13 - Protecting against malware

Summary

During the past few decades, there has been a significant interest in computer malicious programs. As the number of these programs keeps on increasing, efficient software solutions are needed to protect the enterprise from other living software without excessive requirement of user intervention. This chapter discusses malware definition and classification. It describes the ways that major classes of malware (e.g., viruses, worms, and Trojans) are built and propagated. It finally discusses the protection measures that an enterprise needs to develop to protect against such malware destructions. It also develops a non exhaustive set of guidelines to be followed.

Introduction to malware

Malicious software, often referred to as malware, is defined as a program or part of a program that executes unauthorized commands, generally with some malicious intention. Types of malware can be classified based on how they execute their malicious actions and propagate themselves. Viruses, worms, Trojan horses, and backdoors are the major examples of malware (Garetto et al., 2003). Other malware related terms include malcode and malware payload. Malcode refers to the programming code that contains the malware logic, while the malware payload represents the malicious action it is designed to realize (Briesemeister et al., 2003; Anagnostakis et al., 2003).

A malware can damage the host on which it is running by corrupting files and programs or over-consuming resources. Typically, this is done while the malware is avoiding the complete devastation of the host because a system failure would prevent the ability of the malware to propagate further.