<map version="0.7.1">
<node COLOR="#ccff00" TEXT="Malware World">
<cloud COLOR="#33ff33"/>
<font NAME="Century Gothic" BOLD="true" SIZE="20"/>
<node TEXT="Damages" POSITION="right">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Primary">
<node TEXT="Loss of Confidential Data">
<node TEXT="Personal Informaion"/>
<node TEXT="Bank Accounts"/>
<node TEXT="Credit Card Numbers"/>
<node TEXT="Passwords"/>
</node>
<node TEXT="File Destruction">
<node TEXT="System Files"/>
<node TEXT="Data Files"/>
</node>
<node TEXT="Network Traffic Congestion"/>
</node>
<node TEXT="Secondary">
<node TEXT="Cost of Recovery"/>
<node TEXT="Loss of Reputation / Business"/>
<node TEXT="Legal Compliance Issues"/>
</node>
</node>
<node TEXT="Prevention" POSITION="left">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Desktop">
<node TEXT="Weekly Scanning of Hard Drive"/>
<node TEXT="Real-time protection of files"/>
<node TEXT="Detect incoming/outoing mail"/>
<node TEXT="Personal Firewall"/>
<node TEXT="Anti-Adware Utility"/>
<node TEXT="Lock-down user rights"/>
</node>
<node TEXT="Server">
<node TEXT="Detect during backup/restore"/>
<node TEXT="Real-time protection"/>
<node TEXT="Scheduled periodic scans"/>
</node>
<node TEXT="Network">
<node TEXT="Gateway Firewall"/>
<node TEXT="IDS">
<node TEXT="Network">
<node TEXT="Detects virus activity"/>
</node>
<node TEXT="Host"/>
</node>
<node TEXT="Proxy Server">
<node TEXT="Scan downloaded file"/>
<node TEXT="Prevent access to sites"/>
<node TEXT="Log all access"/>
</node>
<node TEXT="Mail Filter">
<node TEXT="Filter by file type"/>
<node TEXT="Scan &amp; quarantine attachments"/>
</node>
<node TEXT="SPAM Filter"/>
<node TEXT="Gateway Filter">
<node TEXT="Monitors TCP/IP traffic"/>
</node>
</node>
<node TEXT="Policies">
<node TEXT="Education">
<node TEXT="Do not open unknwon attachments"/>
<node TEXT="Never connect to untrusted network"/>
<node TEXT="Scan floppies &amp; other removal media"/>
</node>
<node TEXT="Penalties"/>
<node TEXT="Procedures"/>
</node>
<node TEXT="Management">
<node TEXT="Centralised monitoring"/>
<node TEXT="Centralised distribution"/>
<node TEXT="Automated alerts"/>
<node TEXT="Vulnerability management"/>
<node TEXT="Patch management"/>
<node TEXT="Asset management"/>
</node>
</node>
<node TEXT="Virus&#xa;Strategies" POSITION="left">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Stealth">
<node TEXT="Polymorphic">
<node COLOR="#006633" TEXT="Consists of a small decryption mechanism, &#xa;coupled with encrypted malicious code." STYLE="bubble">
<font NAME="Default" SIZE="10"/>
</node>
</node>
<node TEXT="Metamorphic">
<node COLOR="#006633" TEXT="Completely different programs generated&#xa;that performs the same objective. Hard to detect." STYLE="bubble">
<edge WIDTH="thin"/>
<font NAME="Default" SIZE="10"/>
</node>
</node>
<node TEXT="Stop Antivirus">
<node COLOR="#006633" TEXT="Detects and attempts to&#xa;stop antivirus software">
<edge WIDTH="thin"/>
<font NAME="Default" SIZE="10"/>
</node>
</node>
</node>
<node TEXT="Boot Sector"/>
<node TEXT="In-Memory"/>
</node>
<node TEXT="Detection&#xa;Strategies" POSITION="right">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Pattern Matching">
<node TEXT="Fast and efficient"/>
<node TEXT="Cannot detect new virus"/>
<node TEXT="Need to constantly update"/>
<node TEXT="Use database of patterns to detect"/>
</node>
<node TEXT="Generic">
<node TEXT="Monitor and block suspicsious activity"/>
<node TEXT="Can detect new virus"/>
<node TEXT="False positive on authorised software"/>
<node TEXT="Also called &quot;Behavior Blocking&quot;"/>
<node TEXT="Difficult to define efficient matching rules database"/>
</node>
<node TEXT="Heuristic">
<node TEXT="Static">
<node TEXT="Determines potential behavior of executables"/>
</node>
<node TEXT="Dynamic">
<node TEXT="Run the target program in protected space"/>
</node>
<node TEXT="Can detect new virus"/>
<node TEXT="Can detect polymorphic/metamorphic"/>
<node TEXT="Difficult to create rules database"/>
</node>
</node>
<node TEXT="Recovery" POSITION="left">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Escalation Procedure">
<node TEXT="Clear responsibilities"/>
<node TEXT="Clear escalation paths"/>
<node TEXT="Need good asset management"/>
</node>
<node TEXT="Quarantine"/>
<node TEXT="Delete infected files"/>
<node TEXT="Restore from backup"/>
<node TEXT="Patch vulnerabilities"/>
<node TEXT="Public relations"/>
<node TEXT="Shut vulnerable ports on routers"/>
<node TEXT="Report to appropriate authorities"/>
<node TEXT="Notify users &amp; third parties"/>
</node>
<node TEXT="Vendors" FOLDED="true" POSITION="right">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Symantec"/>
<node TEXT="Trend Micro"/>
<node TEXT="Sophos"/>
<node TEXT="Microsoft">
<node TEXT="Malicious Software Removal Tool"/>
</node>
</node>
<node TEXT="Trends" POSITION="left">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Virus writers are becmoing more business oriented">
<node TEXT="More specific targets"/>
</node>
<node TEXT="Short time before exploits&#xa;after a vulnerability is found/announced">
<node TEXT="&quot;Zero-day attack&quot;"/>
</node>
<node TEXT="Spyware"/>
<node TEXT="Adware"/>
<node TEXT="Complex threats"/>
<node TEXT="Non-PC (moile phones, etc)"/>
<node TEXT="Phishing">
<node TEXT="Cross-site scripting"/>
</node>
</node>
<node TEXT="Malware&#xa;Types" POSITION="right">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Worm">
<node TEXT="IM/IRC-Worm">
<node COLOR="#006633" TEXT="Propagates through IRC/IM" STYLE="bubble"/>
</node>
<node TEXT="Net-Worm">
<node COLOR="#006633" TEXT="Takes advantage of vulnerabilities in net service, &#xa;such as www and ftp, to propagate. May carry attacker tools." STYLE="bubble"/>
</node>
<node TEXT="P2P-Worm">
<node COLOR="#006633" TEXT="Spreads via infected files exchanged via P2P.&#xa;Usually carries malicious attacker tools."/>
</node>
</node>
<node TEXT="Trojan">
<node TEXT="Trojan-Spy"/>
<node TEXT="Trojan-ArcBomb"/>
<node TEXT="Trojan-Dropper"/>
<node TEXT="Trojan-Notifier"/>
<node TEXT="Trojan-Proxy"/>
<node TEXT="Trojan-PSW"/>
</node>
<node TEXT="Virus">
<node TEXT="Compiled">
<node TEXT="File Infector">
<node COLOR="#006633" TEXT="Attaches to executables" STYLE="bubble"/>
</node>
<node TEXT="Boot Sector Infector">
<node COLOR="#006633" TEXT="Infect master boot records of hard drives&#xa;or the boot sectors of removable media"/>
</node>
<node TEXT="Multipartite Infector">
<node COLOR="#006633" TEXT="Combination of File and Boot Sector" STYLE="bubble"/>
</node>
</node>
<node TEXT="Interpreted">
<node TEXT="Script (JavaScript VBScript)"/>
<node TEXT="Macro Virus (Word/Outlook)"/>
</node>
</node>
<node TEXT="Hoax">
<node COLOR="#006633" TEXT="Usually not malicious, but can cause&#xa;disruptions to technical support..." STYLE="bubble"/>
</node>
<node TEXT="Mobile Code">
<node COLOR="#006633" TEXT="e.g. Active X and Java Applets" STYLE="bubble"/>
</node>
</node>
<node TEXT="Attacker&#xa;Tools" POSITION="right">
<cloud/>
<font NAME="SansSerif" BOLD="true" SIZE="12"/>
<node TEXT="Rootkit">
<node COLOR="#006633" TEXT="Collection of files to alter standard system files&#xa;(Example in UNIX: ls, find, netsta, etc)" STYLE="bubble"/>
</node>
<node TEXT="Backdoor">
<node TEXT="Zombies">
<node COLOR="#006633" TEXT="Also called a bot. Designed to serve as attacking machine for DDoS. " STYLE="bubble"/>
</node>
<node TEXT="Remote Admin">
<node COLOR="#006633" TEXT="Grants full administrative access&#xa;to the remote attacker" STYLE="bubble"/>
</node>
</node>
<node TEXT="Clicker">
<node COLOR="#006633" TEXT="Takes control of web browser" STYLE="bubble"/>
</node>
<node TEXT="Key Logger">
<node COLOR="#006633" TEXT="Monitors and records keyboard events to capture user name&#xa;passwords, CC numbers, etc" STYLE="bubble"/>
</node>
<node TEXT="Downloader">
<node COLOR="#006633" TEXT="Downloads additional attacker tools" STYLE="bubble"/>
</node>
<node TEXT="Spammer">
<node COLOR="#006633" TEXT="e-mail generating program used to send large&#xa;quantities of spams (also for propagation of other malware)" STYLE="bubble"/>
</node>
<node TEXT="Banker">
<node COLOR="#006633" TEXT="Collects and sends bank account info" STYLE="bubble"/>
</node>
</node>
</node>
</map>
