Malware Detection and Prevention
Malware, or malicious software, is any program designed to harm devices, networks and their users in some way. Depending on the type of malware and its goal, this harm could include stealing, encrypting or deleting data; modifying or hijacking core computing functions; spying on or tracking end users’ computer activity; and even physically damaging computers or servers.
Malicious code enters your systems through a variety of methods, including exploits, Trojan horses, backdoors and ransomware. Exploits use bugs or vulnerabilities in a service, plugin or implementation to gain access. Zero-day exploits use flaws for which there are no currently available defenses or fixes. Backdoors give attackers remote access to your system through a compromised user account or service, giving them the ability to steal data and install malware. Ransomware encrypts files and demands payment in exchange for decryption keys.
Detecting malware requires a holistic approach that includes monitoring for suspicious and malicious behavior, regularly backing up and restoring data, and updating operating systems and applications to close vulnerabilities. As soon as malware is detected, it’s critical to isolate infected systems and disconnect them from the internet to prevent further spread. Security teams should also analyze indicators of compromise to determine the type of malware and which systems were impacted.
The term malware was coined in 1982 to describe a self-replicating program that infects other computer programs without the attacker’s knowledge, causing damage or consuming system resources. Viruses are the most common form of malware, but there are many other types as well: worms spread to multiple computers by infecting floppy disks; Trojans masquerade as games or free updates and claim to repair systems; keyloggers track every keystroke on the keyboard; and rootkits hide themselves from detection and provide attackers with administrator privileges (also known as “root” access). Cybercriminals deploy malware for a variety of purposes: stealing sensitive information; spying on individuals or businesses; disrupting operations; gaining unauthorized access; and holding systems hostage via various forms of ransomware. Governments are also using malware for espionage and sabotage, such as the Stuxnet attack that sabotaged Iran’s nuclear centrifuges.