our most visited articles, Internet security: What threatens you and how to defend yourself.

Updated 13 March 2024