Overview
Knowing how malware works only matters if you can stop it. This lesson pulls the module together into layered defenses against malware — the preventive, detective, and corrective measures that, combined, keep infections rare and survivable.
Learning objectives
- List key anti-malware defenses across control functions.
- Explain defense in depth applied to malware.
- Understand user behavior as a critical defensive layer.
Core concept
Effective malware defense is layered, matching the control functions from Module 7:
- Preventive: patching (closes exploited vulnerabilities), email filtering, disabling macros, application allow-listing, least privilege (so malware runs with limited rights), and user awareness against phishing.
- Detective: endpoint detection and response (EDR), antivirus, network monitoring for beaconing, and log analysis.
- Corrective: isolating infected hosts, removing malware and its persistence, and restoring from clean, tested backups.
No single layer is perfect; together they make infection unlikely and recovery reliable.
How it works
Each layer targets a different stage of the infection you studied: filtering and training break delivery; disabling macros and least privilege hinder execution and limit damage; EDR and monitoring catch persistence and C2; backups defeat the ransomware payload by making recovery possible without paying. Because attackers adapt, defenders keep multiple independent layers so bypassing one still meets another.
Practical example
A phishing email slips past the filter. The user, trained to be cautious, does not enable macros — but even if they had, macros are blocked by policy. Had malware run, the user's standard (non-admin) account would limit it, EDR would flag the behavior, and if ransomware somehow encrypted files, tested offline backups would restore them. Five independent layers, any one of which alone might fail.
Cybersecurity relevance
This layered model is the practical output of the whole module and a template for defense everywhere. Backups deserve special emphasis: reliable, tested, offline backups are the definitive answer to ransomware, turning a potential catastrophe into a recoverable inconvenience.
Common mistakes
- Relying on antivirus alone, which misses new or modified malware.
- Skipping patching, leaving the vulnerabilities malware exploits open.
- Untested or online-only backups that ransomware can also encrypt.
Key takeaways
- Malware defense is layered across preventive, detective, and corrective controls.
- Each layer targets a stage of infection; defense in depth means no single failure is fatal.
- Patching, least privilege, user awareness, and tested offline backups are especially high-value.
Check your understanding
- Match one defense to each infection stage: delivery, execution, persistence, payload.
- Why are tested, offline backups considered the definitive defense against ransomware?