Skip to main content

How to protect your network from Trojans?

So how do you protect your network from Trojans?

A common misconception is that anti-virus software offers all the protection you need.

The truth is anti-virus software offers only limited protection.

Anti-virus software recognizes only a portion of all known Trojans and does not recognize unknown Trojans.

Although most virus scanners detect a number of public/known Trojans, they are unable to scan UNKNOWN Trojans.

This is because anti-virus software relies mainly on recognizing the signatures of each Trojan.

Yet, because the source code of many Trojans is easily available, a more advanced hacker can create a new version of that Trojan, the signature of which NO anti-virus scanner will have.

If the person planning to attack you finds out what anti-virus software you use, for example through the automatic disclaimer added to outgoing emails by some anti-virus engines, he will then create a Trojan specifically to bypass your virus scanner engine.

Apart from failing to detect unknown Trojans, virus scanners do not detect all known Trojans either - most virus vendors do not actively seek new Trojans and research has shown that virus engines each detect a particular set of Trojans.

To detect a larger percentage of known Trojans, you need to deploy multiple virus scanners; this would dramatically increase the percentage of known Trojans caught.

  >> To effectively protect your network against Trojans, you must follow a multi-level security strategy:

  You need to implement gateway virus scanning and content checking at the perimeter of your network for email, HTTP and FTP - It is no good having email anti-virus protection, if a user can download a Trojan from a website and infect your network.

You need to implement multiple virus engines at the gateway - Although a good virus engine usually detects all known viruses, it is a fact that multiple virus engines jointly recognize many more known Trojans than a single engine.

You need to quarantine/check executables entering your network via email and web/FTP at the gateway.

You have to analyze what the executable might do.
  _________________________

Labels:

Comments

Post a Comment

Popular posts from this blog

How to Connect Two Computers Via Crossover Ethernet Cable?

In this tutorial we are going to show you how to transfer data from one computer to another. We need to PC/Laptop and a crossover cable to transfer data. PC 1 Step1: Go to “Open Networking and Sharing Center“. Step2: Click on “Local Area Connection“. Step3: Now click on “Properties“. Step4: Double click on “Internet Protocol Version 4(TCP/IPv6)“. Step5: Click on “Use the following IP address:” and enter the IP address: as 192.168.1.1 and just give a click onSubnet mask. Once done click “Ok” and close it.   PC 2 Step1: Go to “Open Networking and Sharing Center“. Step2: Click on “Local Area Connection“. Step3: Now click on “Properties“. Step4: Double click on “Internet Protocol Version 4(TCP/IPv6)“. Step5: Click on “Use the following IP address:” and enter the IP address: as 192.168.1.2 and just give a click onSubnet mask. Once done click “Ok” and close it. Now  two computers are connected. To share files we need to give access to our drives, so fol...
Post a Comment
Read more

What is a Phreaking ?

A phreak is someone who breaks into the telephone network illegally, typically to make free long-distance phone calls or to tap phone lines. The term is now sometimes used to include anyone who breaks or tries to break the security of any network. Recently, the phone companies have introduced new security safeguards, making phreaking more difficult. Phreaking is a slang term coined to describe the activity of a culture of people who study, experiment with, or explore telecommunication systems, such as equipment and systems connected to public telephone networks. The term phreak is a sensational spelling of the word freak with the ph- from phone, and may also refer to the use of various audio frequencies to manipulate a phone system. Phreak, phreaker, or phone phreak are names used for and by individuals who participate in phreaking. The term first referred to groups who had reverse engineered the system of tones used to route long-distance calls. By re-creating thes...
Post a Comment
Read more

Denial of service (DoS) attack Trojans

These Trojans give the attacker the power to start a distributed denial of service (DDoS) attack if there are enough victims. The main idea is that if you have 200 infected ADSL users and you attack the victim simultaneously from each, this will generate HEAVY traffic (more than the victim's bandwidth can carry, in most cases), causing its access to the Internet to shut down. WinTrinoo is a DDoS tool that has recently become very popular; through it, An attacker who has infected many ADSL users can cause major Internet sites to shut down; Early examples of this date back to February 2000, when a number of prominent e-commerce sites such as Amazon, CNN, E*Trade, Yahoo and eBay were attacked. Another variation of a DoS Trojan is the mail-bomb Trojan, where the main aim is to infect as many machines as possible and simultaneously attack specific email address/addresses with random subjects and contents that cannot be filtered. Again, a DoS Trojan is similar to a virus,...
Post a Comment
Read more