1

Theres an older computer in my home which we don't have connected to a network so it doesn't need an anti-virus and a firewall.

Is there any way I can secure this computer from the outside (i.e. on the network layer) so we would be able to get files in and out of it .mp3 files and wave files. That doesn't open it up to full file sharing within the network.

Basically is there a way to get files on and off the machine without resorting to usb sticks which allow it to push contents.

I'm more worried about the push case as I feel its easier to lock down and the machine is used primarily to produce files.

Oh in case its relevant the machine runs windows XP. (win2k would be the other option)

8
  • 7
    So it doesn't need a firewall because it's not connected to a network... but then you want to connect it to a network?
    – DHall
    Apr 26, 2011 at 16:23
  • No sorry the meaning of that was unclear. Its not connected to a network so that we don't have to run the antivirus (cause not effect). However I'd like to be able to get files off it (while still not allowing outgoing or incomming http / ftp / mail connections etc)
    – Wes
    Apr 26, 2011 at 16:31
  • I'd use some firewall that only allows connections to a single trusted target ip. Apr 26, 2011 at 16:37
  • 3
    @Wes; If you want to be able to interface with it from other computers, you want to network it. However, if the only possible infection vector is from computers that do have antiviruses, then using an AV on it seems somewhat pointless, and a firewall should have no real performance hit.
    – Phoshi
    Apr 26, 2011 at 16:42
  • @phoshi thanks I'll look at getting a firewall. Thank you.
    – Wes
    Apr 26, 2011 at 16:54

3 Answers 3

1

The problem you face is that any network connection introduces security vulnerabilities. Your task then is to mitigate the potential threats. Blocking it from connecting to the internet is a good place to start, but you still have to worry about malicious software using your other machines as a springboard to attack this machine.

The best thing you can do is to modify your usage to fit a more security conscious scenario. Here are a few questions that I hope can guide you to find the right answer for your situation:

  • Why are the files stored on this machine? Can they be offloaded to different system that has security software running?
  • Which computers on your network need access to this machine?
  • Why can't you run security software on this machine? Is there a hardware change that would allow it?
  • What happens when I get an infection? Do I have a backup scheme?

In my home network, I make sure that every machine has at least a basic virus scanner running. If the system can't handle one, I generally throw it out and get something that can. I feel that the cost of a new machine is less expensive than rebuilding my entire network because a system wasn't powerful enough to run anti-virus.

Hope this helps.

2
  • Several of your points are in fact the reason I suggested Steady State and Deep Freeze. Both programs use almost no system resources making them perfect "anti virus" solutions for old machines, plus they work better than any anti virus could... because no matter how good your anti virus is it is going to miss something eventually. Apr 26, 2011 at 19:30
  • It depends on the use case of the machine. Steady State and Deep Freeze are best used on "terminal machines". If you want to make any changes to the system, you have to remember to "refreeze" the system to keep the changes. I should also note that steady state is best used to "undo" the damage done by a virus. If you download a virus on a steady state machine, it can spread to the rest of your network before you reset the machine. Having steady state on only one machine only protects against long term infections on that machine. The machine is still a danger to the network as a whole. Apr 27, 2011 at 15:17
0

You can install the old Sygate 5.6.2808 Firewall. it is no longer supported but is the best XP firewall imho, it also has advanced filtering, so you can lock it down to only allow connections from specific IP addresses.

Disable the XP firewall after Sygate is installed and you reboot.

0

Remove the DNS Server and Default Gateway addresses for the appropriate Network Connection. Googled the instructions on how to do it in about 3 seconds.

You might also consider Windows Steady State (depreciated) or Deep Freeze if you don't want anti-virus but later decide you do want internet access on the computer in question.

EDIT:

To elaborate on my Steady State / Deep Freeze suggestion, I just want to point out that both of those programs use almost no system resources (unlike traditional anti virus programs). Disk freezing is really the way to go these days, especially on older systems with limited resources.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .