What's changed: Initial version
4.2Malware and unauthorized-access countermeasures
Covers malware detection techniques—pattern matching, the behavior method, the heuristic method, dynamic analysis, and static analysis—the concepts of entry-point (ingress) controls, exit-point (egress) controls, and defense in depth, quarantine networks for isolating infected endpoints, the DMZ, vulnerability management (patching), hardening, and secret sharing for splitting a key across multiple holders.
"Preventing all intrusions" can no longer be assumed. Given targeted attacks and zero-day exploits, a design philosophy of assuming intrusion will happen and deciding what to stop at each layer is essential. This section studies malware and unauthorized-access countermeasures from the perspective of a security officer deciding what to place at each layer of defense in depth and how to minimize damage if an intrusion does occur.
4.2.1Malware detection techniques
- Pattern matching (signature-based detection) compares files against known malware's characteristic byte sequences (signatures). It is highly accurate and fast against known threats, but has the fundamental limitation of being unable to detect unknown malware whose signature is not yet registered.
- The behavior method runs a program and monitors its actual runtime behavior—registry changes, suspicious communication—to judge maliciousness. The heuristic method estimates the likelihood of maliciousness statistically or by rule-of-thumb from a program's code structure or patterns. Both can potentially detect unknown malware without relying on signatures.
- Dynamic analysis observes behavior by actually running the sample (often inside a sandbox). Static analysis examines the code or binary structure without executing it. Dynamic analysis can capture behavior that only appears at runtime, but its effectiveness can diminish against malware that evades sandbox detection (behaving benignly once it detects an analysis environment).
Most-tested contrasts: "pattern matching = detects only known threats", "behavior/heuristic methods = can detect unknown threats", "dynamic analysis = observes by running, vulnerable to sandbox evasion", and "static analysis = examines structure without executing". The misconception that "signature-based detection alone is sufficient" is a classic trap.
4.2.2Entry-point controls, exit-point controls, and defense in depth
- Entry-point (ingress) controls—firewalls, mail/web filters, and the like—prevent intrusion from outside the organization into the internal network. Because targeted attacks are designed to evade them, entry-point controls alone are insufficient.
- Exit-point (egress) controls assume intrusion or infection has already occurred and detect and block suspicious communication from inside the organization out to an external destination (e.g., a C&C server). Examples include proxy-based destination checks, DNS-query monitoring, and quarantine networks (connecting unauthenticated or suspicious endpoints to a dedicated isolated segment and allowing access to the production network only after a health check). Their significance as the last line of defense in depth—"even if breached, do not let data leave"—is substantial.
- Defense in depth avoids relying on any single control, instead placing different types of controls at multiple layers—entry, internal (quarantine networks, segmentation), and exit. It presumes that even if one layer is breached, the next layer will stop the damage.
Suppose a manufacturer's factory site is reviewing its defense design against a targeted-email-based intrusion. First, as an entry-point control, it places attachment scanning at the mail gateway (pattern matching to filter known malware) and web filtering to restrict access to suspicious sites—but since targeted attacks are assumed to use unknown, zero-day malware, it judges that this layer alone cannot fully prevent intrusion. Next, in case an endpoint does get infected, it places behavior-method monitoring (such as EDR) at an internal layer to detect registry tampering or suspicious process launches. It also segments the network so that BYOD devices or IoT equipment brought in from outside first connect to a quarantine network for a health check before being permitted onto the production segment, reducing the risk that an infected endpoint reaches critical systems via lateral movement. As a last line of defense, it places exit-point controls to detect and block suspicious communication from inside to an external C&C server (e.g., periodic beaconing to an unknown destination) via proxy and DNS monitoring—so that even if intrusion and infection occur, at least the exfiltration of confidential data can be prevented. Designing separate layers for "preventing intrusion" and "minimizing damage after intrusion" is the practical core of defense in depth, and exit-point controls are especially valued as "the last defensive line after the entry point has been breached." In addition, a public-facing web server is placed in the DMZ (a buffer segment isolated from both the internal LAN and the external internet), so that even if a DMZ server is compromised it cannot directly reach the internal LAN, and vulnerability management (prompt patching) plus hardening (removing unnecessary services and accounts) are maintained continuously to avoid known vulnerabilities being exploited.
| Layer | Representative control | Primary goal |
|---|---|---|
| Entry-point control | Mail/web filtering, pattern matching | Prevent intrusion from outside |
| Internal (quarantine NW, segmentation) | Quarantine network, behavior method/EDR | Isolate infected endpoints, block lateral movement |
| Exit-point control | Proxy/DNS monitoring to block C&C traffic | Prevent data exfiltration (last line of defense) |
4.2.3Secret sharing
- Secret sharing splits a cryptographic key or confidential information into multiple fragments so that it cannot be reconstructed unless a predetermined threshold number of fragments are gathered. Because a leak or loss at any single location alone cannot reconstruct the information, it helps eliminate a single point of failure (SPOF) in key management.
Trap: "Exit-point controls prevent intrusion itself" is wrong—exit-point controls are the layer that prevents data exfiltration after intrusion or infection has already occurred; preventing intrusion itself is the role of entry-point controls. Also wrong: "the behavior method can only detect known malware"—the behavior and heuristic methods do not rely on signatures and can potentially detect unknown malware (being limited to known threats is a characteristic of pattern matching).
4.2.4Section summary
- Pattern matching is limited to known threats; behavior/heuristic methods can also detect unknown ones. Dynamic analysis is vulnerable to sandbox evasion
- Entry-point controls prevent intrusion; exit-point controls prevent data exfiltration after intrusion (the last line of defense). Defense in depth combines multiple layers
- Quarantine networks isolate unauthenticated endpoints, the DMZ isolates public-facing servers, and secret sharing eliminates a SPOF in key management
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which of the following has the highest likelihood of detecting an unknown zero-day malware used in a targeted attack?
Q2. To guard against the case where an intrusion has slipped past entry-point controls and reached the internal network, which countermeasure is most important as the last line of defense against data leaking outward?
Q3. For cryptographic key management, you want to ensure a leak or loss at a single location alone cannot reconstruct the key, eliminating a single point of failure. Which technique is appropriate?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.