This was a Presentation I gave a few years ago on how Cisco Security Agent works, and what the current landscape of threats it prevented. This was from 2009, and presented to a room of Helpdesk Technicians.
Cisco Security Agent - Theory, Practice, and Policy
Mike PruettInformation Technologympruett@istavision.com
Definitions Anatomy of an Operating System Anatomy of an Antivirus Program Anatomy of a Security Threat Analysis
Malware - short for malicious software, is software designed to infiltrate a computer system without the owners informed consent. Spam- junk email that involves nearly identical messages sent to numerous recipients by email. Distributed Denial-of-Service (DDoS) – occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers.
Botnet – a jargon term for a collection of software robots, or bots, that run autonomously and automatically Zombie – a computer attached to the internet that has been compromised by some form of threat. Generally, a compromised machine is only one of many in a botnet, and will be used to perform malicious tasks of one sort or another under remote direction. Intrusion Detection System (IDS) – is a device (or application) that monitors network and/or system activities for malicious activities or policy violations. Intrusion Prevention System (IPS) – like a IDS, but the device can react, in real-time, to block or prevent the unwanted activity.
Vulnerability – a term for weakness which allows an attacker to reduce a systems security. Exploit – a piece of software, a chunk of data, or sequence of commands that take advantage of a bug, glitch, or vulnerability in order to cause unintended or unanticipated behavior to occur on computer systems. Zero Day Threat – a computer threat that tries to exploit computer application vulnerabilities that are unknown to others, undisclosed to the software vendor, or for which no security fix is available. Black Hat Hacker– are hackers who specialize in unauthorized penetration of computer networks. They may use computers to attack systems for profit, for fun, or for political motivations or as a part of a social cause. White Hat Hacker – also known an ethical hackers, or white knights, are computer security experts, who specialize in penetration testing, and other testing methodologies, to ensure that a companies information systems are secure.
A computer program that can copyitself and infect a computer.
A self-replicating computer program.It uses a network to send copies of itselfto other computers, usually without anyuser intervention.
A piece of code that uses a polymorphic engine to mutate whilekeeping the original algorithm intact. That is, the code changesitself each time it runs, but the function of the code in whole willnot change at all.
A derogatory term used to describe thosewho use scripts or programs developed byother to attack computer systems.
Applications Processes NetworkCOM API System API Services Stack KERNEL CPU MEMORY FILE I/O DEVICE I/O
Applications Processes NetworkCOM API System API Services Stack KERNEL CPU MEMORY FILE I/O DEVICE I/O = Cisco Security Agent “Shim”