An excellent question, and one that's not asked often enough. We've got a big article on viruses, but here's the basics.
A virus is a malicious program, usually invisible to computer users (there aren't usually any icons for a virus, and you won't see it running). They're designed to exploit sloppy design and programming practices of the companies who wrote the programs you use, exposing you and your organisation to some serious risks. Just like human viruses, computer viruses can do a number of different things to your computer. Some send everything you type (personal email, credit card numbers, reports for work) to shady underworld characters; some turn your computer into a weapon, getting it to bombard other computers with data, send spam or try to hack into other computers; and some simply start deleting all your files.
No computer is completely resistant to viruses. That being said, there are orders of magnitude more viruses in the wild for Windows machines than for all other kinds combined. There are a number of reasons for this, but the important thing to remember is that everyone should be careful, and use appropriate protection for their computers.
There are a number of different virus protection programs for Windows. Your new computer would likely have come with a demo or time-limited version of one. While some may quibble about features, cost and efficiency, the most important thing is that you have something, anything, installed and running. All of the commercial ones (here's an overview) are very well-supported, and do their jobs well. The second-most important thing (and it's a very close second) is that you keep the protection software up to date. Approximately 20 new viruses are created every day of the year, and the software needs to be updated to be able to recognise and safely remove each of them. Every modern anti-virus software package includes an auto-update feature: generally, all you have to do is stay connected to the Internet long enough for the software to do its thing.
Google searchGood for you for realising that you need to back up. The most important part of doing a backup is doing a backup. You have to remember to do it. It doesn't particularly matter what software is used, but you do need to remember to actually run the backup.
Backups serve two purposes: recovering from human error ("whoops, I deleted that file") and recovering from some kind of physical disaster ("a mob of roving monkeys broke into the office last night and everything is gone"). Unfortunately, these two purposes make planning a backup a bit tricky. If you want to be able to recover from the "whoops, I deleted that file", you'll want the backup close-by. But if you want to make sure your data survives a problem in the office, you'll want to keep your data as far away from mobs of roving monkeys as possible. Also, backups can take a little while to happen, and if something happens during the backup, you're in a bit of trouble too.
Generally, the solution is to have two or more complete backups - one that sits in a safe place offsite, and the other in the office. Swap them daily, so you always have one that's offsite and one that's in the office. There's software and equipment out there to help you with this. Please have a look at an introduction to NAS devices, an overview of backup software.
Another interesting backup method, which is just emerging now, is online backups. You'll need a fairly good Internet connection for this, because it will be used a lot. It's important to pick one that has good security themselves, since they will theoretically have access to all of your data. We've had a look at a few services and have an overview of some of the available options.
Lastly, if you don't have very many files, an interesting solution is a completely online storage solution. The advantages here are being able to access your files from any device, anywhere in the world - without having to really do anything. Have a look at our Dropbox overview.
Google searchEven though you may log in to your computer with a password, it's fairly easy to get around that protection and get at all your data anyway. For maximum security, you'll need to make use of a concept called "encryption". Recent versions of Windows and MacOS include a built-in encryption system, but you need to turn it on. Here's how: for Windows and for MacOS. Note that in both cases, when a document is copied off your computer, it loses the protection that the encryption gave it. It's also a really good idea to run a complete backup before you enable encryption on the disk.
The difference between encryption and just a password is fairly straightforward. Let's say you have a document with a confidential letter in it. If you told your word processor to password-protect that document, all it would do is put an instruction at the beginning of the document, saying "please ask the user for a password when opening this document. The password is…". Nothing about the actual content of the document would change, and someone would be able to force the computer to open the document with a different program that ignores the password request and see the contents. With an encrypted document, the password (and some heavy maths) are used to actually scramble the contents, and opening it with a different program would only reveal the scrambled contents - not the confidential letter. This is much safer, since there's no way to get at the contents of the document without knowing the exact password.
Google searchIn short, a good password is something easy for you to remember, but difficult for others to guess. It should have a variety of upper- and lower-case letters, and some numbers and symbols too. A good way to get a seemingly nonsensical series of letters and numbers is to use the first letter of each word in a phrase. A bit like an acrostic. Substitute some numbers for letters and perhaps start or end with a symbol, just for good measure. For example: "The people who work at VCOSS are really nice" turns into "tpww@Varn", with an uppercase V for VCOSS (since it's an uppercase word) and an "@" instead of the word "at". Just remember that the people who work at VCOSS are really nice, and you'll remember your password.
As for how often they should be changed, the general opinion is that they should be changed a few times per year.
Google searchWireless networks are really convenient: they save on paying for wiring, they allow people with laptops more work freedom, and they're quick and easy to set up. Unlike wires, they pass through walls, floors and ceilings with ease - they can even cross the street. Unless you're careful, any passer-by with a computer may be able to connect to your network. They may simply use it to check their email and move on, or they may do worse things, like downloading illegal and copyrighted works, attacking other people's computers or even worse: your own.
There are two parts to the security story for wireless connections: making sure only authorised people are connected, and making sure that once you're connected, no one else can "evesdrop" on what you're doing online.
The first part is dealt with, generally, in two ways. First is simply setting a password on the connection. Most cheaper wireless base stations have a "shared" password - meaning, it's a password that everyone connected to the base station shares. There isn't a separate password for each person. More expensive units work with individual passwords, usually in conjunction with other security and login systems. The second way to make sure that only the right people can connect is by maintaining a "whitelist" of computers. Every netowrk port on every computer has a unique identifier called a MAC address (nothing to do with Apple - it stands for "Media Access Control" and looks like this: 00:25:bc:dd:75:c2). Most wireless base stations allow you to enter this address into a list of allowed computers. Unless your computer is on this list, you're not getting on, no matter what you say about the password.
Once you're connected, you don't want people snooping on your Internet traffic, so the data across the wireless connection needs to be encrypted (scrambled) from evesdroppers. There are three standards for this, and two of them aren't very good. Avoid the ones called WEP and WPA - the newest one, WPA2 is the one to use. WPA isn't bad, but if WPA2 is available, use it.
More information is available in this wireless security article.
Google searchDoing IT Better is a social justice initiative of the Centre for Community Networking Research (Faculty of Information Technology, Monash University) and the Victorian Council of Social Service, generously funded by a foundation.
© Victorian Council of Social Service 2010