Copyright Goodheart-Willcox Co., Inc. Chapter 2 Information Security Fundamentals 45 Defending Against Malware How do you get malware infections? There are many ways malware can make its way into computer systems. These are the most common examples: • downloading software from the Internet • opening infected attachments from e-mail or other social media platforms • using infected media, such as a fl ash drive Preventing malware infections is the best defense. However, sometimes malware slips past all precautions and defenses. Using an antimalware software program is critical to catch threats that may have been installed without your knowledge. It is important to keep the operating system fully patched. A patch is an update provided by the vendor to correct errors or bugs. Many viruses exploit vulnerabilities left in place due to uninstalled patches. Be careful of any program downloaded from the Internet. Never download anything from a website that appears to be suspicious or unreliable. Ensure the URL displayed in the browser matches the site. For example, www.microsoft.com is the correct URL. However, a hacker may set up a website to look like the offi cial site, but the URL may be www.micr0s0ft.com. Notice the zeros where there should be the letter O. Companies should also consider an equipment policy that prohibits the use of removable media, such as fl ash drives. A system should also be in place to scan e-mail messages and attachments as they are received by the company’s e-mail system. Many malware infections are transmitted via e-mail. Antimalware security companies maintain a database of known threats. Often, antimalware software also uses heuristic methodology. Heuristic methodology is an approach to fi nding previously undetected unwanted pro- grams or variants of known viruses. Antivirus companies have designed sev- eral heuristic methods to search for potentially malicious software. Some of the approaches include deep inspection of fi les, such as determining intent or looking for key words or phrases in the fi le. Others include running the code in an isolated environment to test it before determining if it is safe. Looking at fi le signatures is another method. Basically, this is looking for fi les that are variations of known virus fi les. Heuristic scanning can be successful, but can also result in a lot of false positives. A false positive occurs when the software incorrectly fl ags a valid fi le as a threat. Did you know, heuristic comes from the ancient Greek word heuriskein, which means to fi nd or discover! FYI Quick Look 2.2.2 Antimalware Software There are many antimalware programs on the market. Some are free, and others offer paid subscriptions. With so many choices, it can be diffi cult to make the best decision on which to pick. 1. Launch a web browser, and navigate to a search engine. Enter the search phrase best paid antimalware software. 2. In the search results, select an article from a source you believe to be reliable. Which program is recommended as the top choice? What were some of the highest-rated features of this product? Browse through the list of all products. Which one do you like best, and why? 3. Return to the search engine, and enter the search phrase best free antimalware software. 4. In the search results, select an article from a source you believe to be reliable. Which free antimalware programs would you recommend and why? 5. Discuss your conclusions with your class.