Symmetric vs. Asymmetric

There are three broad types of encryption that are important in computer security: symmetric, asymmetric, and hashes. Hashes are closely related to encryption, but they have somewhat different purposes.

Most people are familiar with the first: symmetric encryption . A single key is used for both encryption and decryption. This is what we ordinarily expect from encryption. See Figure 3-1.

Figure 3-1. Symmetric encryption uses the same key for encrypting and decrypting

For example, naval headquarters and a ship at sea share the secret key. Headquarters encrypts a message with the secret key. The ship receives the message, decodes it with the key, and responds with a message encoded with the same secret key. This system works well when there is a clear sender and receiver who can safely share a secret key. Symmetric encryption /decryption is generally faster than the alternative, asymmetric encryption , so it often used safe transmission and storage of data where speed is important. But other purposes for encryption have other requirements.

Asymmetric encryption uses different keys for encryption and decryption. Asymmetric keys are generated in pairs using special algorithms. These paired keys have the property that a message encrypted using one of the keys can only be decrypted using the other key in the pair. The encrypting key will not decrypt the message it encrypted. Only the other key in the pair will decrypt the message. See Figure 3-2.

Figure 3-2. Asymmetric encryption uses different keys for encryption and decryption

Requiring separate keys means that sender and receiver do not share a secret key that they both know. Under some circumstances, this is a big advantage.

11 * 67 / 4757 = 0.1549295774647887323943661971831

0.1549295774647887323943661971831 * 71 = 11

0.1549295774647887323943661971831 * 67 =
                 10.380281690140845070422535211268

HTTP and HTTPS

Hypertext Transmission Protocol (HTTP) is the protocol that controls messages traveling in the World Wide Web . HTTP is not a secure protocol. A network snooper can easily intercept and read the information in any message. This is a gaping security hole for critical information. The hole was closed by an addition to the HTTP standard, which is called Secure HTTP or HTTPS .

HTTPS encrypts the message and verifies that the receiver of a message is who it appears to be using electronic signatures . The protocol is rather complex. The sender and receiver negotiate the encryption algorithm to be used and exchange encryption keys securely. See Figure 3-3.

Figure 3-3. HTTPS protects messages with encryption

Hashes and Digests

Hashes are related to encryption, but hashed messages are not intended to be decrypted. In fact, a hash is one-way encryption; a hash that can be decrypted is not useful. A more precise name for the hashes that are used in security are one-way hashes. They are also called digests or message digests.

In general computer programming, a hash is a way of assigning a simple tag for each item in a list. You can hash a list of words by using the first letter of each word as its tag, which is called the hash. The hash of “Lupaster” is “L,” the hash of “Reggie” is “R,” and so on. This is not a very useful hash because it has many collisions . A collision is when two or more values hash to the same thing. For instance, “Apple,” “Antique,” and “Atom” all hash to “A.” Second, it’s too easy to reverse this hash because a computer can easily list all the values that hash to “A.”

A good cryptographic hash function does the following:

• It is infeasible to reverse.

• It has no collisions .

• Its output values are all the same length.

• The hashed output from two input values that differ only slightly will be drastically different.

Hashes are called digests because a hash function can condense a document, even a large document, into a short digest of the original document. Since even a slight change in the original will produce a big change in a good digest, digests can be used to prove that a document has not changed when downloaded or in transmission. The source sends a digest along with the message . The receiver calculates the digest of the document and compares it to the digest sent by the source. If the two match, the receiver knows the document has not been tampered with or corrupted. When digests and electronic signatures are combined, downloaded software is much safer because the receiver is certain that the software received is an exact match to the software sent by the sender who is verified with an electronic signature.

Hashes are also important in verifying passwords , which will be covered in the “Authentication” section.

Passwords

Everyone knows about passwords, but some implementations of passwords are better than others. In current security practices , most passwords are a pair: a user id and a secret password. If the password goes with the id, the claimant gets into the system. That's simple.

What happens in between gets complicated. For a simple implementation, all that is necessary is a table stored in a file. Each row in the table has a user id and corresponding password, both in clear text . When a user attempts to authenticate , the system scans the table for the user id that the supplicant entered. If there is no matching user id in the table, the supplicant has no account. If the user id is in the table, the system compares the password presented by the supplicant with the password corresponding to the supplicant's user id in the table. If the two passwords match, the supplicant is allowed in. If the user id isn't present, or the password does not match, the supplicant is not authenticated. There are problems with this simple implementation, although it was used when innocence still prevailed. Later, the password file was encrypted to prevent snooping on passwords.

Securing Passwords

Most password schemes now use one-way cryptographic hashes rather than encryption. If a password is encrypted rather than hashed, it can be decrypted with the key. If a hacker obtains the key, they can quickly decrypt all the passwords in the password database. A cryptographic hash has no key and cannot be reversed. Encoded passwords never need to be decoded. The system performs a hash when the supplicant offers the password and compares it to the stored hash. Since encoded passwords never need to be decoded, using an encryption with a key is an unnecessary risk. See Figure 3-5 for the entire process. Note that there is a large vulnerability: hashing the password before it is sent to the authenticator may not be practical. More typically, the clear password is sent. You will see in a moment how that gap can be closed.

Figure 3-5. Unencoded passwords are never stored in current password practice

How Passwords Are Cracked

Passwords are not invulnerable. They can be compromised in several different ways. Computer users can reduce the chances of password compromise by following good password management practices and being aware of the threats .

Password Theft

Reliable authentication relies on passwords that are kept secret. The system must be hardened against hacker's attacks. The most vulnerable point of attack is the supplicant's practices for keeping passwords secret. If the supplicant can be forced or tricked into revealing a password, authentication is compromised. As usual, breaching a system with social engineering is easy and quick compared to more technical methods, and very little can be done technically to harden human nature against gullibility and deceit.

Social engineering is not the only way passwords are stolen. Whenever a clear password is placed in an unsecured file, into email or some other insecure messaging system, the password can be stolen by an industrious hacker.

Snooping

Social engineering is not the only way to break a password system. Another point of vulnerability is the connection between the supplicant and the system. If the supplicant is on the same computer as the system, the connection is most likely all in memory and difficult to break into, but a remote login is subject to network snooping. Encrypting the messages interchanged in password validation and creation will prevent network snooping.⁵ Secure sockets and secure HTTP are common methods, although some older applications developed their own methods of secure transmission.

Reading unencrypted network traffic is trivial for hackers. Entering a password into a website that does not use encryption is an open invitation for password snoopers. The first version of the HTTP standard documented basic authentication . The method is easy to implement but insecure because it does not protect user id and passwords from snooping in transit. A newer method, digest authentication , uses a cryptographic hash . Since digest authentication is somewhat more difficult to implement, some websites still use basic authentication . Digest authentication is not as secure as using another web security alternative, Secure HTTP (HTTPS) . HTTPS encrypts the entire message as well as the password and user id and it also verifies that the message is sent to the intended server. When computers and networks were slower, HTTPS was noticeably slower than HTTP . Websites tended to use HTTPS only when exchanging credentials. This practice has declined as the HTTPS overhead has become less noticeable. Sites like Google and Facebook use HTTPS for all communication on the Web; in fact, HTTPS has become the most common way of hiding passwords from hacker and securing communications on the Web.

Cryptographic Attacks

Cryptographic attacks assault the encryption or hash algorithm . They come in several forms, but they all require mathematical sophistication. One such attack is called a collisionattack. Some hash algorithms, which were previously thought to be secure, have proven capable of producing the same hash for two passwords . If a hacker could take advantage of this, they might generate an alternate password for a user id without knowing the real password.

Cryptographic attacks can be more theoretical than real for sites following best practices because they are certainly more difficult than stealing or snooping and could, depending on the circumstances, be slower than brute force cracking . However, there have been sites that continue to use deprecated cryptographic hashes that have been shown to be insecure.

Brute Force

Brute force attacks are more common. A brute force attacker tries different passwords until they find one that works. Some finesse makes the task quicker, but brute force is not subtle. The method assumes that the hash algorithm , user id, and hashed password value are known. Usually the hacker will break into the system by some means and steal the password file or database. Personal computers usually have only a few user id/password pairs to crack and are therefore not as desirable as a corporate server with thousands of ids.

The hacker could simply begin by hashing sequential possibilities like “a”, “A”, “ab”, “Ab”, “aB”, “AB”, “AZ” and so on until a hash pops out that matches the user's hashed password . The method is systematic and brute force in the extreme.

Guessing

Hackers know that users have favorite passwords . For instance, “password” is said to be the most used password. “1234” is another chestnut. Hackers, and security researchers, compile lists of these. You can get a list of the 10,000 most common passwords hashed with a popular algorithm from the Internet .⁶ Hackers use lists like this to skim off the easy candidates. The time for scanning a list like this is trivial (seconds for a smartphone) and hackers tend to favor fast, high-performance servers. Some experts estimate that 60% of passwords at most sites will appear on these lists.

Dictionary

The next level of attack is a dictionary attack. A dictionary attack tries every word in a dictionary, and perhaps some common combinations of words. With faster processors , they will probably throw in a few substitutions: “kat” for “cat”, random capital letters, anything obvious. For example, “E1eph@nT” might fall to a dictionary attack. For a dictionary attack, the hacker will probably use sophisticated in-memory storage techniques called rainbow tables to reduce the memory required and speed processing. Note that mixing uppercase and lowercase letters, numerals, and symbols is not as good a suggestion as it was when cracking machines were less powerful. The number of possibilities to try in a dictionary attack gets large, but it is nothing compared to the huge number of random choices.

Ultimate Force

If a dictionary attack fails, the next stage is true brute force, which is required to crack passwords that are neither common nor in the hacker's dictionary.

At this point, the hacker needs heavy duty resources. A hacker will probably not make this effort without strong motivation because the time and computing resources are expensive. Nevertheless, such an effort is possible.

An ordinary computer is not adequate at this stage. Hackers build special computers that can execute hash algorithms at very high speeds. Graphics processors happen to be well-suited to this. Calculating the next set of pixels to display for a high-resolution, fast-moving subject requires similar capacities to hashing an arbitrary string of characters. Password cracking computers use many graphics processors to process candidate passwords very rapidly. One example, reported on in 2012, uses 25 graphics processors to execute 63 billion guesses per second. If this specialized computer were to test the 10,000 popular passwords referred to above, it would finish in two millionths of a second. An ordinary dictionary attack would still take less than a second.⁷

Figure 3-6 shows an important characteristic of brute force attacks. Brute force cracking of a random password that is not in a popular choice table or subject to a dictionary attack is subject to simple mathematical rules. The table below crunches the numbers for a simple example. The password character set is a common one: digits, lowercase and uppercase letters, and a few special symbols. Altogether, there are 64 possible characters. For a password of a single character, there are 64 possibilities. For two character passwords, for each possible first character, there are 64 possible second characters. With each added character, the number of possibilities is multiplied by 64. The number of possibilities rises rapidly. The table shows that a 5-character password has over a trillion possibilities. The number may seem formidable, but a 63 billion guess per second cracking machine can try them all in less than a second.

Figure 3-6. Password length determines the difficulty of brute force cracking

How to Build a Cracking Machine

Today, building a high-speed brute-force cracking machine is not extremely hard. It relies on two technologies. First, big data analysis has developed very effective algorithms for combining the efforts of large numbers of relatively small computers to perform gigantic tasks. The second is the availability of relatively low-cost, high-speed processors that are specifically designed to efficiently perform the mathematical manipulations involved in encryption. These processors are readily available because both encryption and high resolution moving computer graphic images require high-speed, high-throughput numeric processing. In other words, a high-end graphics processor (GPU) is just the thing for cracking passwords . Combining a large number of GPUs into a big data-style parallel processing array for cracking processing is not a job for a first-year computer science student, but by their second or third year, some could handle it. The cost would be in five figures perhaps—but well under the "governments only" price range. It’s certainly possible with some help from the "dark side."

Looking down the table, a 7-character password will take a little over a minute, but a 14-character password will take close to ten million years. In short, longer is better. The exceptions are choices from the table of popular choices or the dictionary table. From the table, a 10-character password is quite safe. No hacker would be likely to be willing to wait for 200 days to crack a password. Since cracking machines are bound to get faster, a 12-character password would be a safer choice.⁸

This table brings out an important aspect of password strength. The strength of a password depends on the character set the hacker thinks you are using, not the character set in the password. In Figure 3-6, the length of the password determines the probability that the password will be cracked, not the mixture of characters in the password. If the password does not fall under guessing and dictionary attacks , an all-lowercase 12-character password would still be very time consuming to crack. Stringing together random word combinations into long passwords can be easy-to-remember and strong.

Death of Passwords

The death of passwords seems to be announced by some important person in the computing industry every few months. For good reason. Strong passwords are a human-computer interaction catastrophe.

Memorizing a 12-character random password , say 2kLc%Arr3$7#, is not easy for most people and accurately typing a random sequence can be frustrating. Not only that, but passwords should be changed frequently in case the password has been stolen through social engineering or snooping .

The result is that most people ignore safer practices. Most passwords in use are on the popular passwords list or subject to dictionary attack , are seldom changed, and are often used for several accounts.

There are alternatives to passwords, but they have their own drawbacks. Possessions, like cellphones, can be lost or stolen. Personal physical artifacts, like fingerprints or face scans, cannot be changed if they are compromised. Fingerprints, for example, have been compromised with casts taken from ­fingers. One can easily imagine a method that uses a 3-D printer to convert a photograph of a fingerprint to create an ersatz finger to fool a fingerprint reader. If one print is compromised, the user can substitute a different finger, but there is a limit. Secret questions have been proven to be easily guessed by hackers who do a bit of prying into social media and other public records.

Passwords are a problem but they are also familiar, and techniques for programming password systems are well known. There are also methods built around the password system for sharing authentication . A site does not need to have its own authentication. Instead, it can use authentication provided by another site. Facebook , Google, and other sites provide authentication services. This reduces the number of passwords that a user must manage.

The best alternative to passwords on the horizon now is multi-factor authentication , which continues to use passwords but includes other factors such as a message to your phone containing a PIN you must enter to complete the authentication . Combining passwords with physical artifacts like fingerprints is also more secure. A weaker password combined with other factors can be more secure than a strong password alone.

Firewalls

The fundamental purpose of a firewall is to create a perimeter that isolates the interior from attacks from the outside of the firewall.

Perimeters are a fundamental form of isolation and firewalls help enforce perimeters. Think about what a system without a perimeter is like. It would be as if the entire system were built in an open field without a fence or other border around it. Anyone could walk in and look at the system machinery and pull a lever here, turn a valve there, and bring the system to a halt. After a few nasty episodes, the management would probably put a perimeter wall around the system and allow no one in.

Unfortunately, a system inside a wall with no openings may still have problems. Customers and suppliers are stuck outside the wall. The system might be fine, but the business might die. Management and the IT department must think again. What they need is a system that permits some transactions in and out, and blocks others. The rules for permitting and blocking transactions could be complex and difficult to implement, but the programmers claim that is their job.

A firewall is an implementation of rules permitting and blocking transactions. It selectively isolates a system from the outside world. The selectivity of an IT firewall differentiates it from a general firewall like the firewall between the engine and the passenger compartment of an automobile. An automobile firewall blocks all fires, but an IT firewall picks and chooses which fires it will stop.

Core mission of a personal computer firewall is to stop all unsolicited incoming transactions. The firewall will reject any message from a node outside the firewall that is not a response to a request from a computer inside the firewall.

This rule is not as restrictive as it might seem. For instance, a widget on a computer desktop shows the outside temperature. You might expect that whenever the temperature changes, some server outside the firewall sends a message with the new temperature. This is not the case. The widget on the desktop requests a new temperature periodically, which would pass through the firewall without an issue. Whenever possible, interactions with outside resources are designed to request information, not receive it unsolicited.

There are exceptions when a process running on a node outside the firewall must send an unsolicited message . These messages will pass through the firewall if the site is on the firewall's whitelist. Messages from a node on the whitelist are always accepted. The other side of the coin is the blacklist . Messages from the blacklist sites are always rejected, even when they are solicited. A blacklisted site could be a known malware source.

Firewalls are a critical element in both personal and enterprise site security. Personal firewalls are usually implemented as software. The Windows firewall is a prominent example, although most of the antivirus vendors also have their own software firewalls.

Enterprises usually rely on firewalls implemented as hardware. The job of a firewall becomes progressively more difficult as the volume of transactions rises. A software firewall can reduce the performance of the PC it protects when the transaction volume is high. When a firewall is protecting hundreds or thousands of users, maintaining satisfactory performance is more than software can provide. Enterprise firewalls are typically hardware appliances that use firmware and dedicated memory to filter incoming and outgoing messages .

Most home computer networks have what could be called a pseudo-firewall that is based on Network Address Translation (NAT) . The usual home system has a small router attached to the Internet . All the computers in the house are connected to the router, either by cables or wirelessly . The router distributes incoming messages to the connected computers. Every computer connected to the Internet has a unique address. The computers in a home network have a different kind of address that cannot be seen on the Internet. The router has its own address that is visible on the Internet and it sends and receives messages from other computers on the Internet. The router does a bit of magic. The home computers send all the messages to the router. The router transforms the messages so they look like they came from the router, and sends the messages on to the Internet. For all appearances, the messages came from the router. When replies arrive, the router sends them to the correct home computer. Only the router is visible to the other computers on the Internet and the home computers are invisible.

This invisibility is helpful, but hackers have found many ways to work around NAT. It does not provide an adequate perimeter for a home system.

Virtualization

Virtualization is another tool for isolation . Virtualization is the simulation of a computer in the memory of a host system. A virtual computer, usually called a virtual machine (VM), can be created and destroyed at will. There are many uses for virtual machines because they are easier to manage than a physical machine , especially when they are implemented in such a way that they can migrate from physical machine to physical machine.

Virtualization is the key to cloud implementations. A cloud consumer can request a VM without knowledge of the physical device where the VM is running and the cloud provider can migrate the VM to other devices at will. This permits great flexibility for both the consumer and provider.

A VM running on a computer, often called a guest, looks like a computer inside a computer. Install a new operating system on the guest and it is a freshly minted machine. Alternatively, you can install a snapshot that you have taken of a machine in a state you want to reproduce and have a duplicate of the machine.

Trying a new operating system can be a problem. If you install the operating system directly on a computer, you have to go to the trouble of restoring from a backup if you want to go back to your old system. A VM solves that problem. Create a VM, install the new operating system, and experiment with it on the VM. If you decide you don't like the operating system, shut down the VM; the operating system is gone, and your computer is unchanged.

A VM can be configured to use memory rather than a hard disk for storage . When the VM is shut down, everything that it has written disappears. Every local record of the guest's activity is gone. If it happened to be infected by malware , the infection is wiped out. If you are concerned about privacy, there is no record.

Malware researchers intentionally infect VMs to study virulent software safely. The researchers close all network ports or turn off the virtual network adapter completely. With no disk and no network connection, the infection can't spread and the researchers can poke and prod, examining the characteristics of the specimen and devising a detection and removal strategy.

Personal users can use a VM as a safe haven for critical tasks like bank transactions by launching a clean VM and performing the transaction from the VM. Malware may have infected your computer without you knowing it, but the chance of malware slipping into the new VM is very slight. When the transaction is complete, you can shut down the VM and it disappears.

VMs also can be used to test install applications that might be infested with malware or to visit questionable websites. You can also open email attachments in a VM when you suspect an attachment is legitimate but you are not sure. Perform the risky action on the VM and delete the VM when you are finished.

Attack Surface Reduction

The attack surface of a system is all the points where a system is vulnerable to attack. An armadillo rolled up into a tight ball showing only leathery plates has minimized its attack surface by hiding its soft and vulnerable belly. Computer users can minimize the attack surface of their computers, perhaps not as efficiently as a three-banded armadillo, but they can isolate themselves from some threats .

Any point where data can move in and out of a system is part of the attack surface. These include

• Network and USB ports

• CD or DVD drives

• SD card slots

• External SATA hard drive ports

• Wireless and Bluetooth radios

Older or newer devices may have other vulnerable connection types. Every one of these connections could be exploited to break into and take over or damage a system. The threats that come in through the network are well-known. Any external storage device, whether a flash drive , an SD card, or an external hard drive , can be a carrier for malware . CDs and DVDs also can contain malware. Wireless network connections are especially vulnerable to intrusion through unsecured public wireless services. Bluetooth may not often be thought of, but it also can be a route into a computer.

The first step to reducing the external connection attack surface is to remove, disconnect, unplug, or turn off any of external connection facility that is not used. The second is to be vigilant over what is plugged into ports. USB flash drives loaded with malware and left in parking lots to attract office workers are a popular method of attack.

Wireless networks and Bluetooth connections are useful and convenient, but turning them off when they are not in use reduces the danger that a miscreant will use them as an entry point.

Other attack surfaces that can be reduced are the programs installed on the computer. Most programs have exploitable defects that may never be known, but there is a risk that a criminal may discover them at any time. By removing all unused software , the attack surfaces of the unused software are also removed.

For example, manufacturers often preinstall utilities for maintaining their computers. These can be problematic because many users don't use them. They are frequently only slight improvements over similar and more familiar utilities that are part of the operating system . These utilities can have flaws that can compromise security.¹¹Removing them reduces the attack surface.

Services and daemons are programs that run in the background without a user interface. Many of them are started automatically when the computer boots. These too are attack surfaces that are bound to have exploitable flaws. Quite often, there are unused services set to start automatically. Switching them to start manually or disabling them will reduce the attack surface and occasionally improve performance by freeing resources for more useful processes.

There are also processes or tasks that are started for no understandable reason. These processes may have been left behind by an application that started them but neglected to shut them down. These processes simply wait for input or a termination signal. Hackers are always on the prowl for idle processes running with administrative privileges . Sometimes, a hacker can feed data to the program that will cause it to crash and confer its privileges on the hacker, who is then able to wreak any havoc they care to.

The tasks and services lists reveal the beating heart of the computer more accurately that a cardiologist's echocardiogram. Weeding services and processes from the task list is tough. There is no easy way to spot the rogues. You must become familiar with which processes are legitimate and which are not and a feeling for the CPU time and memory activity that each process should have. If you get it wrong and kill a legitimate task or service, you have programs crashing or losing stability. The entire operating system may crash. On the other hand, a user with a good feel for what should be running and how a normal system behaves on detailed level can reduce their attack surface and keep their system stripped of extraneous performance -sapping activity. By watching the task and services list, Googling process names, and judiciously stopping tasks, a user can become an expert on their own computer. Such a user may be able detect and remediate zero-day attacks before other instrumentation raises an issue.

Encryption

Encryption can prevent many types of data theft and intrusion. For example, a hacker may break into a personal computer , but if the computer's files are encrypted, the hacker may not find anything to steal. Encryption has become increasingly important in enterprise computing because workplaces are changing and successful exploits have become more frequent. Employees work from home or places like coffee shops. Encryption has become an important tool for protecting information assets that are outside controlled premises or vulnerable to exploits. These benefits apply to personal computers as well as enterprise systems.

Unfortunately, encryption is surrounded by controversy on exactly how secure it is. Successful encryption requires an entire implementation, not just a strong encryption algorithm . For instance, the Microsoft BitLocker file encryption system, which has been a part of Windows since Vista, combines an encryption algorithm with hardware key generation.¹² In theory, BitLocker is very secure because its algorithm is strong. However, some believe that Microsoft built a backdoor into BitLocker for government agencies. They may have, or they may not. There are vehement partisans on both sides. Some say backdoors for proper law enforcement are good, others say backdoors are always bad. The point is that it is never good to assume that encryption, or any other technology, is infallible. For securing data on a personal computer , perhaps the only thing to say is that even flimsy encryption will defeat an inept hacker, and which is an improvement over no encryption.

Antivirus

Antivirus, or antimalware, tools find and remove malware . They do not prevent viruses and other malware from infecting computers; they detect and remove the malware after the computer has been infected. Antivirus products began to appear in the 1980s, not long after viruses began to appear. A virus is code that reproduces itself and travels to other computers. Other varieties of malware do not reproduce like viruses. Early antivirus products only detected and removed viruses. As other malwares appeared, the antivirus tools expanded to combat them.

The fundamental mechanism used to detect malware is the signature . The signature can be as simple as a file name and size, but they are often more sophisticated, capable of detecting malware that is disguised and hidden. More sophisticated signatures match patterns in compiled code and scan settings found in registries and other configuration files.

Signatures are both the strength and weakness of antivirus tools because the proper signature has to be devised and installed in the tool before the tool can detect and remove a virus. An antivirus tool is helpless against a virus that has no signature because no antivirus team has seen the virus. Malware developers are always busy devising new viruses, which they test against the major antivirus tools. It is a cat-and-mouse game that guarantees that some viruses will go undetected. Nevertheless, the antivirus tools protect against thousands of viruses.

Signatures are not the only way that antivirus tools work. Some use heuristics, rules of thumb that identify suspicious processes by their activity rather than a signature . Other methods examine the layout of binary files to identify patterns that are characteristic of viruses. Instead of scanning the computer periodically, some tools monitor the system continually, watching for anomalies as they occur. This is good, but can affect performance .

Antivirus tools have become more effective as automatic updates over the Internet have shortened the time between discovering a virus in the wild and the tool being prepared to detect and remove it. However, hackers have dealt with antivirus tools for a long time and they have become adept at thwarting them. Therefore, antivirus tools are only one line of defense against cybercrime.

Backing Up

Users may not think of backups , saving copies of the data stored on a computer, as a security tool. However, a good backup is the final protection for a compromised computer. With a current backup, a computer can be taken down to bare metal, where every bit and byte of software is removed and the system is cleaned to nothing but the hardware. After the system is thoroughly cleaned, the system can be built up again to its state at the time of the backup .

Although a backup is the ultimate defense, they are not infallible. Some malware buries itself into the firmware in non-volatile memory and crawls out again after the computer is restored. In that case, even the firmware has to be replaced. Also, the unfortunate fact is that backups are only as reliable as the person administering them. Good backup procedure relies on several backups. One should be off-site in a location where it will not be destroyed if a disaster strikes the computer. Backups should not be accessible to ransomware, as they may be on a hard drive . Finally, backups have to be tested regularly. Malfunctioning equipment, such as hard drives, can write unreadable backups , and have a habit of doing so at the moment they are needed most.