Build Your Own Security Lab: A Field Guide for Network Testing

Chapter 8. Defeating Malware

This chapter takes an in-depth look at malware. Malware is something that really didn't exist until 1984, when Fred Cohen coined the term computer virus. He was working on his doctoral thesis and needed a term to describe self-replicating programs. An advisor suggested he call such code computer viruses. The first known computer worm was not released until 1988. Malware has grown, changed, and become a much bigger threat since these early days of computing. These events deserve discussion, as by studying the origins of malware we can better understand it. This chapter not only looks at malware from a historical perspective but also includes a more up-to-date review. One thing about malware that will become clear is that it is a threat that is constantly changing. That's why other malicious code such as rootkits, spyware, and phishing will also be examined. Each of these has the potential to cause damage to a company's network or your home computers. Therefore, we look at the methods used to detect, eradicate, and prevent such threats. Many of these defenses can be tested in your network security lab.

The Evolving Threat

Things have certainly changed since the term computer virus was created back in 1984. Back then, most computer viruses and other forms of malware (worms, etc.) were written for fame. For many years, this was the motivating factor behind the development of such code. Consider the 1986 Brain virus. This piece of malware was developed by two ...