CTI 120 Security Fundamentals CH 5

spam

junk email that sends a lot of unsolicited bulk messages indiscriminately, hoping that a few people will open the email, navigate to a website, purchase a product, or fall for a scam.

run Auto Update

to ensure that critical, security, and compatibility updates are made available for installation automatically without significantly affecting your regular use of the Internet.

Use the Services MMC

to stop unknown or questionable services.

Allowing users to install software may

• Introduce malware to a system. • Bypass safeguards already put in place to protect against malicious viruses and Trojan horse programs. • Cause conflicts with software already on a baseline computer within an organization.

Windows 7 supports two mechanisms for restricting applications which are:

- Software restriction policies - AppLocker

Security updates

A security update is a broadly released fix for a product-specific securityrelated vulnerability. Security vulnerabilities are rated based on their severity, which is indicated in the Microsoft security bulletin as critical, important, moderate, or low.

Service packs:

A service pack is a tested, cumulative set of hotfixes, security updates, critical updates, and updates, as well as additional fixes for problems found internally since the release of the product. Service packs might also contain a limited number of customer-requested design changes or features. After an operating system is released, many corporations consider the first service pack as the time when the operating system has matured enough to be used throughout the organization.

Windows Update program

This program scans your system to determine what updates and fixes your system needs. You then have the opportunity to select, download, and install each update.

Window's Defender

This program will help protect your computer against pop-ups, slow performance, and security threats caused by spyware and other unwanted software by detecting and removing known spyware from your computer.

autolaunch

Turn off ......... , so you don't activate a computer virus just by opening an email.

individual user account

UAC can be enabled or disabled for any

buffer overflow

Viruses and worms often exploit what is known as a

Group Policies

When moving from computer to computer with in an organization,everything will be similar if you use..... so that users can't access certain features (including the control panel) and make changes to the system that may be detrimental.

Do not do it

When surfing the Internet, if you encounter browser pop-ups that tell you that you need to download the newest driver or check your system for viruses,

virus hoax

a message warning the recipient of a nonexistent computer virus threat, usually sent as a chain email that tells the recipient to forward it to everyone he or she knows.( a form of social engineering that plays on people's ignorance and fear)

worm

a self-replicating program that copies itself to other computers on a network without any user intervention and usually spread via security holes in operating systems or TCP/IP software implementations. Does not corrupt or modify files....slows it down

hotfix

a single, cumulative package that includes one or more files that are used to address a problem in a software product, such as a software bug.

rootkit

a software or hardware device designed to gain administrator-level control over a computer system without being detected while targeting the BIOS, hypervisor, boot loader, kernel, or less commonly, libraries or applications.

Spyware

a type of malware that is installed on a computer to collect a user's personal information or details about his or her browsing habits, often without the user's knowledge. ie KEYLOGGER, in the form of browser extensions

Trojan horse

an executable (performs a function) program that appears as a desirable or useful program. Because it appears to be desirable or useful, users are tricked into loading and executing the program on their systems. it might cause a user's computer to become unusable, or it might bypass the user's system security, allowing his or her private information (including passwords, credit card numbers, and Social Security number) to be accessible by an outside party.

Adware

any software package that automatically plays, displays, or downloads advertisements to a computer after the software is installed or while the application is being used.

In Internet Explorer

be sure to disable any unknown or questionable add-ins.

If you can't do windows updates:

check to see what the date and time is... go to Bios and fix the clock

Microsoft Windows Malicious Software Removal Tool,

checks computers running Windows for infections by specific, prevalent malware. Release dates for updated versions on the second Tuesday of each month.

macro code

code within a word document that performs a function.

Offline files

copies of network files that are stored on your computer so you can access them when you aren't connected to the network or when the network folder that contains the files is not connected. Not encrypted and may need encryption..which would safeguard your computer incase of theft. If you do encrypt, . You do not need to decrypt an encrypted file or folder stored on your computer before using it. This is done for you automatically.

DNS Mail Exchanger (MX) record

direct all email to the spam filter by changing your .... to point to the antispam server or device. email that is not considered spam will be forwarded to your internal email servers. ***Barracuda***

antispyware package to check for spyware. You can also use Windows Defender.

if your antivirus package does not have an antispyware component, you should install a separate

Critical updates:

is a broadly released fix for a specific problem addressing a critical, nonsecurity related bug

virus

program that can copy itself and infect a computer without the user's consent or knowledge. Usually a compressed file.

RODC

read only domain controller

Pharming

redirecting a website's traffic to a bogus website

User Account Control (UAC)

s a feature that started with Windows Vista and is included with Windows 7. UAC helps prevent unauthorized changes to your computer—and in doing so, it helps protect your system from malware.

Windows Defender

s a software product from Microsoft that is intended to prevent, remove, and quarantine spyware in Microsoft Windows.

Locking down a Client computer

so that a user cannot harm it, (should everybody be an Admin or standard users?)

phishing

social engineering

Malicious software or Malware

software that is designed to infiltrate or affect a computer system without the owner's informed consent

keep your system up to date with the latest service packs, security patches, and other critical fixes.

the first step you should take to protect yourself against malware is to :

anti-virus program and up to date anti-spyware

to detect malware, you should use an....... and a ........

Use System Configuration or MSconfig

to disable unknown or questionable services and startup programs.

Use Task Manager

to view and stop unknown processes and to stop unknown or questionable services.

Press Task Manager

to view processor and memory utilization to see which process is using the greatest amount of processor and memory.

Important updates

These updates offer significant benefits, such as improved security, privacy, and reliability. They should be installed as they become available and can be installed automatically with Windows Update.

Windows updates,

After installing Windows, you should check to see whether Microsoft has released any

regular backups

Don't forget to perform

at least once a week

To protect your computer you should be sure to perform a full scan with anti-virus software:

Optional updates:

These include updates, drivers, or new software from Microsoft to enhance your computing experience. You need to install these manually.

Recommended updates

These updates address noncritical problems or help enhance your computing experience. Although these updates do not address fundamental issues with your computer or Windows software, they can offer meaningful improvements.

e-mail or IM

Avoid using hyperlinks attatched in a :

an unreputable source

Don't install unknown software or software from

Windows Server Update Service (WSUS)

For corporations, you can also use................. or System Center Configuration Manager (SCCM) to keep your systems updated.

content zone

For each of these zones, a security level is assigned.

administrator

If you are logged in as an , UAC asks you for permission before performing actions that could potentially affect your computer's operation or change settings that affect other users.

reboot Windows in safe mode and try another scan or you can also try booting from a CD or DVD and running the scan.

If your antivirus software package keeps finding the same malware over and over again, you need to be sure that you're not accessing a disk or other device that keeps infecting your system. How do you reboot Windows?

the Internet. Often, you can find step-by-step instructions for removing malware, including deleting files and keys in the registry

If your software can't remove a particular virus,look on

As a standard user, in Windows 7,

Install updates from Windows Update • Install drivers from Windows Update or drivers that are included with the operating system • View Windows settings • Pair Bluetooth devices with a computer • Reset the network adapter and perform other network diagnostic and repair tasks

Important, Recommended, or Optional

Microsoft classifies updates as

Microsoft Security Essentials (MSE),

Microsoft offers......... a free antivirus software product that provides protection from malware including viruses, rootkits, spyware, and Trojan horses.

Symptoms of Malware

Poor system performance • Unusually low levels of available memory • Poor performance while connected to the Internet • Decreased response rates • Longer start-up times • Instances in which your browser closes unexpectedly or stops responding • Changes in your browser's default home or default search pages • Unexpected pop-up advertising windows • Addition of unexpected toolbars to your browser • Instances in which unexpected programs automatically start • Inability to start a program • Malfunctions in Windows components or other programs • Missing programs or files • Unusual messages or displays on your monitor • Unusual sounds or music played at random times • Creation and/or installation of unknown programs or files • Appearance of unknown browser add-ins • Corrupted files • Unexpected changes in file sizes ********Malwarebytes********

backdoor

Programmers build a program that gives someone remote, unauthorized control of a system or initiates an unauthorized task. installed by viruses or other forms of malware or created by programs on commercial applications or with a customized application made for an organization.

to enable offline files

Start/ Control Panel/ search for offline files/Manage offline files/click Enable offline files

to encrypt offline files

Start/ Control Panel/Manage Offline Files/Encryption tab/Click encrypt/ok

COOKIE

Stores information can be good and bad, delete on occasion