Guide To Malware Incident Prevention And Handling For Desktops Laptops

• Executive Summary
• 1. Introduction
  • 1.1 Purpose and Scope
  • 1.2 Audience
  • 1.3 Document Structure
• 2. Understanding Malware Threats
  • 2.1 Forms of Malware
  • 2.2 Attacker Tools
  • 2.3 The Nature of Today’s Malware
• 3. Malware Incident Prevention
  • 3.1 Policy
  • 3.2 Awareness
  • 3.3 Vulnerability Mitigation
  • 3.4 Threat Mitigation
    • 3.4.1 Antivirus Software
    • 3.4.2 Intrusion Prevention Systems
    • 3.4.3 Firewalls
    • 3.4.4 Content Filtering/Inspection
    • 3.4.5 Application Whitelisting
  • 3.5 Defensive Architecture
    • 3.5.1 BIOS Protection
    • 3.5.2 Sandboxing
    • 3.5.3 Browser Separation
    • 3.5.4 Segregation Through Virtualization
• 4. Malware Incident Response
  • 4.1 Preparation
    • 4.1.1 Building and Maintaining Malware-Related Skills
    • 4.1.2 Facilitating Communication and Coordination
    • 4.1.3 Acquiring Tools and Resources
  • 4.2 Detection and Analysis
    • 4.2.1 Identifying Malware Incident Characteristics
    • 4.2.2 Identifying Infected Hosts
      • 4.2.2.1 Forensic Identification
      • 4.2.2.2 Active Identification
      • 4.2.2.3 Manual Identification
      • 4.2.2.4 Identification Recommendations
    • 4.2.3 Prioritizing Incident Response
    • 4.2.4 Malware Analysis
  • 4.3 Containment
    • 4.3.1 Containment Through User Participation
    • 4.3.2 Containment Through Automated Detection
    • 4.3.3 Containment Through Disabling Services
    • 4.3.4 Containment Through Disabling Connectivity
    • 4.3.5 Containment Recommendations
  • 4.4 Eradication
  • 4.5 Recovery
  • 4.6 Lessons Learned
    • Appendix A— Glossary
    • Appendix B— Acronyms and Abbreviations
    • Appendix C— Resources