Avoiding Malware 101

Here is yet another article about the increasing problems surrounding malware. Take a few moments to learn about some of the new attack methods hackers are using so you can avoid having to pay the IT guy (hopefully me) to fix your broken PC.

1. USB malware

A great number of the cyber security threats companies face come from the Internet and reach the network through users’ web-facing machines. That’s why a lot of the security tools companies use are focused on blocking those web-based security threats.

However, the Internet isn’t the only place malware can come from. In fact, among the companies surveyed by Bit9 who had been stung by a malware attack, 25% said the threat got onto the network from a USB device that a user plugged into a PC.

Those USB-based attacks are becoming more common, according to a report released earlier this year by McAfee.

Often, problems occur when employees use free USB drives they receive as promotional items — or when they use lost drives they pick up from the street.

Some of the steps being considered by IT staffs everywhere (including me) to help keep malware from moving off of a USB drive onto the company’s network:

• Disable USB ports for users who don’t need them
• Disable auto-play for USB drives
• Require storage devices to be approved by IT before they’re used, and
• Train users not to use drives if they don’t know where they came from, and not to open unknown files contained on drives.

2. Attacks against remote users

Many companies rely on perimeter defenses designed to keep threats away from the internal network.
But as more work is being done remotely on laptops, smartphones and other devices, that means a lot of endpoints aren’t being protected.

According to Bit9′s report, 17% of malware infections occurred while an employee was using a device outside of the company’s network. Another 8% of respondents said an attack originated from an employee’s mobile phone.

Those attacks might give hackers access to sensitive data stored on the remote device, and the malware may spread once the employee returns to office and connects the device to the network.
What it means for IT: It’s important to make sure that all of the devices employees use are being protected regardless of their physical location. That includes both company-issued and employee-owned devices.

3. Malware antivirus programs can’t catch

Close to half (40%) of the companies surveyed that had been hit with malware attacks said the threats simply bypassed the antivirus systems the organization was using.

Recent tests have found that antivirus software is unable to detect many of the threats out there. The main issue is that those programs rely mostly on malware signatures for detection — that means a virus has to be labeled as dangerous before the software will be able to catch it.

Even when virus definition files are updated, there’s typically a lag between when a threat appears and when those signatures are created.

On top of that, cyber criminals are turning more toward sophisticated methods to avoid detection, such as creating specific malware meant to target a single organization.

As I always say, "never ever click on links that your are not familiar with and do not download attachments unless your are 100% sure of where it came from!