Malware Explained
Malicious software (also known as ‘malware’) is software or web content that can harm your organisation, such as the recent WannaCry outbreak. The most well-known form of malware is viruses, which are self-copying programs that infect legitimate software.
YOU CAN PROTECT YOURSELF FROM MALWARE IN A NUMBER OF WAYS:
Antivirus software – which is often included for free within popular operating systems – should be used on all computers and laptops. For your office equipment, you can pretty much click ‘enable’, and you’re instantly safer. Smartphones and tablets might require a different approach and if configured in accordance with the NCSC’s EUD guidance, separate antivirus software might not be necessary.
Following Best practice for downloading mobile Apps – You should only download apps for mobile phones and tablets from manufacturer-approved stores (like Google Play or Apple App Store). These apps are checked to provide a certain level of protection from malware that might cause harm. You should prevent staff from downloading third party apps from unknown vendors/sources, as these will not have been checked.
Set any staff accounts with the appropriate permissions – Staff accounts should only have enough access required to perform their role, with extra permissions (i.e. for administrators) only given to those who need it. When administrative accounts are created, they should only be used for that specific task, with standard user accounts used for general work.
Keep software & firmware up to date – For all your IT equipment (so tablets, smartphones, laptops and PCs), make sure that the software and firmware is always kept up to date with the latest versions from software developers, hardware suppliers and vendors. Applying these updates (a process known as patching) is one of the most important things you can do to improve security – the IT version of eating your fruit and veg. Operating systems, programmes, phones and apps should all be set to ‘automatically update’ wherever this is an option.
Avoid sharing portable memory – We all know how tempting it is to use USB drives or memory cards to transfer files between organisations and people. However, it only takes a single cavalier user to inadvertently plug in an infected stick (such as a USB drive containing malware) to devastate the whole organisation. Consider other file transfer methods (such as by email or cloud storage), rather than via USB. There free online services like WeTransfer that enable you to share large files and folders.
Turn on your firewall – Firewalls create a ‘buffer zone’ between your own network and external networks (such as the Internet). Most popular operating systems now include a firewall, so it may simply be a case of switching this on. For more detailed information on using firewalls, refer to the Network Security section of the NCSC’s 10 Steps to Cyber Security.