HOW TO PROTECT YOUR NETWORK FROM TROJANS
Saturday, November 9, 2019
Edit
So how do you protect your network from Trojans?
A common
misconception is that anti-virus software offers all the protection you need.
The truth is anti-virus software offers only limited protection.
Anti-virus software recognizes only a portion of all known Trojans and does not recognize unknown Trojans.
Although most virus scanners detect a number of public/known Trojans, they are unable to scan UNKNOWN Trojans.
This is because anti-virus software relies mainly on recognizing the signatures of each Trojan.
Yet, because the source code of many Trojans is easily available, a more advanced hacker can create a new version of that Trojan, the signature of which NO anti-virus scanner will have.
If the person planning to attack you finds out what anti-virus software you use, for example through the automatic disclaimer added to outgoing emails by some anti-virus engines, he will then create a Trojan specifically to bypass your virus scanner engine.
Apart from failing to detect unknown Trojans, virus scanners do not detect all known Trojans either - most virus vendors do not actively seek new Trojans and research has shown that virus engines each detect a particular set of Trojans.
To detect a larger percentage of known Trojans, you need to deploy multiple virus scanners; this would dramatically increase the percentage of known Trojans caught.
To effectively protect your network against Trojans, you must follow a multi-level security strategy:
You need to implement gateway virus scanning and content checking at the perimeter of your network for email, HTTP and FTP - It is no good having email anti-virus protection, if a user can download a Trojan from a website and infect your network.
You need to implement multiple virus engines at the gateway - Although a good virus engine usually detects all known viruses, it is a fact that multiple virus engines jointly recognize many more known Trojans than a single engine.
You need to quarantine/check executables entering your network via email and web/FTP at the gateway.
You have to analyze what the executable might do
DON'T COPY AND PASTE BEFORE GIVING ME CREDITS
-Mr.X-
Regards -UPnextskills