Prevention

The most effective way to prevent malicious code attacks is avoid opening unexpected email messages or attachments. You should be cautious and use only authorized media for loading data and software. You should not run executable programs unless you trust the sender of the information and you confirmed with the sender that he intended to send you the attachment. Also, avoid sending programs from an unknown source to others.

You should also be cautious when executing content such as Java applets, JavaScript, or Active X controls from web pages. To decrease your computer's susceptibility to worms, you may wish to configure your browser to disable the automatic execution of web page content. You may also want to disable macros in any product that contains a macro language. For example, to disable macro execution in Microsoft Word, click on Tools, select Macro, and then select Security. Choose a security level from High or Medium. "High" silently ignores the macro code and "Medium" prompts you to enable or disable the macro code.

Many security vulnerabilities such as those related to the operating system are discussed on mailing lists. Software companies such as Microsoft release service packs or patches that can be installed to fix the security holes, but if these updates are not installed in a timely fashion, your operating system remains vulnerable to attacks. It is also important to become aware of emerging viruses, worms, and Trojan horse programs. You can consult McAfee's virus calendar for the latest reported viruses.

Detection

Some notable symptoms of malicious code infection on your computer system are:

• Unexpected changes in file sizes or date/time stamps

• Slow starting or slow running because the virus is exhausting computer's resources

• Unexpected or frequent system failures

• Low computer memory on disks

• Abnormal application behaviors

Counter Measures

When you suspect that a virus has entered your system:

1. Try to contain the virus.

2. Try to identify the virus.

3. Try to recover corrupted data and files.

4. Once you have determined the source of infection, alert others of the virus.

There are various tools such as anti-virus scanners that can help you look for known viruses. You can also use anti-virus monitors to look for virus-related application behaviors. These type of tools will be discussed in more detail in section 6.3.2 Intrusion Detection Tools.

You can find more information about malicious code from the CERT website.

6.1.4 Denial of Service

• Network Connectivity

• Network Bandwidth

• Other Resource Consumption Attacks

• Distributed Denial of Service Attack

• Prevention

In February 2000, DoS [denial of service] attacks took down five popular Web sites in the world, including Amazon, Yahoo! and eBay. Yankee Group has estimated that these attacks have cost the industry at least US$1.2 billion. [InfoWorld, NETstatistica]

In a denial of service (DoS) attack, the objective of the attacker is to exhaust system resources such as network connectivity and network bandwidth to prevent legitimate traffic from being transmitted and processed. This attack is characterized by the following:

• Disruption of network connectivity and Internet services

• Disruption of services to specific system(s) or person(s)

• Consumption of other resources on a computer system