Anti-Virus Software

Virus attacks can spread quickly and are costly and time-consuming to fix. Researchers at CAIDA estimate that Code Red worm infected 359,000 computers in less than 14 hours. [CAIDA] Therefore, it is worth the investment to install anti-virus software on all servers and workstations within the protected network to guard against malicious code attacks.

In general, an anti-virus software program searches through files (or memory) for indications of malicious code using a virus profile (sometimes called "signatures") provided by the vendor. Anti-virus software programs can also remove viruses from files, isolate files that cannot be cleaned, and discover Trojan horse programs and worms. Some anti-virus software can recover data deleted by viruses.

Because new viruses are discovered daily, the effectiveness of anti-virus software is dependent upon having the latest virus profiles installed on your computer. Some virus tool vendors provide subscription services or other distribution facilities to help customers keep up to date with the latest viral signatures.

Strengths of anti-virus software:

• Protect users from email borne malicious code that can go unnoticed by IDSs and firewalls

• Can detect a network-propagated virus infection

Weaknesses of anti-virus software:

• Must be updated frequently

• Does not protect against all network-based exploits

Two popular anti-virus programs are Norton Anti-Virus and McAfee Anti-Virus toolkits. Click on either of these links to explore their virus information libraries.

More information about viruses and anti-virus software can be found on the CERT Computer Virus Resource page.

You can also read an article on "Malicious Code Propagation and Antivirus Software Updates" from the CERT incident notes page.

6.3.3 Data Recovery

In case of a security breach where your data is compromised, tampered with, corrupted, or deleted, you need to be sure you have a backup, or a copy of your data to restore your computer system. Data that can be compromised include files, application programs, and the operating system. Backing up your data is one of the most important actions in securing your computer system. Having a backup of your data not only mitigates data loss caused by intruder attacks, backups also help recover from losses caused by unintentional deletion of data, software malfunction, hardware malfunction, and natural disasters.

In general, you should back up your system:

• Periodically (for example, monthly, weekly, every other day, everyday) depending on how frequently your data changes

• Before you make potentially irreversible changes to your data such as changing file structures, deleting large amounts of data

• Before installing hardware or software components that may alter your data

Backups should be kept on a removable medium or stored at a remote site in case of natural disasters or physical destruction of computer equipment. When performing virus scans or data integrity checks on your system, be sure to perform it on your back ups too. It is important that the backed up data is not compromised or corrupted.

There are various backup methods.

Full backup

A copy of all your data

Differential backup

A copy of all the data that changed since the last full backup

Incremental backup

A copy of all the data that changed since the last full, differential, or incremental back up. Note that the first incremental backup is also a differential backup from the full backup.

Selective backup

A copy of only selected data

Below is a chart comparing the relative time consumed for each method, and a suggested time frame for performing each backup scheme.

Backup Method	Relative time	Suggested backup period
Full backup	***	every week or every other week
Differential backup	**	mid-way between full backups
Incremental backup	*	mid-way between differential backups
Selective backup	* to**	when selected data is changed

Table 1 Comparing backup methods

To understand how these backup methods work better, let us visit some scenarios.

Example 1: organization that does a full backup every Friday at 5 P.M. and a differential backup every Wednesday at 5 P.M. Incidence: data failure on Thursday at 6 P.M. Data recovery method: restore data from last Friday's full backup and then Wednesday's differential backup. Data loss: data after Wednesday's differential backup and before data failure Thursday- about 25-hours worth of work on the machine

 

Example 2: organization that does a full backup every Friday at 5 P.M., a differential backup every Wednesday at 5 P.M., and an incremental backup every other day at 5 P.M. Incidence: data failure on Thursday at 6 P.M. Data recovery method: restore data from last Friday's full backup, then Wednesday's differential backup, and finally Thursday's incremental backup. Data loss: data after Thursday's incremental backup- about one hour worth of work on the machine

Notice that it may take more time to recover data if many incremental backups were done, but the amount of data lost would be less. When determining how often you should backup your data, ask yourself how many hours worth of work on the computer are you willing to risk losing? For example, if your answer is 24 hours, then you should back up everyday. If your answer is 48 hours, you should back up every other day. When choosing a backup method, keep in mind the relative amount of time each backup method takes to complete when you would conduct the backup. For example, a full backup would take the longest amount of time; therefore, they are usually performed during hours when the computer system is not being used as much. At the minimum, full backups should be performed on a regular basis.