INFORMATION SECURITY EFFORTS are often focused on protecting data from unauthorized people. While the concepts are generally stated in terms of users and not people, it is common to relate the two. What if an attacker is not a person? Programs can carry out attacks on behalf of people. It is important to consider controls to prevent programs from violating the confidentiality, integrity, and availability of data as well as just preventing human attacks.

In this chapter, you’ll learn about the different types of software that can violate the security of your information systems. Software designed to infiltrate a target computer and carry out the attacker’s instructions is referred to as malicious software. Malicious software of all types is generally referred to as malware. You’ll also learn techniques to prevent malware attacks, search for the presence of suspect software, and remove any software you have identified as malicious. Diligence is required to fully protect an information system environment from malware attacks, and you’ll learn what to do to keep your systems secure.