Malware: Types, Infection and Defense
Malware is software or code designed to compromise system confidentiality, integrity, or availability.
Summary
Malware is software or code designed to compromise system confidentiality, integrity, or availability. Categories describe different properties, such as propagation, disguise, payload, and concealment; one specimen may fit several categories.
| Category | Distinguishing property |
|---|---|
| Virus | Replicates by attaching to a host file or program |
| Worm | Propagates between systems without attaching to a host file |
| Trojan | Masquerades as legitimate software |
Ransomware denies access for extortion, while spyware secretly collects information. Rootkits conceal malicious activity through privileged manipulation. Bots accept remote commands, and fileless malware executes primarily through memory and trusted system tools.
Initial access may involve phishing attachments, malicious downloads, compromised updates, removable media, or vulnerable services. After execution, malware may establish persistence, escalate privileges, contact command-and-control infrastructure, and move laterally.
Layered defenses interrupt initial access, execution, persistence, communication, and harmful actions. Controls include patching, least privilege, application control, email filtering, endpoint protection, network segmentation, and tested offline or immutable backups. Behavior-based monitoring can identify suspicious activity even when signatures do not recognize a sample. Endpoint detection and response (EDR) uses endpoint telemetry and analysis to support detection, investigation, and containment.
Incident response combines isolation, evidence preservation, investigation, eradication, and validated recovery.
Common Misconceptions: Malware categories are not mutually exclusive. Deleting a detected file does not necessarily remove persistence or resolve stolen credentials. Restoring backups does not reverse data theft.
🧠 Key Concepts
- Malware classification
- Virus versus worm
- Initial access
- Persistence
- Command and control
- Layered defenses
- Behavior-based monitoring
- Endpoint detection
- Incident response
- Recovery backups
🧠 Quick Check
See what you remember from the summary.
A malicious program propagates between systems without attaching to a host file. Which malware category describes this propagation method?
🧠 Flashcards Preview
Tap a card to reveal the definition.
Ready to quiz yourself?
Test what you remember with a full practice quiz on this note. Create a free account and start in seconds.
Full Notes
Read the original note content before deciding whether to save or study from it.
Malware: Types, Infection and Defense
📘 Overview Malware is software or code designed to compromise system confidentiality, integrity, or availability. Malware categories describe different properties, including propagation, disguise, payload, and concealment, so a single specimen can belong to several categories.
🧠 Key Idea Effective malware defense interrupts multiple stages of an attack: initial access, execution, persistence, communication, and harmful actions. No single control reliably prevents every infection.
⚔️ Core Details: - A virus replicates by attaching to a host file or program; a worm propagates between systems without attaching to a host file. - A Trojan masquerades as legitimate software; ransomware denies access to data or systems for extortion; spyware secretly collects information. - Rootkits conceal malicious activity through privileged manipulation; bots accept remote commands; fileless malware executes primarily through memory and trusted system tools. - Initial access paths include phishing attachments, malicious downloads, compromised updates, removable media, and exploitation of vulnerable services. - After execution, malware may establish persistence, escalate privileges, contact command-and-control infrastructure, and move laterally. - Layered defenses combine patching, least privilege, application control, email filtering, endpoint protection, network segmentation, and tested offline or immutable backups.
🎯 Why It Matters: - Overlapping malware categories prevent misleading assumptions: a worm can also deliver ransomware or install a remotely controlled bot. - Behavior-based monitoring can reveal suspicious execution and persistence even when signature-based tools do not recognize a new sample. - Segmentation and restricted privileges limit the spread and impact of an infection that bypasses preventive controls. - Incident response combines isolation, evidence preservation, investigation, eradication, and validated recovery; deleting a detected file alone may leave persistence or stolen credentials unresolved.
🧠 Quick Recall: - Virus versus worm - A virus depends on a host file or program; a worm propagates independently between systems. - Trojan - Malware presented as legitimate software; the label describes deception rather than a replication method. - Command and control - Infrastructure or communication channels used to direct compromised systems. - EDR - Endpoint detection and response; endpoint telemetry and analysis supporting detection, investigation, and containment. - Recovery backups - Offline or immutable copies with tested restoration procedures; restoration does not reverse data theft.
More ways to study when you copy this note
Copy this note into your library to unlock focused practice sessions and long-term review.
Answer all questions first, then see feedback at the end — the way real exams work.
Focuses each session on what you got wrong, not what you already know.
Full timed exam with all questions, no pausing, and results at the end. Built for board exam prep.
Part of 🗄️ BS Information Systems — 1st Year
Browse this Review Set →More Computer Science notes
See all →More in Information Assurance and Security
See all →More from NoteLib
Browse NoteLib's public notes →Copy this note to your library and get the full Study Pack instantly — summary, key concepts, and practice quiz included.