What Are the Types of Malware? Why Is It So Important? And How to Prevent It | Free Antivirus

Malware such as ransomware is nothing new. During the past five years, the number of attacks has increased dramatically, and usually behind these attacks are criminals whose desire to collect small sums of money is driven to extort victims whose data is stolen. Criminals promise to return the stolen data once the money is paid off, but that isn't always the case.

Malicious software

This is the second major malware attack after the WannaCry attack spread in May 2017. Although the Petya attack was initially classified as very similar to the WannaCry attack, Petya is significantly different, specifically in the way it spreads and encrypts victims' data. The WannaCry attack relied on behaviors like worm actions to spread online, but the Petya attack was less harmful, using a compromised software update as the primary component of virus transmission and lacking the ability to spread across the public Internet from victim to victim.

Initial information indicated that this was another ransomware attack, but it is often reported now that the malware used was not in fact a ransomware malicious program, but it is more like malware that is more capable of scanning and encrypts all the data on the compromised systems in an image. Always. In fact, the malware appears to be intentionally designed to not have the capabilities to decrypt and recover encrypted data. This means that even if the victim paid the ransom, they might not get their data back.

This may also support the theory that this cyber attack was not motivated by making money, but was intended to severely destroy financial institutions.

Why is this attack so important?

The global reach and what appears to be random targeting of enterprises confirms the necessity for companies to pay attention to safety fundamentals as follows:

Systems are kept up-to-date using patches

Always keep backup copies of your data

Instructing users not to click on suspicious links

As with the WannaCry attack, the cost incurred in disrupting operations is substantial, but it varies by sector and by the organization. The true cost borne by the institutions is not yet known, and it will vary according to each victim.

Agitators may not get paid much in ransom payments, and currently stands at around $ 50,000. The likelihood of a true perpetrator being identified is extremely low, and procedures for bringing them to justice could be lengthy and costly.

This will likely not benefit many organizations that will struggle with the costs they will incur and the lost data resulting from this criminal activity.

Steps to be taken now

My attack and WannaCry highlighted the need for organizations to implement appropriate basic cybersecurity steps, which are as follows:

• Identifying and managing cyber risks for the enterprise, with a special focus on cyber threats and breach scenarios that may disrupt operations or have negative impacts on the organization

• Directing and training organization employees on good cybersecurity practices and using third-party programs for safety assessment and assurance.

• Continue to check the cyber threat environment. Cybercriminals and other attackers continue to develop their own techniques to devise effective means of exploiting vulnerabilities for obtaining funds or destructive purposes. Often this involves interfering with the integrity of the data rather than compromising its confidentiality.

• Maintaining and reviewing the elements of a cybersecurity program regularly will provide a solid basis for building a cyber wall in your organization: implement patches on an ongoing basis, define procedures for dealing with cyber incidents that you may experience, maintain regular backups,, and train in breach handling scenarios.

• A precautionary measure to reduce the risk of exposure to ransomware and malware

The cybersecurity services provided by EY member companies, including pre-emptive penetration testing, electronic switching,, and managed security operations centers, can be utilized to prevent the spread of a ransomware malicious program within an organization as follows:

Ensure that the vulnerability management approach and procedures and patch packages are updated and implemented with appropriate change monitoring procedures. If you are using outdated and outdated operating systems, ask suppliers for guidance on what additional steps you need to take

Designating effective procedures for dealing with incidents in companies and developing a business continuity plan after they have been tested and measured for their effectiveness in combating ransomware and other potential means of attack, as well as carrying out updates to keep pace with the current cyber threat environment

Ensure that the establishment has a security awareness training program in place and conduct proactive testing, including screenshots of what to look for. Clear guidance on direct steps should be provided as well as guidelines for reporting incidents. This must be made clear to all users and third parties connected to the enterprise network

Ensure that files are backed up and tested on an ongoing basis to reduce potential virus impacts and speed up the recovery process instead of yielding to ransom demands

Requesting guarantees from third parties that are connected to your network that they take the same measures that you do and provide them with appropriate protections

Conducting monitoring of peripheral devices, and enabling security operations teams to see suspicious behavior occurring in the environment

Identify critical systems and data and ensure their connection to the Internet only when necessary

Ensure that security software testing with serial penetration programs is conducted in all regions

An assessment of the extent to which proactive monitoring of the security of the entire environment via the Security Operations Program (SOC) can help enable rapid detection and handling of incidents

Considerations for dealing with attacks if they occur

If an organization believes that it has been compromised, or is being compromised, the following activities can help provide rapid means of dealing with the breach, damage repairs, and means of communication for end-users as follows:

First: Separating the compromised devices from the network and gathering backups without connecting to the Internet. It can also be encrypted if it's on a network

Second, EY member firms can quickly prepare to assist companies with:

Thoroughly analyze the host network and systems to uncover the initial indications of ransomware breaches to provide the means for rapid recovery and repair.

Accurate ransomware detection, identification,, and inclusion based on previous experiences in ransomware negotiations; cordon off ransomware and/or restore data from compromised systems and/or backups, and ensure that recovered data is free of ransomware.

Accurately depict and maintain highly sensitive and compromised devices to help ensure that systems and data are not compromised by a ransomware breach.

Accurately collect and maintain IT and business evidence, and then present the results of internal or external investigations to shareholders and support dispute settlement with clients, service providers, and regulatory requirements for reporting.

Third: Activate your plan to deal with incidents and do not deal with investigations as a purely technical topic; there should be a cross-functional representation in the investigation team such as the legal team, the compliance team, information security, business, public relations, human resources, etc.

Fourth: Identifying and Dealing with gaps in the work environment, increasing environmental protection to avoid exposure to hackers' attacks again, enhancing the ability to detect future attacks, and preparing for response operations.

The antivirus program installed on your device with one of the new programs designed to protect you from all types of malware and viruses at the same time and avoid installing two protection programs, which may negatively affect the speed of your device, in the event that these features are not available in The program that you want can be found on the list of the best free antivirus programs that may provide you with two aspects of protection as well.