Implementing Malicious Code Countermeasures

Because malware is so prevalent, it’s important to protect systems. The primary method of protection is antivirus software and an aggressive defense-in-depth strategy. As an overview, the following methods can be implemented as countermeasures against malware:

• Install antivirus software on all systems.

• Install antivirus and antispam software on e-mail servers.

• Install antivirus and content filter software on firewalls.

• Keep all antivirus software up to date.

• Keep all systems up to date.

• Educate users.

Figure 6-1 shows a popular multipronged approach to installing AV software. First, content-filtering firewalls are placed between the Internet and the internal network to filter all traffic coming in. They attempt to filter out any malicious code. Next, the mail server has specialized software that scans all e-mail that can strip off malicious attachments and also filter out spam. Last, each individual system has AV software installed.