Malware Protection: Types, Tools and Best Practices

What Is Malware Protection

Malicious software (malware) is a program designed to perform malicious activities. For example, malware can be programmed to spy on browser activity, steal financial information, or irreversibly encrypt data and demand a ransom.

There are many types of malware—the most common are viruses, worms, trojans, ransomware, spyware and adware. We discuss each of these types in more detail below.

The majority of malware attacks are delivered through links to malicious websites or malicious email attachments. Once a user clicks on the link or opens the file, the malware is activated and starts performing the malicious action it was designed for.

Malware protection technology can protect against malware attacks using a variety of techniques, including signature-based malware detection, behavior-based malware detection and sandboxing.

Common Types of Malware

Here are some of the most common types of malware:

Ransomware—malware which is designed to infiltrate computers and encrypt key files. After these files have been encrypted, the individual behind the ransomware demands payment for access to the secret key required to decrypt the encrypted files.

Viruses—malware that functions by infecting different computer programs. For instance, a virus could overwrite the code of an affected program with its own code or make the program import and use a malicious code.

Worms—malware that is created to sprawl out to additional infected systems. This could include malware that spreads by releasing phishing emails or that scans for different vulnerable computers.

Rootkits—malware that is created to be secretive and can watch a computer user. Once it has been installed, the rootkit attempts to hide itself so as to avoid detection by antivirus and other security programs, while exfiltrating and collecting data for the operator.

Cryptomining malware—cryptocurrency mining programs are created to exploit cryptocurrencies awards by solving Proof of Work computational puzzles. Cryptomining malware makes use of the CPU tools of an infected computer to find solutions to these problems. This enables criminals to win award money.

Botnet—a network of infected computers. Cybercriminals use and control botnets in order to carry out large-scale, automated attacks, such as Distributed Denial of Service (DDoS) and credential stuffing. Botnet malware is intended to infect computers with a place a control and command structure that lets attackers send commands to the malware so that it carries out the attacker’s intention.

Trojans—malware created to impersonate something. Trojans try to steal the credentials of online accounts that may offer access to various streams of income like online bank accounts.

Fileless—a form of malware that avoids detection by traditional antivirus applications, which scan a computer’s files for indications of malware. This is achieved by removing custom malicution code and using functionality built into the system being targeted. This makes fileless malware difficult to detect, because it doesn’t have the file that matches signatures previously retained by antivirus applications.

Adware—malware that is created to serve malicious ads to computer users. Malware developers gain revenue from the advertisers whose ads the author serves.

How to Prevent Malware Infections in Your Organization

You can prevent malware with a variety of techniques:

• Install anti-malware software on your devices
• Ensure safe user behavior on devices (i.e. avoiding opening attachments from untrusted sources)
• Keep your anti-malware software updated, so you can benefit from the latest patches
• Implement a dual approval process for transactions between different organizations
• Implement second-channel verification processes for transactions with customers
• Apply threat detection and response procedures to identify malware and prevent it from spreading
• Implement robust security policies such as whitelists or allow lists
• Deploy advanced threat protection solutions for email security
• Ensure that files uploaded via collaboration channels and cloud storage are properly scanned
• Implement security at the web browser level

How Does Antimalware Software Work?

Antimalware software is a core component of a malware protection strategy. There is a wide range of antimalware solutions and vendors. The majority use the following security strategies.

Signature-Based Malware Detection

This type of detection looks for known software components, identifying them using digital signatures. These signatures are used to flag newly detected software as malware. The signature-based malware approach can help defend against many common malware types, like adware, keyloggers, and some types of ransomware.

It can be useful as a first line of defense against malware, but cannot safeguard a system if threats are new and unknown, or use advanced evasion strategies.

Behavior-Based Malware Detection

This type of detection can support the efforts of security experts, helping them quickly identify, block, and eradicate malware. Behavior-based malware detection processes employ active malware analysis, which examines how the malware component behaves, to identify suspicious processes running on a machine. Behavior-based malware detection is often powered by machine learning (ML) algorithms.

Sandboxing

Sandboxing can isolate potentially malicious components, separating threats from the rest of the system or network. Sandboxes are often used to filter potentially malicious files, ensuring these files are removed before they can damage the system.

For example, when a user opens an email attachment from an unknown source, a sandbox can be used to run the file in a virtual environment. The file is not allowed to access the real operating system or other programs running on the machine—it can only operate within a safe, isolated environment. If the file behaves suspiciously, it is quarantined for further analysis, and the user is not allowed to open it outside the sandbox. Traditional sandboxes have many limitations including latency, detection accuracy, scalability and cost.

9 Malware Protection Best Practices

Here are several best practices to consider when implementing malware protection:

1. Strong passwords and software updates—ensure all users create strone, unique passwords, and regularly change passwords. Use a password manager to make it easier for users to use and remember secure passwords. Update your systems as quickly, as security flaws become known and patches are released.
2. Back up your data and your test restore procedures—backup is a critical practice that can help to protect against data loss. It can help ensure that normal operations can be maintained even if the organization is attacked by network-based ransomware worms or other destructive cyber attacks.
3. Protect against malware—you should employ a layered approach that employs a combination of endpoint protection tools. For example, you can combine endpoint protection with next-generation firewalls (NGFW), and also implement an intrusion prevention system (IPS). This combination can help you ensure security is covered from endpoints to emails to the DNS layer.
4. Educate users on malware threats—train your users on techniques that can help them avoid social engineering schemes, such as phishing attacks, and report suspicious communication or system behavior to the security team.
5. Partition your network—you should use network segmentation to isolate important parts of your network from each other. This can significantly reduce the “blast radius” of successful attacks, because attackers will be limited to a specific network segment, and cannot move laterally to other parts of the network.
6. Deploy advanced email security—the majority of ransomware infections are spread via malicious downloads or email attachments. You should implement a layered security approach; one that can prevent advanced threats from reaching your end users as well as a company-sanctioned file-sharing solution that is scanned, and endpoint protection on user devices.
7. Use security analytics—continuously monitor network traffic, and use real-time threat intelligence feeds to add context to security alerts. This can help you gain extended visibility into threats affecting your network, understand their severity and how to respond effectively.
8. Create instructions for your IT staff—develop an incident response plan, which tells security staff and other stakeholders what they should do to detect, contain, and eradicate a cyber attack.
9. Deploy a zero-trust security framework—in this security approach, all access requests, whether coming from outside or inside the network, must be verified for trustworthiness before they can gain access to a system. The goal is to secure access by end-user devices, users, APIs, microservices, IoT, and containers, all of which may be compromised by attackers.

Malware Protection with Perception Point 

Perception Point delivers one platform that prevents malware, ransomware, APTs and zero-days from reaching your end users.

Advanced email security is an integrated cloud email security solution (ICES) that can replace SEGs. The solution cloud-native SaaS solution protects your organization against all threats using 7 layers of advanced threat detection layers to prevent malicious files, URLs, and social-engineering based techniques.

Advanced Browser Security adds enterprise-grade security to your organizations native browsers. The managed solution fuses browser protection technology with multi-layer advanced threat prevention engines which delivers the unprecedented ability to detect and remediate all malicious threats from the web, including phishing, ransomware, malware, APTs, and more. Multi-layered static and dynamic detection capabilities instantly detect and block access to malicious/phishing websites and prevent malicious file downloads of ransomware, malware, and APTs.

Advanced Threat Protection for Cloud Collaboration, File Sharing and Storage Applications, such as Microsoft 365 applications (OneDrive, SharePoint, Teams), Google Drive Box, AWS S3 buckets, Zendesk, Salesforce, and any of the other hundreds of apps out there, protects your organization with near real-time dynamic scanning. It does not tamper with files and does not impede on productivity.

An all-included managed Incident Response service is available for all customers 24/7 with no added charge. Perception Point’s team of cybersecurity experts will manage incidents, provide analysis and reporting, and optimize detection on-the-fly. The service drastically minimizes the need for internal IT or SOC team resources, reducing the time required to react and mitigate web-borne attacks by up to 75%.

Interested in learning more? Contact us for a demo.