CS111-PART 7 (MALWARE).pdf

CS111: INTRODUCTION TO COMPUTING
SOURCE: CISCO.COM

Malware, short for “malicious software”, refers
to any intrusive software developed by
cybercriminals (often called “hackers”) to steal
data and damage or destroy computers and
computer systems.
Examples of common malware include viruses,
worms, Trojan viruses, spyware, adware, and
ransomware.
Recent malware attacks have exfiltrated data in
mass amounts.

HOW DO WE PROTECT
THE NETWORK
AGAINST MALWARE?

Typically, businesses focus on
preventative tools to stop
breaches.
By securing the perimeter,
businesses assume they are safe.
Some advanced malware, however,
will eventually make their way into
your network.

As a result, it is crucial to deploy
technologies that continually
monitor and detect malware that
has evaded perimeter defenses.
Sufficient advanced malware
protection requires multiple layers
of safeguards along with high-level
network visibility and intelligence.

HOW DO WE DETECT
AND RESPOND TO
MALWARE?

Malware will inevitably
penetrate your network.
You must have defenses
that provide significant
visibility and breach
detection.
In order to remove
malware, you must be able
to identify malicious actors
quickly.

This requires constant
network scanning.
Once the threat is
identified, you must
remove the malware from
your network.
Today's antivirus products
are not enough to protect
against advanced cyber
threats.

WHAT ARE THE
TYPES OF MALWARE?

Malware detection is crucial with
malware's prevalence on the
Internet because it functions as an
early warning system for the
computer secure regarding malware
and cyber attacks.
It keeps hackers out of the computer
and prevents the information from
getting compromised.

Viruses are a subgroup of malware.
A virus is malicious software attached
to a document or file that supports
macros to execute its code and spread
from host to host.

Once downloaded, the virus will lay
dormant until the file is opened and
in use.
Viruses are designed to disrupt a
system’s ability to operate.
As a result, viruses can cause
significant operational issues and
data loss.

Worms are a malicious software that
rapidly replicates and spreads to any
device within the network.
Unlike viruses, worms do not need
host programs to disseminate.

A worm infects a device via a
downloaded file or a network
connection before it multiplies and
disperses at an exponential rate.
Like viruses, worms can severely
disrupt the operations of a device
and cause data loss.

Trojan viruses are disguised as
helpful software programs.
But once the user downloads it, the
Trojan virus can gain access to
sensitive data and then modify,
block, or delete the data.

This can be extremely harmful to
the performance of the device.
Unlike normal viruses and worms,
Trojan viruses are not designed to
self-replicate.

Spyware is a malicious software
that runs secretly on a computer
and reports back to a remote user.
Rather than simply disrupting a
device’s operations, spyware
targets sensitive information and
can grant remote access to
predators.

Spyware is often used to steal financial or
personal information.
A specific type of spyware is a keylogger,
which records your keystrokes to reveal
passwords and personal information.

Adware is malicious software used
to collect data on your computer
usage and provide appropriate
advertisements to you.
While adware is not always
dangerous, in some cases adware
can cause issues for your system.

Adware can redirect your browser
to unsafe sites, and it can even
contain Trojan horses and spyware.
Additionally, significant levels of
adware can slow down your
system noticeably.
Because not all adware is
malicious, it is important to have
protection that constantly and
intelligently scans these programs.

Ransomware is malicious software
that gains access to sensitive
information within a system,
encrypts that information so that
the user cannot access it, and then
demands a financial payout for the
data to be released.
Ransomware is commonly part of a
phishing scam.

By clicking a disguised link, the
user downloads the ransomware.
The attacker proceeds to encrypt
specific information that can only
be opened by a mathematical key
they know.
When the attacker receives
payment, the data is unlocked.

Fileless malware is a type of
memory-resident malware.
As the term suggests, it is malware
that operates from a victim’s
computer’s memory, not from files
on the hard drive.
Because there are no files to scan,
it is harder to detect than
traditional malware.

It also makes forensics more
difficult because the malware
disappears when the victim
computer is rebooted.
In late 2017, the Cisco Talos threat
intelligence team posted an
example of fileless malware that
they called DNSMessenger.

Some viruses are sneaky and can infect your system without you
ever knowing.
Knowing the symptoms of a virus can help you save your
computer before it's too late.
Look for slow computer performance, erratic computer behavior,
unexplained data loss, or frequent system crashes.

CS111-PART 7 (MALWARE).pdf

More Related Content

Similar to CS111-PART 7 (MALWARE).pdf (20)

Recently uploaded (20)

CS111-PART 7 (MALWARE).pdf