Weekly summary 5

Nikunj Nayak

easttom_netd_ppt_09F.pdf

Home >Information Systems homework help >Weekly summary 5

Network Defense and

Countermeasures

by Chuck Easttom

Chapter 9: Defending Against Virus Attacks

Objectives

 Explain how virus attacks work

 Explain how viruses spread

 Distinguish between different types of virus

attacks

 Employ virus scanners to detect viruses

 Formulate an appropriate strategy to defend

against virus attacks

Introduction

Defending against virus attacks is more than

having antivirus software in place.

Organizations need to understand the nature of

viruses in relation to other types of attacks so

that they can reduce the overall effects and

impact that viruses can have on their

organization.

Understanding Virus Attacks

 Some questions that should be answered to

help understand virus attacks:

 What is a virus?

 What is a worm?

 How does a virus or worm spread?

How Does a Virus Spread?

 Common ways viruses and worms spread:

1. Attaching itself to an external e-mail system

2. Finding connected computers and copying itself

3. More recently, using its own e-mail engine

4. Instant messaging (newest form)

How Does a Virus Spread? cont.

 Recent examples of worm attacks:

 Zafi

 Mabutu

 Bropia

 Santy

The Virus Hoax

 Jdbgmgr hoax

 Tax return hoax

 W32.Torch hoax

Virus Scanners

 Software that tries to prevent viruses from

infecting machines.

 Works in two ways, generally:

 Contains a list of known virus files in a .dat file

and compares files on your computer to that file

 Monitors the computer for certain types of virus

behavior

 Can be on-demand or ongoing scanning

Virus Scanning Techniques

 E-mail and attachment scanning

 Download scanning

 File scanning

 Heuristic scanning

 Active code scanning

 Instant messaging scanning

Commercial Antivirus Software

 Factors to consider when choosing antivirus

software:

 Budget (price)

 Vulnerability (how often is e-mail used or files

downloaded?)

 Skill (users need to understand how to use it)

 Technical (specifications of the software and how

it functions)

Commercial Antivirus Software cont.

 McAfee VirusScan

 Very affordable

 Different versions for different levels of

vulnerability

 Easy to use

 Technically sound virus scanner

McAfee Virus Map

Commercial Antivirus Software cont.

 Norton Antivirus

 Very affordable

 Different versions for different levels of

vulnerability

 As easy to use as McAfee

 Technically sound virus scanner

Commercial Antivirus Software cont.

 Avast! Antivirus

 Free

 Commercial version for enterprise settings

 GUI interface for ease of use

 Does not have a virus map (like McAfee)

 Does not pick up hacking tools (like Norton)

 www.avast.com

http://www.avast.com/

Commercial Antivirus Software cont.

 PC-cillin

(www.trendmicro.com)

 GUI interface

 Includes wireless

scanning

http://www.trendmicro.com/

Commercial Antivirus Software cont.

 Panda (www.pandasoftware.com)

 Available in both commercial and free versions

 Personal firewall can be bundled with it

 Offered in multiple languages

 Other Virus Scanners

http://www.pandasoftware.com/

Antivirus Policies and Procedures

 Brief summary of possible policies:

 Always use a virus scanner

 If you are not sure about an attachment, do not

open it

 Consider exchanging a code word with friends

 Do not believe “security alerts” you are sent

 Be skeptical of any e-mail you are sent

 Do not download files from the Internet

Additional Methods for Defending

Your System

 Set all browsers to block active code

 Set all user accounts so that they cannot

install software or change browser security

 Segregate subnetworks

What to Do If Your System Is

Infected by a Virus

 Need to focus on three things:

 Stopping the spread of the virus

 Removing the virus

 Finding out how the infection started

Stopping the Spread of the Virus

 Priority number 1

 Follow these steps:

1. If infection is on a WAN, disconnect the WAN.

2. If on a subnet, disconnect that subnet.

3. Disconnect vital servers that might be connected

to an infected machine.

4. Disconnect any backup devices that might be

connected to an infected machine.

Removing the Virus

 Virus propagation must be stopped first

 Run antivirus software

 Find removal instructions on the Internet

 Some viruses cannot be removed

Finding Out How the Infection Started

 Talk to users of infected machines

 Read any online documentation on that virus

 Check activity logs from the machine

Summary

 Virus attacks and hoaxes are arguably the

greatest threat to computer networks

 Sophistication of viruses and worms is

increasing

 It is necessary to understand how viruses

work to prevent infection

 You also need to know how viruses spread

Summary cont.

 There are a number of ways to reduce

exposure to viruses

 Virus scanners

 Understand how they work

 Be familiar enough to choose the right one for your

organization

 Come in both commercial and free versions

 Establish written policies and procedures

Summary cont.

 There are a number of ways to reduce

exposure to viruses (continued)

 Block installation of software by users

 Secure the browser

 Separate subnetworks

 Security should have a multilayer approach