Every malware type you already know has a different answer to one question: does it need a person to do something, or not?
🦠 Propagation Mechanisms — click each type
Requires user action: None
Spreads on its own across a network, scanning for and exploiting vulnerable devices without any human interaction at all.
🔑The worm/virus distinction from 1.2.1 is the load-bearing fact here. If a scenario says malware spread across an entire network overnight with nobody touching anything, that's structurally impossible for a virus — it has to be a worm.
4.3.ASkill
Three Managerial Controls
Managerial controls are policy, not technology — but they close the exact openings malware relies on to spread in the first place.
Length, reuse rules, rotation timing, and construction requirements for passwords
Software Installation Policy
What software users can install themselves, and the request process for anything else
💡Notice the theme: every one of these removes a way malware typically gets in — an AUP blocking external drives closes the autorun path from 1.2.1; a software installation policy closes the "download something you shouldn't" path entirely.
3.3 (recap)Concept
Segmentation Stops What Detection Missed
Detection and containment are different problems. Even a perfectly detected infection can still spread if nothing physically limits where it can go — which is exactly what network segmentation, from 4.2.4 and 2.1.3, is built to do.
🧱 Segmentation as Containment
On a flat network, an infected device (orange) can reach every other device — malware spreads until it runs out of vulnerable targets, which may be the entire network.
4.3.BSkill
What Happens After Detection: Quarantine and Removal
Once anti-malware software matches a file against a known signature, it takes two actions in sequence.
ExampleGuided Example — The Response Sequence
Anti-malware software scanning a device finds a file matching a known ransomware signature.
Step 1 — Detect
The file's signature matches an entry in the anti-malware database — a confirmed identification, not just a suspicion.