Preventing Malware
There are various ways of securing your system from malware attacks within a company, you can do things like:
1. Properly Configuring Endpoint Security
2. Make Network Security Strong
3. Regularly Update Systems and Software
If you are securing a personal system from malware, just don't click any suspicious links from people you dont recognise. You should also avoid downloading software that you arent fully sure if safe or not, if you are unsure, you can use websites like Virus Total or Hybrid Analysis to ensure that the software is safe to download. However, detection websites like this are not always accurate, as they can generate false positives, so you can also use a sandboxed environment to run the software in to ensure that it is safe first. There are some useful websites in the Resources page.
Configuring Endpoint Security
When it comes to configuration of endpoint security, you should ensure that you are using a reputable antivirus software, and that it has strict real time scanning policies built into it. This will scan files that are accessed, written to, and executed. You should also make sure that you are keeping this antivirus up to date, as new malware is created every day, and new exploits are found with this, so keeping your antivirus up to date is really important because outdated antivirus programs could have a vulnerability that could be exploited in order to disable the antivirus. You should also integrate an engine that can detect malware based on behaviour of processes, to see if any process that is within the system is doing anything that doesn't align with usual program activities; some examples of suspicious program behaviour would be programs that are trying to modify memory of other processes, or accessing files that the program doesn't need access to in order to operate. The endpoint security you implement should make sure that any suspicious files are quarantined or removed from the system to ensure safety on the system. If there are false positives, ensure you test the file in a sandboxed environment to ensure that it is a legitimate software, before allowing it to run on the system.
Network Security
When it comes to network security, you need to ensure that you have firewalls properly setup on your network, and that you have some kind of software in place to monitor network traffic to ensure that there isn't any suspicious activity going on. Your firewalls should have SPI or Stateful Packet Inspection, as well as DPI or Deep Packet Inspection, which will inspect packets that are coming into the network, and will determine if the packets are safe to be allowed into the network. If the packets are deemed unsafe by the firewall, they will be excluded, and not allowed onto the network. You should also implement intrusion detection systems, which will monitor the network for any suspicious activity happening on the network, and if it detects any suspicious activity on the network, it will alert a network administrator and whoever the network administrator is, can decide what to do with the alert. For critical sections of the network, you should implement a segmentation system, which will be able to stop malware from getting deeper into the system. Segmentation is where for example; one computer is infected with malware, and the malware attempts to spread to other systems, the infected systems will be isolated from the rest of the network to prevent the malware from spreading to other systems and causing more damage. VPNs should also be utilised, as they will encrypt the data that is sent between the network, and ensure any remote workers are secure when accessing the network from home.
Updating Systems/Software Regularly
When it comes to updating software, it is really important that you keep your systems up to date, as new exploits are constantly being developed, and if you do not update your software, an attacker or group of attackers could have found a vulnerability in an old version of the software, and could potentially exploit that vulnerability to gain unauthorized access into the network. The most dangerous exploits are called 0day exploits, which are exploits that are found by attackers even before the developers of the software itself have found the exploit. This is why it is very important to keep your software up to date to ensure that you are protected from these kinds of exploits, as developers could push a patch to fix a vulnerability, and if you do not update the software, your networks would still be vulnerable to such exploits.
Backing up Data
Taking regular backups of your data is really important, because if you do fall victim to a malware attack, usually ransomware, you can restore your data from a backup, and you will not have to pay the ransom fee to the attacker to retrieve your files. If you do not have any backups of your data, and you are targeted in a ransomware attack, you will not really have many options, and will likely have to pay the ransom fee to the attacker, or wait for a decryptor to be released by a researcher, or wait for government intervention to retrieve any decryption keys that the attacker has. You should also ensure that any of your backups are stored offsite, as most modern ransomware have features to encrypt network shares, and delete backups that are stored on the network or stored locally on the device.