Is Your Security Software Working?

How to Test Your Security Software

Most of a security suite's work is silent observation, watching for known threats trying to get into your computer or suspicious behavior that indicates an attack is being launched. How is a user supposed to tell if the security software is actually doing its job?

Smoke detectors have indicator lights that tell you they're working properly. So do most security suites, in the form of system tray icons or other indicators that literally tell you, if you hover the cursor over them, "your system is protected." A properly configured security suite will load with your operating system upon reboot. You should look for the "working" indicator each time you reboot your machine.

If the icon looks different, or has an exclamation point inside, your antivirus protection may be expired or out of date. Many new computers come with a trial version of McAfee, Norton or some other commercial security product. If you let the trial version expire, you may be unprotected until you pay the "ransom" and purchase a paid license for the software.

Smoke detectors also have a "test button" you can press to set off the alarm briefly, proving that this vital function works. Something similar is available for antivirus programs: the EICAR virus signature test file. You can create this small file on your own and use it to test the virus-detecting function of antivirus software. Just copy the following string of text:

Paste the string into any text editor, such as Windows Notepad. Change the "A" at the beginning of the line to "X" then save the file as "TEST.EXE". If your antivirus software is working, the simple act of saving this test file should trigger a virus alert. But don't worry; the file is not an actual virus! It's simply a signature that most antivirus program developers include in their virus definition signatures databases specifically for testing purposes.

More Security Testing Tools

Another thing you can do to test the effectiveness of your security software is to run a standalone scanner such as MBAM or the new Microsoft Security Scanner. Both MBAM and Security Scanner will do a deep scan of the files on your hard drive, and alert you if any nasties are found. If something does turn up in the scan, you might consider switching to a new anti-virus program. See my article Free Anti-Virus Programs for some recommendations.

Security suites do more than scan for virus signatures. They also monitor and even close various ports that could give hackers access to your computer when it's connected to the Internet. There are tens of thousands of such ports, but most users need to use only a handful of them (like port 80, commonly used for Web access). To test the port monitoring features of your security suite, you can run a port scan.

SuperScan is a relatively easy-to-use port scanning utility. It will tell you which ports are open to strangers on the Internet, and what services are running on those ports. Then you can close unnecessary ports and services to seal off those potential lines of hacker attacks.

Even more advanced vulnerability testing utilities can find holes in your security setup that port scanning does not look for. Nessus is one such vulnerability testing application. A free version is available for non-commercial use.

It can be a lot of work to verify that your security software is working properly. Most people just rely on a security vendor's reputation and recommendations from friends or experts. But if you want to verify things for yourself, it's possible with these tools.

Do you have something to say about computer security tools? Post your comment or question below...