Trojans, Worms, and Spyware (eBook)

Cover 1
Table of Contents 8
Preface 14
Introduction 16
Inside This Book 18
Acknowledgements 20
Chapter 1. Malicious Code Overview 22
Why Malicious Code Attacks Are Dangerous 24
Impact of Malicious Code Attacks on Corporate Security 27
Why Malicious Code Attacks Work 29
Action Steps to Combat Malicious Code Attacks 36
Chapter 2. Types of Malicious Code 38
E-mail Viruses and Miscellaneous Viruses 39
Trojans and Other Backdoors 43
Worms 44
Blended Threats 45
Time Bombs 46
Spyware 46
Adware 47
Stealware 49
Action Steps to Combat Malicious Code Attacks 50
Chapter 3. Review of Malicious Code Incidents 52
Historic Tidbits 53
The Morris Worm 56
Melissa 57
Love Bug 58
Code Red(s) 63
SirCam 64
Nimda 65
Slammer 65
The Summer of 2003 Barrage of Blaster, Sobig, and More 66
Early 2004 with MyDoom, Netsky, and More 67
Action Steps to Combat Malicious Code Attacks 68
Chapter 4. Basic Steps to Combat Malicious Code Attacks 72
Understanding the Risks 73
Using Security Policies to Set Standards 75
System and Patch Updates 77
Establishing a Computer Incident Response Team 78
Training for IT Professionals 80
Training End Users 81
Applying Social Engineering Methods in an Organization 82
Working with Law Enforcement Agencies 83
Action Steps to Combat Malicious Code Attacks 86
Chapter 5. Organizing for Security, Prevention, and Response 90
Organization of the IT Security Function 90
Where Malicious Code Attack Prevention Fits into the IT Security Function 93
Staffing for Malicious Code Prevention in IT 95
Budgeting for Malicious Code Prevention 98
Evaluating Products for Malicious Code Prevention 101
Establishing and Utilizing an Alert System 102
Establishing and Utilizing a Reporting System 104
Corporate Security and Malicious Code Incident Investigations 105
Action Steps to Combat Malicious Code Attacks 106
Chapter 6. Controlling Computer Behavior of Employees 110
Policies on Appropriate Use of Corporate Systems 111
Monitoring Employee Behavior 113
Web Site Blockers and Internet Filters 114
Cookie and Spyware Blockers 118
Pop-up Blockers 120
Controlling Downloads 121
SPAM Control 124
Action Steps to Combat Malicious Code Attacks 128
Chapter 7. Responding to a Malicious Code Incident 130
About the Case Study 131
The First Report of a Malicious Code Attack 133
The Confirmation Process 135
Mobilizing the Response Team 136
Notifying Management 137
Using an Alert System and Informing End Users 137
Cleanup and Restoration 138
Controlling and Capturing Malicious Code 140
Identifying the Source of Malicious Code 141
Preserving Evidence 143
When to Call Law Enforcement and What to Expect 143
Enterprise-wide Eradication 145
Returning to Normal Operations 147
Analyzing Lessons Learned 149
Action Steps to Combat Malicious Code Attacks 151
Chapter 8. Model Training Program for End Users 154
Explaining Why the Training Is Important 155
Explaining the Appropriate-Use Policy for Computers and Networks 162
Explaining How the Help Desk and PC Support of the Organization Works 164
Providing Basic Information about Malicious code 166
Covering the Basic Do’s and Don’ts of Computer Usage to Prevent Attacks 170
Explaining How to Identify and Report Malicious Code 172
Explaining What Employees Should Expect from the IT Department During Incident Response 173
Performing the Administrative Aspects of a Training Program 175
Action Steps to Combat Malicious Code Attacks 175
Chapter 9. The Future of Malicious Code 178
Military-Style Information Warfare 179
Open-Source Information Warfare 187
Militancy and Social Action 195
Homeland Security Efforts 198
Action Steps to Combat Malicious Code Attacks 205
References 205
Appendix–Computer Security Resources 206
Central Command 206
CERT/CC 206
CIO Security and Privacy Research Center 206
CISSP and SSCP Open Study Guide 206
Common Vulnerabilities and Exposures (CVE) 206
Computer Associates Virus Information Center 207
Department of Homeland Security 207
Federal Trade Commission 207
F-Secure Security Information Center 207
GFI Security Lab 207
ICSA Information Security Magazine 207
InfoSysSec 207
InfraGuard 207
Internet Security Review Magazine 208
Internet Storm Center 208
McAfee Avert Virus Information Library 208
MessageLabs: Current Threats 208
Microsoft Security Advisor 208
NIST Computer Security Resource Clearinghouse 208
NIST Virus Information Page 209
NSA Information Assurance Program 209
Panda Software Virus Info 209
SC Info Security Magazine 209
Security Magazine 209
SecurityFocus 209
SecurityGeeks 209
Sophos Virus Information 209
Symantec Security Response 210
Trend Micro Virus Information Center 210
Virus Bulletin 210
VirusList.com 210
Index 212