Page 1462 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

The reason for this sudden activity was unclear until three months
later, in October 2017, when the Wall Street Journal broke a report

claiming that Kaspersky software created a back door in their
security products that allowed Russian hackers to break into the
computer of a National Security Agency contractor and steal highly
classified information.

The vast majority of these packages utilize a method known as
signature-based detection to identify potential virus infections on a
system. Essentially, an antivirus package maintains an extremely large
database that contains the telltale characteristics of all known viruses.

Depending on the antivirus package and configuration settings, it
scans storage media periodically, checking for any files that contain
data matching those criteria. If any are detected, the antivirus package
takes one of the following actions:

If the software can eradicate the virus, it disinfects the affected files
and restores the machine to a safe condition.

If the software recognizes the virus but doesn’t know how to
disinfect the files, it may quarantine the files until the user or an

administrator can examine them manually.

If security settings/policies do not provide for quarantine or the
files exceed a predefined danger threshold, the antivirus package
may delete the infected files in an attempt to preserve system
integrity.

When using a signature-based antivirus package, it’s essential to

remember that the package is only as effective as the virus definition
file upon which it’s based. If you don’t frequently update your virus
definitions (usually requiring an annual subscription fee), your
antivirus software will not be able to detect newly created viruses.
With thousands of viruses appearing on the internet each day, an
outdated definition file will quickly render your defenses ineffective.

Many antivirus packages also use heuristic-based mechanisms to

detect potential malware infections. These methods analyze the
behavior of software, looking for the telltale signs of virus activity,
such as attempts to elevate privilege level, cover their electronic tracks,