- Because a client computer is connected to an organization’s network, which may have direct and indirect access to servers and network resources, it is important to protect the client computer.
- A computer virus is a program that can copy itself and infect a computer without the user’s consent or knowledge.
- A backdoor is a program that gives some remote, unauthorized control of a system or initiates an unauthorized task.
- Some viruses, worms, rootkits, spyware, and adware are made possible because they exploit some security holes within Windows, Internet Explorer, or Microsoft Office.
- The first step that should be taken to protect yourself against malware is to keep your system up-to-date with the latest service packs, security patches, and other critical fixes for Windows (as well as other Microsoft products, such as Internet Explorer and Microsoft Office).
- A virus hoax is a message warning the recipient of a non-existent computer virus threat, usually sent as a chain email that tells the recipient to forward it to everyone they know. It is a form of social engineering that plays on people’s ignorance and fear and may include emotive language and encouragement to forward the message to other people.
- User Account Control (UAC) is a feature that was introduced in Windows Vista and is included with Windows 10 that helps guard against malware.
- Microsoft recommends always using the Windows Firewall.
- Offline files are copies of network files that are stored on your computer so that they can be accessed when not connected to the network or when the network folder with the files is not connected.
- Offline files are not encrypted unless you choose to encrypt them. Consider encrypting your offline files if they contain sensitive or confidential information, and you want to make them more secure by restricting access to them.
- By restricting users to standard user accounts, you can limit what software those users can install.
- Use group policies to restrict what software can be executed on a client's computer.
- Most of the emails will be unsolicited emails called spam or junk email.
- The best place to establish an anti-spam filtering system is on your email relay, on a dedicated server or appliance, or as part of a firewall device or service.
- Many anti-spam solutions will also use Real-time Blackhole Lists (RBLs) or a DNS-based Blackhole List (DNSBL), which can be accessed freely. RBLs and DNSBL are lists of known spammers that are updated frequently.
- Sometimes, spammers will try to spoof a legitimate email address or IP address when the message actually comes from one with an email address or IP address that would likely be identified as spam.
- Simple Mail Transfer Protocol (SMTP) is used to transfer email from one server to another and it is also responsible for outgoing mail transport.
- Spammers look for unprotected SMTP servers through which they can relay their email.
- A cookie is a piece of text stored by a user’s web browser. It can be used for a wide range of items, including user identification, authentication, storing site preferences, and shopping cart contents.
- While some pop-up windows are useful website controls, most are simply annoying advertisements, with some attempting to load spyware or other malicious programs.
- To help manage Internet Explorer security when visiting sites, Internet Explorer divides a network connection into four content zones or types. For each of these zones, a security level is assigned.
- Phishing and pharming are forms of attacks to get users to a bogus website in an attempt to spread malware or collect personal information.
- When surfing the internet, there are times when it is necessary to transmit private data such as credit card numbers, Social Security numbers, and so on. During these times, it is important to use http over SSL (https) to encrypt the data sent over the internet.
- The server should be kept in a secure location. In addition, the servers should be in their own subnet to reduce the amount of traffic to the servers, especially broadcasts.
- To secure a server is to harden the server by reducing its surface of attack and thereby reducing the server’s vulnerabilities. To harden a server, look for security guides and best practices for Windows servers and for the specific network services that you are installing.
- Windows servers provide support for the dynamic update functionality. Dynamic DNS lets client computers dynamically update their resource records in DNS.
- To keep your DNS server secure, secure DNS makes it so that only members of an Active Directory domain can create records on the DNS server.
Multiple Choice
- Virus
- Worm
- Trojan horse
- Spyware
(a)
A computer virus is a program that can copy itself and infect a computer without the user’s consent or knowledge. Early viruses were usually some form of executable code that was hidden in the boot sector of a disk or as an executable file (a file name with an .exe or .com extension).
- Virus
- Worm
- Trojan horse
- Spyware
(d)
Spyware is a type of malware that is installed on computers and collects personal information and browsing habits, often without the user’s knowledge. Spyware can also install additional software, which can redirect your web browser to other sites or change your home page.
One type of spyware is the keylogger, which records every key a user presses. Therefore, when typing credit card numbers, Social Security numbers, and passwords, that information gets recorded and is eventually sent to and read by someone without the user’s knowledge. It should be noted that not all keyloggers are bad, because some corporations use them to monitor their corporate users.
Adware is any software package that automatically plays, displays, or downloads advertisements to a computer after the software is installed on it or while the application is being used. While adware may not necessarily be bad, it is often used with ill intent.
- The ISP has slowed the network connection.
- The computer has been infected with malware.
- The computer has not been updated.
- The user accidentally clicked the turbo button.
(b)
Malicious software, sometimes called malware, is software designed to infiltrate and adversely affect a computer system without the owner’s informed consent. It is usually associated with viruses, worms, Trojan horses, spyware, rootkits, and dishonest adware. As a network administrator or computer technician, it is important to know how to identify malware, how to remove malware, and how to protect a computer from malware
- Keep the computer up-to-date with the latest security patches.
- Reboot the computer on a regular basis.
- Change the password on a regular basis.
- Spoof the IP address.
(a)
- Don’t install unknown software or software from an unknown source.
- Don’t open strange email attachments.
- Don’t click hyperlinks from strangers or if it’s unclear what the link is supposed to do. This also applies to sources like Yahoo!, AOL, and MSN.
- If your email client supports auto launch, turn it off. Otherwise, you might automatically activate a computer virus just by opening the email.
- Don’t visit questionable websites, especially sites that allow downloading software from music and video piracy sites and pornography sites.
- If your web browser alerts you that a site is known for hosting malware, pay attention to these warnings.
- If you surf the internet and browser pop-ups indicate that you need to download the newest driver or check your system for viruses, use caution.
- Don’t forget to perform regular backups. So, if a computer does get a virus and data is lost, you can restore from a backup.
- Recommended update
- Hotfix pack
- Service pack
- Critical update
(c)
The first step that should be taken to protect yourself against malware is to keep your system up-to-date with the latest service packs, security patches, and other critical fixes for Windows (as well as other Microsoft products, such as Internet Explorer and Microsoft Office).
- UAC
- Protected mode
- Windows Defender
- ProtectGuard
(a)
User Account Control (UAC) is a feature that was introduced in Windows Vista and is included with Windows 10 that helps guard against malware.
- Install updates from Windows Update.
- Change the date and time.
- Reset the network adapter.
- Install drivers from Windows Update.
(b)
UAC can be enabled or disabled for any individual user account. Of course, if UAC is disabled for a user account, the computer will be at higher risk. However, if you perform a lot of administrative tasks on a computer, the UAC prompts can be annoying and can stop you from doing certain activities, including saving to the root directory of a drive, or using an application that is not compatible with UAC.
- Windows Firewall
- Protected Mode
- Windows Update
- UAC
(d)
UAC can be enabled or disabled for any individual user account. Of course, if UAC is disabled for a user account, the computer will be at higher risk. However, if you perform a lot of administrative tasks on a computer, the UAC prompts can be annoying and can stop you from doing certain activities, including saving to the root directory of a drive, or using an application that is not compatible with UAC.
- Windows Firewall
- Windows Protected Mode
- UAC
- Windows GuardIt
(a)
Microsoft recommends always using the Windows Firewall.
- Windows Firewall with IPsec Plugin
- IPsec Monitor
- Windows Firewall with Advanced Security
- IPsec Configuration console
(c)
In addition to the Windows Firewall found in Control Panel, newer versions of Windows include Windows Firewall with Advanced Security. Windows Firewall with Advanced Security combines a host firewall and Internet Protocol security (IPsec). Windows Firewall and Windows Firewall with Advanced Security are tightly coupled together, allowing better control of a firewall. In addition, Windows Firewall with Advanced Security provides computer-to-computer connection security, because it can be used to require authentication and data protection for communications via IPsec.
- Clear the cache.
- Encrypt the offline files.
- Clear the cookies.
- Execute ipconfig /renewip.
(b)
Offline files are not encrypted unless you choose to encrypt them. Consider encrypting your offline files if they contain sensitive or confidential information, and you want to make them more secure by restricting access to them.
- Flush out the quarantined items.
- Reboot the spam-blocking device.
- Add the email address or domain to the allow list.
- Add the email address or domain to the block list.
(c)
- 43
- 25
- 80
- 443
(b)
- 1
- 2
- 4
- 8
(c)
- Phishing
- Pharming
- Phaking
- Spoofing the IP address
(a)
Phishing and pharming are forms of attacks to get users to access a bogus website so the phisher or pharmer can spread malware and/or collect personal information.
- AppLocker
- Windows Defender
- Microsoft Passport
- Smart card
(a)
Use AppLocker to control how users access and use programs and files, and extend the functionality originally provided by the Software Restriction policy found in earlier versions of Windows operating systems. In Windows 10, AppLocker is located in the Local Group Policy Editor.
- Domain account
- Microsoft account
- Local account
- Virtual account
(b)
- Biometrics
- Windows Defender
- Security baseline
- Windows Store
(c)
A security baseline is a collection of security settings. Security baselines should include Microsoft’s recommendations for configuring those settings. To help with faster deployments, and to ease the managing of Windows, Microsoft provides customers with security baselines that can be used with Group Policy Objects (GPOs).
- STRIDE
- DREAD
- Trusted Platform Module
- Security Compliance Manager
(c)
