Malware Counter Measure Standard Operation Procedure in Old Corporations

I have a few experience in playing around with cyber attacks, but it was merely a curiosity and I did this on my own PCs and virtual machines. Back then I tried exploiting the vulnerability on port 445 SMB using an exploit prepared by Metasploit. Metasploit also provided a tool to make backdoors (Trojan) which I practice after hijacking. The result was I can remotely control the victim's PC and after I activate the backdoor, I can connect whenever I want. Then after the vulnerability is patched (system updated) exploiting port 445 no longer works as explained on this lecture but for as long the backdoor is still implanted I can still remotely connect through there. If the vulnerability is exploited once and the system got infected by a virus, just patching it will not be enough. The infection must be healed. This is the fourth assignment from my Masters Advanced Network Security Course which has never been published anywhere and I, as the author and copyright holder, license this assignment customized CC-BY-SA where anyone can share, copy, republish, and sell on condition to state my name as the author and notify that the original and open version available here.

1. Cyber Attacks Can Come From Based on This Lecture

1. Kernel and server side of OS.
2. Application vulnerabilities.
3. Before and after infection of worm or virus.

Most famous attack is buffer overflow. PCs for file sharing are susceptible to remote buffer overflow. What happens if vulnerability is announced

1. With patch or update available.
2. No patch or update available.

The first case automatically or manually apply the patch. The second case disable the application or port that is vulnerable. Vulnerability can be:

1. Vulnerability due to design and programming error.
2. Vulnerability due to misconfiguration.
3. Vulnerability due to modules.

In case of design, the service must be disabled and reprogram. Case of misconfiguration, edit the configuration file, and as for modules disable and edit the module. To handle the vulnerabilities above the following common steps are taking.

1. Identify the vulnerability and plan the modification beforehand.
2. Isolate the system from the network.
3. Backup the system and make sure it can be restored.
4. It's suggested to perform simulation beforehand on similar environment, using virtual machine for example.
5. Finally perform modification. For beginners the step usually taken is update the system to the latest, after this process experts tends to manually modify. It's suggested to leave explanations on modified parts, for example leaving a comment on a configuration script that contain informations of what the modification is and when it was modified.

If not taking the steps above then there's a risked in rebuilding the system from the scratch since there's a chance in breaking the system when performing modification.

2. International Standard Organization Information Security Management

As written on the first part if it is already infected by a virus or worm then the infection must be cleaned. A software called antivirus had been developed which detects the infection based on patterns of the virus. By installing this software it can prevent and also clean the infections, but even this software is not perfect. If the antivirus cannot detect the infection then it's suggested to take the 5 steps above in dealing with the vulnerability. Worst case we must backup the data, destroy and rebuild the system.

The term “policy” is a set of rules and procedures that is agreed by involving parties, and then carried out. In my opinion the strategy build this information security policy must be carried out not in a hasty pace, because it includes parties that is not professional in IT and some are less aware of the cyber attacks that occurs. Even as a information security professional, if given a large book of the information security policy will respond as “this will take time to review”. So it is recommend to take it step by step as in some standards from International Standard Organization (ISO).

1. The first thing is to explain the current situation that many personal information is leaked, the network is swarming with worms and virus, and ultimately the damages cause a lost in profit of over millions of Yens. We should state as a national, if possible global crisis, or any other to convince that this is important.
2. Then create an overview of the important part of the security policy which includes the counter measures of the cyber attacks, for example what the system should be equipped with (antivirus, firewall, IDS, vulnerabilities patch, etc), and clearly separate private data and public data. Private data should not go into public data which we decided to be completely open, also measures to protect the private data should be stated for example the use of authorization and backup. Another important point that should be added is the procedure that should be taken if a threat is detected which in general it is isolating the PC from the network, reporting, then take action to fix the issue.
3. The first draft should only be the overview and contains only most important points, because this determines whether the policy be implemented or not. It's an important turning point and the strategy above is one of the best ways to open the door. When it's established then we can submit even more details of the security policy. For example security policy 2nd chapter should state about private informations, what data are important information, why is it important, and how's the impact if it's leaked, altered, or destroyed. 3nd chapter is about the system's equipment (what softwares should be installed, how the configuration should be, not to forget the physical secuirty as well, etc). 4Rd chapter of how to confront the network when holding private data, in other words our behavior that we should be careful when receiving attachments, suspicious files, dangerous site, and what we should do if we're attacked.