2) Security Part 2 Flashcards
Malware: Ransomware
Locks all files and requests money in order to unlock.
In some cases, it doesn’t lock anything.
Can sometimes be removed with anti-malware
Crypto-Malware (Latest Ransomware)
Encrypts all files and requires payment in order to decrypt.
Very powerful encryption. The only way to decrypt is to send them money.
Keep offline version of backup to avoid issues.
Malware: Trojan Horse
Malware disguised as software. Doesn't care about replicating. Can circumvent existing security. Some trojans can disable anti-malware. Can install other types of malware.
Malware: Keylogger
Captures all keystrokes in order to acquire valuable personal information.
Logins, emails, URLs, passwords
Circumvents encryption because it records they keyboard directly.
Clipboard logging, screen logging, instant messaging, search engine queries
Malware: Rootkit
Originally a UNIX technique “root user”
Modifies core system files (part of the kernel)
Has complete control over OS
Can be invisible to system & anti-malware/virus
Malware: Virus
Generic term for malware that spreads/reproduces
Requires you to execute a program
Reproduces through file systems or networks
Some are invisible, some are annoying
Very common, thousands created every week
Program Virus - part of application
Boot Sector Virus - hides in boot sector
Script Virus - OS & browser-based
Macro Virus - Common in Microsoft Office
Malware: Botnet
Robot networks
Once your machine is infected, it becomes a bot/zombie
Can be installed with worms/trojans/viruses
Waits for third-party instructions
Third party can send out emails, perform DDoS, etc
Malware: Worm
Malware that self-replicates quickly
Requires no human intervention
Uses network as transmission medium
Firewalls & IDS/IPS can mitigate/prevent many worm infestations
Malware: Spyware
Malware that spies on you.
Advertising, identity theft, affiliate fraud
May come from a trojan.
Watches browsing habits
Sometimes uses keyloggers
Anti-Virus/Anti-Malware
You need both of these.
Real-time options (not just on-demand)
Modern anti-malware recognizes malicious activity
Doesn’t require specific set of signatures
Recovery Console
WinRE = Very Powerful/Dangerous - Last Resort
Gives complete control of OS
May need to repair boot sectors or file systems
Backup/Restore
Always have a backup
Image backup built into Windows 7/8/10
The only way to be 100% sure malware is removed
End User Education
One-on-one & personal training Posters & signs to remind users Message board posting Login message (invisible over time) Intranet Page
Software Firewalls
Monitor the local computer
Alert on unknown/unauthorized network communication
Prevent malware communication
Windows Defender Firewall
or Third Party
Should be running by default
DNS Configuration
Secure DNS Services External/Hosted DNS Service Real-time domain blocking Sites with malware unresolvable Constantly updated with known bad sites
Runs on secure platform
Avoids DNS cache poisoning attacks
Social Engineering: Phishing
Social engineering with a touch of spoofing.
Often done by spam, IM, etc
Check the URL
Usually something is not quite right
Vishing (Voice Phishing)
“I’m from IRS, need money, get gift cards”
