JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech IV Year COMPUTER FORENSICS Previous Question Paper (September - 2022 - R16)

Malicious software, or malware, encompasses various forms of intrusive code designed to compromise system integrity. Among these, viruses and worms are two of the most prevalent threats, though they differ significantly in their propagation mechanisms and operational requirements.

1. Computer Viruses

• A virus is a piece of malicious code that attaches itself to a legitimate host program or executable file. It requires human intervention to spread, typically through the execution of the infected host file.
• When the infected program is run, the virus code executes, allowing it to replicate by infecting other files on the system or network.
• Viruses can be categorized based on their target, such as file infectors (targeting executables), boot sector viruses (targeting the Master Boot Record), and macro viruses (targeting documents in applications like Microsoft Word).
• The primary goal of a virus is often to corrupt data, delete files, or cause system instability. Because they are dependent on host files, they are generally easier to contain if the host file is identified and removed.

2. Computer Worms

• A worm is a standalone, self-replicating program that does not require a host file or human intervention to propagate. It exploits vulnerabilities in operating systems or network services to spread automatically across networks.
• Worms consume significant network bandwidth and system resources as they scan for other vulnerable machines, often leading to Denial of Service (DoS) conditions.
• Unlike viruses, worms reside in the system's memory and do not necessarily modify existing files. This makes them particularly dangerous as they can spread globally in a matter of minutes.
• Modern worms often carry payloads, which may include backdoors, keyloggers, or ransomware, allowing attackers to gain unauthorized remote access to compromised systems.

Comparison Summary

In digital forensics, identifying these threats involves analyzing system logs, examining network traffic patterns for anomalous spikes, and performing memory forensics to detect resident malicious code.

The Incident Response Methodology is a structured framework used by organizations to identify, contain, and recover from security breaches. The process is typically categorized into the following phases:

• Preparation: This phase involves establishing the necessary tools, policies, and personnel to handle incidents. It includes defining the Incident Response Plan (IRP), training the Computer Security Incident Response Team (CSIRT), and ensuring backup systems and monitoring tools are operational.
• Detection and Analysis: This stage focuses on identifying suspicious activity through Intrusion Detection Systems (IDS), log analysis, and alerts. Once an anomaly is detected, the team must verify if it is a true incident, determine its scope, and assess the potential impact on organizational assets.
• Containment: The primary goal here is to limit the damage and prevent the threat from spreading further. This is divided into short-term containment (e.g., isolating an infected segment of the network) and long-term containment (e.g., applying temporary patches or reconfiguring firewalls).
• Eradication: Once the threat is contained, the root cause must be removed. This involves deleting malware, disabling compromised user accounts, and patching vulnerabilities that allowed the initial entry. It is crucial to ensure that the environment is clean before moving to recovery.
• Recovery: This phase involves restoring systems to normal operation. This includes restoring data from clean backups, verifying system integrity, and implementing enhanced monitoring to ensure the threat does not return.
• Post-Incident Activity (Lessons Learned): This is the most critical phase for long-term improvement. The team conducts a formal review to document what happened, how the team responded, and what could be improved. The findings are used to update the Incident Response Plan and strengthen security controls for the future.

Note: Documentation must be maintained throughout every phase to ensure chain of custody, especially if legal action or forensic investigation is required.