Q22Information Security Systems
Question
Differentiate between Viruses, Worms, and Trojans. Describe the typical lifecycle of malware and suggest comprehensive countermeasures.
Answer
Viruses infect files, worms self-propagate, and Trojans masquerade as legitimate software.
Malicious software (Malware) categorizes into several distinct types based on propagation and execution behavior. A Virus attaches itself to clean files and infects other clean files, requiring human interaction to spread. A Worm is a standalone malware program that replicates itself automatically across a network to infect other computers without user intervention. A Trojan Horse disguises itself as legitimate or desirable software to deceive users into installing it, often creating backdoors for attackers.
The typical malware lifecycle consists of:
1. Infection/Delivery: The malware is introduced into the target system via phishing, drive-by downloads, or infected media.
2. Execution: The payload activates. 3. Propagation (Optional): The malware attempts to spread across the network. 4. Payload Activation: The primary malicious intent is carried out (data theft, encryption for ransom, botnet joining).
Countermeasures include robust Next-Generation Antivirus (NGAV), strict email filtering and web proxies, regular patching and vulnerability management, User Awareness Training, and enforcing Principle of Least Privilege.
