4.2 Protection From Malware

What is malware?

Malware (malicious software) is any program designed to damage, disrupt, or gain unauthorized access to a system. Common types include viruses (attach to files, need a host to spread), worms (self-replicate across networks without user action), trojans (disguised as legitimate software), ransomware (encrypts data for payment), and spyware (secretly collects user data).

How malware spreads

Malware often spreads through phishing emails, malicious attachments, infected downloads, removable media, and exploiting unpatched software vulnerabilities. Social engineering tricks users into clicking links or granting permissions, while worms exploit network weaknesses directly without human interaction.

Defending against malware

Protection strategies include installing antivirus/anti-malware software, keeping systems and applications updated with patches, using firewalls, enabling least privilege access, avoiding suspicious links/attachments, and performing regular backups. Layered defenses reduce the chance that one weakness leads to full system compromise.

Key terms

Malware

Malicious software designed to damage, disrupt, or gain unauthorized access to a system.

Virus vs. Worm

Virus: attaches to files, needs user action to spread. Worm: self-replicates and spreads automatically across networks.

Trojan

Malware disguised as legitimate software to trick users into installing it.

Ransomware

Malware that encrypts a victim's files and demands payment for the decryption key.

Least privilege

Security principle giving users/programs only the access needed to perform their tasks, limiting potential malware damage.

Try an AP-style question

Signature-based antivirus detects malware by…

1. watching for odd behavior
2. encrypting every file
3. blocking all downloads
4. matching known code patterns