Teema 14 - Andmeturveː tehnoloogia, koolitus ja reeglid

 Mitigations against Trojan horses using the “Mitnick formula”.

Within the world of IT, security is a very important aspect. There are several types of threats that compromise your security and cause damage to your company. Within this article, Trojan horses will be analyzed and will be described how to mitigate the three components of the “Mitnick formula” to minimize risk of infection.

A Trojan horse is a type of malware. It is hidden in a computer program, and after installation a Trojan horse gives criminals access to your computer unnoticed. It is a kind of backdoor that can be used by malicious people to secretly gain control over your computer and files. This is also where the name Trojan Horse comes from; it is a reference to the Trojan Horse, which was used by the Greeks to open the gates of Troy from the inside for a large-scale invasion.

There are several ways in which your computer can become infected with a Trojan horse. For example, this can happen via an attachment to an e-mail. Trojans are also often hidden in pornographic material, distributed via chat programmes and dormant in files on torrent networks. As a user, you will often not immediately notice that your computer has been infected by a Trojan horse. In all discretion, malicious parties can access your files while you don't notice anything.

If your computer is infected with a Trojan horse, your computer can be taken over by hackers/criminals. These criminals can, for example:

·           - Steal, modify or destroy files.

·          - Retrieve passwords and login details.

·          - Use your PC to attack other networks or servers within a botnet (by means of a DDos attack, for example).

·          - Systematically crash your computer.

·          - Take over the operating system.

·          - Record keystrokes.

·         - Visit websites with your PC.

These are just a small portion of all possibilities, and it is mandatory to try to prevent this from happening, especially for companies. Several mitigations can be applied to minimize your device becoming infected by a Trojan, this is where the “Mitnick formula” comes into play. People can use technology to minimize infection rate and can be trained not to blindly click any file they receive via e-mail. Additionally rules can be made about which person has administrative access to devices and how they are monitored.

Firewalls and anti-malware/anti-virus software can be used to identify security threats and patch holes in your security. The firewall will prevent incoming connections from outside of your network and the software will prevent malicious programs from running on your device and causing damage. With the use of anti-malware and anti-virus software, hackers will less likely be able to record your keystrokes and modify your filesystem.

Employees can be trained to further minimize the risk to your company. They can be taught not to blindly run executable files (.exe) or scripts (.vbs) received as e-mail attachments (with administrative privileges), not to download and install (suspicious) applications from the internet and to scan all incoming mail and downloaded documents with a recent version of installed antimalware software.

 

Even if all these precautions are taken, it is not excluded that the system can be hacked. Any barrier erected reduces the risk of intrusion. Therefore, rules come into play. These rules can guide employees how to behave and act in certain situations. To further address this, administrative templates can be created, only administrators will have all rights to certain components, whilst regular users will not, or they can only read the files instead of modify them. They can be required to enter a password to access files as well, preferably changed at least once a month. Visitors must only get limited access to the network, and should not be able to run malicious software on their devices whilst being connected. It should be clear who is responsible for incidents and how to deal with them.

In short, a sufficient level of awareness must be created and employees must be trained infection preventive measures, combined with monitoring software and a firewall to protect the network from malicious incoming connections. Rules can be a welcome addition to achieving the required level of awareness regarding security, administrative templates must be used to minimize the risk of unauthorized users accessing sensitive files and potentially modifying them.