5.13.4 Malware

Question 1

How malware works ?

Answer 1

It attack 4 parts of the computer:
- executable program file
- file directory system (which track the location of all computer file )
- boot and system area (which are needed to start the computer)
- data files

Question 2

What are the 2 ways to reduce the risk of computer viruses and worms ?

Answer 2

1/ preventive controls: having policies and procedure in place
2/ détective controls: technical means including anti malware

Question 3

What kind of procedure & controls should be in place to prevent from malware ?

Answer 3

• build any system from original, clean master copies
• allow no media to be used until they have been scanned on stand alone machine that is not connected to network
• update malware software scanning
• protect removable media against theft
• have vendor run demonstration on their machine
• scan before any new software
• ensure network admin use pc and server anti-malware
• ensure servers are equipped w/ malware detection software
• consider encrypting & decrypting file before execution
• ensure bridge, router and gateway updates are authentic
• ensure effective backup plan is in place
• educate users
• review anti malware policies

Question 4

What are the technical controls to prevent from malware ?

Answer 4

• use boot malware protection
• use remote booting
• use hardware based password
• ensure that insecure protocols are blocked by the firewall from external segments and internet

Question 5

What is the most effective technical controls to prevent from malware?

Answer 5

Anti malware software

Question 6

What are the different type of anti malware software ?

Answer 6

• scanner: look for sequences of bits called signature that are typical of malware programs
• active monitors: interprets DOS and ROM BIOS calls, looking for malware like action
• integrity CRC checkers
• behaviour blocker: focus on detecting abnormal behaviour
  -immunisers: defends against malware by appending sections of themselves to files

Question 7

Why is it important to implement a anti malware strategy ?

Answer 7

To effectively prevent the spread of malware throughout their IS. It is important to detect the malware before it cause damage

Question 8

Let’s say you need to implement an anti malware strategy. What features a malware has to have to be considered as acceptable ?

Answer 8

• reliability and the quality in malware detection
• memory resident which is a continuous checking facility
• efficiency such as reasonable working speed and usage of resources