Turning off your computer could be a security risk

As a computer professional, people often tell me how they turn their computer off at night to save power, usually with a degree of glum "I'm so green" about them.

I usually smile politely, then ask them what time of day they are running their antivirus / security updates?

Usually they stammer and say something like "oh, I check all the time", but you can tell from the hesitation and the look of horror in their face...

Mari Nichols, one of the handlers on ISC's "Internet Storm Center" (if you care about security much, then http://isc.sans.org/ should be in your favorites) tells the story in a recent diary entry about a town who's computers were hit with a big old infection. The CIO was somewhat taken aback that the only computers not affected were the ones who had ignored the cost-savings plan implemented by the town, which involved powering down their computers at night.

We computer in a dangerous time -- take a look at the size of your antivirus' latest dat file if you doubt that. We can ill afford to be anything less than diligent in the applications of AV datfile updates and OS and application security patches, and, to be perfectly frank, those things usually happen at night.

In powersave or low-power mode (not sleep or hibernation), the power curve on a modern desktop is infintessimal, so, as long as you power down the monitor and peripherals, you are still saving a BUNCH of power if you leave the computer itself on. I even suggest not clamshelling your laptop overnight at least once a week so it can catch up on updates.