Effective Measures

Malware - (mal´wãr) (n.) Short for malicious software, software designed specifically to damage or disrupt a system, such as a virus or a Trojan horse. This recently invented term covers the entire taxonomy of nasty programs that you're sooner or later going to encounter over the life of your system. There are several broad classifications of malware and here, we're going to address some of the most effective ways to deal with it. These threats to your system's security cover the range from simple annoyances such as pop-up advertisements to viral system-wreckers to the more sinister and often unnoticed agents of identity theft in the form of certain Trojan horse programs.

The vast majority of malware makes its way into your system via a network connection of one sort or another. Sometimes, it takes nothing more than the simple exchange among friends of a CD that may contain downloaded music or other files to spread a particular virus or other nasty piece of work.

Layered Defense. Here's your picture: no single defense against malware is going to be 100% effective. You can't just install an antivirus package and call it good. The best defense is a layered defense, typically consisting of one or more antivirus packages (yes - I meant more than one), a spyware blocker/killer and a good firewall. That's your holy trinity: firewall - antivirus - antispyware.

Network Guardian. Generally speaking, the place to stop malware is at the periphery of your network - that is, stop it before it enters your network - not after. The role of network guardian in small networks is ususally delegated to a relatively inexpensive combination router/firewall/switch. The protection offered by the least expensive of these devices is better than nothing, but can amount to little more than a speed bump with respect to a determined attacker or one of the more sophisticated viruses/Trojans. The very best of breed firewalls often incorporate highly effective antispam and antivirus engines that offer far more sophisticated protection than workstation-based packages. This comes at a price, however, but it is not as expensive as you might think.

Workstation-Based Defense. Just because you have a decent firewall that may even incorporate stateful antivirus and antispam engines, you're not off the malware hook just yet. You can think of workstation-based antivirus and antispam/spyware packages as your last-ditch defense against the legions of malware attackers. This is where you'll catch the 5% of the items that will inevitably slip past your firewall. Let's look at some of the scenarios that make workstation-based defenses an absolute necessity:

The bottom line is that if you can stop 98% of malware and intruders at the edge of your network, your workstation-based antivirus/antispyware packages will have less work to do and will be more likely to stop the other 2% of the nasty business that lurks out there.

So - let's take a look at what you can do to secure your business and personal data assets.

Spyware may be close to the bottom of the malware taxonomy, but it can cause real problems for your business systems. Firewalls and antivirus packages generally won’t stop this type of intrusion, although some are getting better at it. This particular class of intrusion is one that is generally benign – more of a nuisance than anything else. But there’s a dark side to spybots and spyware that needs to be examined. This stuff – most of the time – tracks your website browsing habits and sends that info back to certain web-based advertisers. That’s why you get those never-to-be-sufficiently damned pop-ups and other sorts of intrusive adverts. Someone knows where you’ve been and gears their advertising accordingly. Getting spam? Weird results from search engines? Home page redirection? This may be one of the reasons. If nothing else, once you've accumulated enough of these unwanted 'passengers,' your system's performance will suffer.

Often, you don't even realize that you've installed spyware because it piggybacks in on free software that serves another purpose (example: the ad-serving app Cydoor, which is included with the Kazaa file-sharing program). Spyware is often downloaded and installed via nefarious Web sites (notice a new default home page or search engine for your Internet Explorer?). The end result is that your browser may default to unusual search-engine sites or produce odd search results, and you may see exponential growth in the number of pop-up ads that litter your desktop while you surf.

In practical terms, you now have one or more "live" servers sitting on your PC shoveling information about you and your surfing habits out the back door. But wait. There's more. And worse. These tiny ‘servers’ can be hijacked by knowledgeable bad guys and can be used for any other purpose they see fit. This, folks, is not a Good Thing. There are cures for this sort of thing, and some of the best ones are free.

Recommendations:

Microsoft Anti-Spyware. This product, currently in beta and available as a free download form Microsoft is world-class. Easily the most effective product in the current marketplace.

SpyBot Search and Destroy. Outstanding results and performance. Free. Minimal end user support. Download from www.cnet.com or www.ZDNet.com.

WebRoot Spy Sweeper. Outstanding results and performance. $29.95. Excellent end user support. Download and purchase from http://www.webroot.com/products/spysweeper/

The best way to protect your business against viruses is not to catch them in the first place. This is hardly practical, because in order to be 100% virus-proof, your computer would have to remain isolated with no external input from anywhere. This means that accessing the Internet, using floppies and CD-ROMs are all verboten. Not too practical, I'm sure you'd agree. In an imperfect and sometimes hostile world, your next best bet is to use an industrial-strength commercial anti-virus package, such as GriSoft's AVG Anti-Virus. These scanners examine the files, folders, mail messages, and Web pages on your computer, looking for the distinctive patterns of viral code. When the scanner detects something that looks suspicious, it quarantines the suspect object and warns you about what it's found. But as good as some virus scanners are, there are threats against which they offer no protection at all. There are some things that they are simply not designed to do. The fundamental unit of network communication - the packet - is basically invisible to them. For protection at this level, you need a firewall.

A firewall is the necessary complement to a good virus scanner. Without a firewall, your computer is operating under an "open door" policy. Bank account information. Passwords. Credit card numbers. Documents and photos that you don't want to share with the world. They are all available to anyone with bad intentions and basic computer skills. Hackers can get in, take what they want, and even leave open a "back door" so they can turn your computer into a "zombie" and use it to attack other computers.

Think of a firewall as a traffic cop - it controls the flow of traffic going between two or more networks. A firewall acts as a gateway that makes decisions about what kind of connections to allow or deny. Firewalls accomplish this by inspecting what virus scanners do not - the packet and its contents. By examining each and every packet that passes through them, a firewall's programming can look at services, network addresses and even users associated with network traffic. If something suspicious occurs - that is, a violation of the rules set up in the firewall's programming - the firewall will drop that connection, usually before it can be made. Firewalls can be broadly classified in terms of the defensive methods they use: packet filters, stateful packet inspection and proxy-based firewalls.


\| Sat Services \| Networks \| Data Security \| Products \| Solutions \| \| Educate Me \| Home \|
Copyright 2003 - StarLAN Consulting Services