Q22Information Security Systems

Malicious software (malware) can be categorized into several distinct types based primarily on how it propagates and executes.

• Virus: A piece of code that attaches itself to a legitimate host program or file and requires that host to execute in order to run. It is parasitic and typically requires human interaction, such as opening an infected file or running an infected program, to spread from one system to another. Once active, it inserts copies of itself into other clean files on the same machine.
• Worm: A standalone, self-replicating program that does not need to attach to a host file or require user interaction to spread. Worms exploit network vulnerabilities or use email/network shares to automatically copy themselves across systems, often consuming bandwidth and system resources at scale purely through their propagation (e.g., the Morris worm, WannaCry).
• Trojan Horse: Malware disguised as legitimate or desirable software (a game, a utility, a pirated application) to trick a user into voluntarily installing it. Unlike viruses and worms, a Trojan does not self-replicate; instead it typically opens a backdoor, installs a keylogger, or establishes remote access for the attacker once executed.

• 1. Infection/Delivery: The malware is introduced into the target system through vectors such as phishing emails, drive-by downloads from compromised websites, infected removable media, or exploitation of an unpatched software vulnerability.
• 2. Execution: The delivered payload is triggered, either automatically (exploiting a vulnerability) or by the user unknowingly running the malicious file.
• 3. Propagation (where applicable): Worms and some viruses actively attempt to spread further, scanning the local network for other vulnerable hosts, mailing themselves to contacts, or infecting attached storage.
• 4. Establishing persistence: The malware modifies startup entries, scheduled tasks, or system services so it survives a reboot and continues running.
• 5. Payload activation: The primary malicious objective is carried out, such as exfiltrating sensitive data, encrypting files for ransom, logging keystrokes, or enlisting the machine into a botnet for future DDoS attacks.
• 6. Concealment: Many modern malware families use rootkit techniques to hide their processes and files from the operating system and security tools, prolonging their dwell time on the infected host.

• Endpoint protection: Deploying Next-Generation Antivirus/EDR (Endpoint Detection and Response) tools that use behavioral and signature-based detection rather than signatures alone.
• Patch management: Promptly applying security updates to operating systems and applications to close the vulnerabilities worms and drive-by exploits rely on.
• Email and web filtering: Blocking phishing emails and malicious attachments at the gateway, and filtering access to known malicious domains.
• Network segmentation: Limiting how far a worm or lateral-movement Trojan can spread by isolating critical systems into separate network zones.
• Principle of least privilege: Restricting user and process permissions so that even a successful infection has limited ability to modify system-critical resources.
• User awareness training: Educating users to recognize phishing attempts and avoid installing untrusted software, since Trojans specifically rely on social engineering.
• Regular backups: Maintaining offline, tested backups so that ransomware payloads cannot force payment by holding the only copy of critical data hostage.