Peer-to-Peer (P2P) networking is a fairly popular concept. P2P clients make it easy for people to find what they want and share what they have. In order to share files on your computer and sometimes in order for you to access files on other computers within a P2P network, you must open a specific TCP port through the firewall for the P2P software to communicate. In effect, once you open the port you are no longer protected from malicious traffic coming through it.
Another security concern is that when you download files from other peers on the P2P network you don't know for sure that the file is what it says it is. You might think you are downloading a great new utility, but when you double-click the EXE file how can you be sure that you haven't also installed a Trojan or backdoor in your computer allowing an attacker to access it at will?
So, with all of that in mind, here are three key points to consider when using P2P networks to try use them as securely as possible:
- Don't Use P2P On a Corporate Network:
At least, don't ever install a P2P client or use P2P network file sharing on a corporate network without explicit permission - preferably in writing. Having other P2P users downloading files from your computer can clog the company's network bandwidth. That is the best-case scenario. You may also inadvertently share company files of a sensitive or confidential nature. All of the other concerns listed below are also a factor.
- Don't Share Everything:
When you install P2P client software and join a P2P network, there is generally a default folder for sharing designated during the installation. The designated folder should contain only files that you want others on the P2P network to be able to view and download. Many users unknowingly designate the root "C:" drive as their shared files folder which enables everyone on the P2P network to see and access virtually every file and folder on the entire hard drive, including critical operating system files.
- Scan Everything:
You should treat all downloaded files with the utmost suspicion. As mentioned earlier, you have virtually no way of ensuring that what you downloaded is what you think it is or that it doesn't also contain some sort of Trojan or virus. It is important that you run protective security software such as AntiVirus software. You should also scan your computer periodically with Anti-Spyware/Adware Software to ensure you haven't unwittingly installed spyware on your system. You should perform a virus scan using updated antivirus software on any file you download before you execute or open it. It may still be possible that it could contain malicious code that your antivirus vendor is unaware of or does not detect, but scanning it before opening it will help you prevent most attacks.
