How to protect your network from Trojans?

So how do you protect your network from Trojans?

A common misconception is that anti-virus software offers all the protection you need.

The truth is anti-virus software offers only limited protection.

Anti-virus software recognizes only a portion of all known Trojans and does not recognize unknown Trojans.

Although most virus scanners detect a number of public/known Trojans, they are unable to scan UNKNOWN Trojans.

This is because anti-virus software relies mainly on recognizing the signatures of each Trojan.

Yet, because the source code of many Trojans is easily available, a more advanced hacker can create a new version of that Trojan, the signature of which NO anti-virus scanner will have.

If the person planning to attack you finds out what anti-virus software you use, for example through the automatic disclaimer added to outgoing emails by some anti-virus engines, he will then create a Trojan specifically to bypass your virus scanner engine.

Apart from failing to detect unknown Trojans, virus scanners do not detect all known Trojans either - most virus vendors do not actively seek new Trojans and research has shown that virus engines each detect a particular set of Trojans.

To detect a larger percentage of known Trojans, you need to deploy multiple virus scanners; this would dramatically increase the percentage of known Trojans caught.

  >> To effectively protect your network against Trojans, you must follow a multi-level security strategy:

  You need to implement gateway virus scanning and content checking at the perimeter of your network for email, HTTP and FTP - It is no good having email anti-virus protection, if a user can download a Trojan from a website and infect your network.

You need to implement multiple virus engines at the gateway - Although a good virus engine usually detects all known viruses, it is a fact that multiple virus engines jointly recognize many more known Trojans than a single engine.

You need to quarantine/check executables entering your network via email and web/FTP at the gateway.

You have to analyze what the executable might do.
  _________________________