CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.5  Malicious Code

1.5  Malicious Code 1 2 1.5.2  Trojan Horses

Managing and Preventing Virus Infections

Numerous measures can be taken to prevent, contain and perform damage control on virus infections on your network, including:

Enforcing a policy that users must run anti-virus software on their workstations (if some users complain that they don’t want to run your organization’s standard anti-virus software xyzzy because it locks their computer up when they try to run program frobozz, don’t let them out of the anti-virus utility requirement… find another one for them to try). Common packages are Symantec’s Norton Anti-Virus¹⁰², McAffee VirusScan¹⁰³ and Grisoft AVG AntiVirus¹⁰⁴

• Virus-scanning all incoming email automatically, to guard against attachments that contain viruses being received and then opened or run by users
  
  
• Require users to use software which does not include macro capability, or require users to save files in formats not supporting macros (for example, Microsoft Word can save files in .rtf format, which doesn’t support macros, as well as in .doc format)
  
  
• Change PC boot sequence in CMOS to always try to boot from the hard disk first, so that a floppy carrying a boot sector virus won’t infect a workstation’s boot sector (and thus infect that PC)
  
  
• Set email clients to not automatically open attachments of certain types (like .EXE)

A virus is almost guaranteed to get through your defenses eventually no matter how careful you are – perhaps because it was just released out into the wild 6 hours ago, and your anti-virus software does not recognize it, and thus didn’t stop its entry into your network. And then, once it’s been discovered, you may or may not have software that will remove it safely, since some viruses are so destructive that they cannot be removed without deleting all infected files. Taking on a task like this is expensive. The average cost in 2003 was almost $100,000 USD¹⁰⁶ . (And you thought getting Security+ certified is expensive).

In that case, what will save you is a good, recent backup. If you are on a company network which features standardized clients (same type of PC, same OS and applications, etc.), a “Norton Ghost” style disk image program may allow for quick recovery in the case of multiple infections.

1.5  Malicious Code 1 2 1.5.2  Trojan Horses