Malware, social engineering and backups

A message reaches several Fairhaven staff on a Monday morning. It appears to come from the library's payroll provider, says a tax form needs urgent confirmation before the end of the day, and links to a page that looks exactly like the provider's sign-in screen. Two people report it to Hana within minutes; one person clicks and types their password before realizing something is off, then calls the help desk. Because of MFA, the attacker gets nothing useful, and Hana resets the password and blocks the fake site within the hour. She brings the message, with names removed, to the cert club. "This is how most incidents begin," she says. "Someone is tricked, and then malware or stolen access does the damage. Backups are what save you when the rest fails." This lesson covers the main types of malware, the social engineering techniques that deliver it, and how backups are planned, stored and tested.

Types of malware

Malware is any software designed to harm a device, steal data or give an attacker control. Tech+ expects you to recognize the main types by what they do and how they spread.

The distinctions the exam tests most are between virus, worm and Trojan. A virus needs a host file and a person to run it. A worm needs neither and spreads by itself. A Trojan relies on the user being fooled into installing it, like the wooden horse it is named after. Ransomware deserves special attention because it attacks availability directly and is the most damaging threat many organizations face: once files are encrypted, the choices are restoring from backups, paying criminals with no guarantee of results, or losing the data. Modern ransomware groups also copy data before encrypting it and threaten to publish it, which turns an availability problem into a confidentiality one too.

Signs of infection include a sudden slowdown, programs crashing or opening by themselves, a changed browser home page or search engine, new toolbars, pop-ups appearing outside the browser, security software turned off, files renamed with unfamiliar extensions and a note demanding payment. A technician who sees these should isolate the device from the network, by unplugging the cable or turning off Wi-Fi, report it to the security team and avoid trying random fixes that could destroy evidence. Removing malware fully is often harder than reimaging the device and restoring the user's data from a clean backup.

Social engineering

Social engineering means manipulating people into giving away information, granting access or taking an action that helps an attacker. It works because it exploits ordinary human qualities: helpfulness, trust, curiosity, fear and the wish to avoid trouble. Attackers create urgency ("before the end of the day"), claim authority ("this is the IT department"), offer something attractive ("you have won a prize") or make the target afraid ("your account will be closed"). Recognizing those pressures is the first defence.

The defences are habits and processes. Check the sender's real address, not just the display name. Hover over links to see where they really go before clicking, and go to important sites by typing the address or using a bookmark instead. Be suspicious of urgency, threats and requests to bypass normal procedures. Verify requests for money, passwords or sensitive data through a separate channel, such as calling the person back on a number you already have. Never share passwords or MFA codes: no legitimate IT team asks for them. Report suspicious messages, because one report lets the security team warn everyone and block the site, as Hana did. Physical rules matter too: badge doors that close behind each person, visitors signed in and escorted, screens locked when unattended and found USB sticks handed to IT, never plugged in.

The person who clicked the fake payroll link did the most important thing right: they reported it immediately. Hana is careful to thank people who report mistakes rather than blame them, because a culture where people hide clicks gives attackers hours or days instead of minutes. Security awareness training, run regularly and backed by short simulated phishing tests, keeps the warning signs fresh.

Backups

A backup is a copy of data kept so the data can be restored if the original is lost, damaged or encrypted. Backups protect against hardware failure, accidental deletion, software corruption, theft, fire and flood, and ransomware. They are the last line of defence for availability and integrity, and they only count if they can actually be restored.

There are three classic backup types. A full backup copies all of the selected data every time; it is the simplest to restore but takes the most time and space. An incremental backup copies only what has changed since the last backup of any kind; each one is small and fast, but restoring needs the last full backup plus every incremental since, in order. A differential backup copies everything that has changed since the last full backup; each differential grows through the week, but restoring needs only the last full backup and the latest differential. Many organizations run a full backup weekly and incremental or differential backups daily.

full_size = 500          # GB in a full backup
daily_change = 20        # GB of data that changes each weekday
days = ["Mon", "Tue", "Wed", "Thu", "Fri"]

incr_total = full_size
diff_total = full_size
print("Day  Incremental  Differential")
for i, day in enumerate(days, start=1):
    incr = daily_change           # only changes since yesterday
    diff = daily_change * i       # all changes since Sunday's full
    incr_total += incr
    diff_total += diff
    print(f"{day}  {incr:6d} GB    {diff:6d} GB")
print(f"Storage for the week: incremental {incr_total} GB, differential {diff_total} GB")
print("To restore Friday: incremental needs the full + 5 backups; differential needs the full + 1")

Day  Incremental  Differential
Mon      20 GB        20 GB
Tue      20 GB        40 GB
Wed      20 GB        60 GB
Thu      20 GB        80 GB
Fri      20 GB       100 GB
Storage for the week: incremental 600 GB, differential 800 GB
To restore Friday: incremental needs the full + 5 backups; differential needs the full + 1

Where backups live

Where backups are stored matters as much as how they are made. An on-site backup, such as a backup server or external drive in the same building, restores quickly but is lost along with the original in a fire or flood, and may be encrypted along with everything else in a ransomware attack if it is always connected. An off-site backup, kept at another location or with a cloud backup provider, survives local disasters but may take longer to restore. Cloud storage that simply synchronizes files is not a backup on its own, because a deletion or encryption on one device is copied to the cloud too; a real backup keeps earlier versions that cannot be overwritten.

A widely used rule of thumb is the 3-2-1 rule: keep at least three copies of important data, on two different types of storage, with one copy off-site. Many organizations add that one copy should be offline or immutable, meaning it cannot be changed or deleted for a set period even by an administrator, so ransomware cannot reach it. Fairhaven keeps nightly backups on a backup server at central, a copy in a cloud backup service in another region, and an immutable copy that is retained for thirty days.

Testing is the step most often skipped. A backup that has never been restored is a hope, not a plan: jobs fail silently, media goes bad and people discover too late that a critical folder was never included. Organizations should check backup job reports daily and perform restore tests regularly, restoring individual files and, from time to time, an entire system to prove it works and to measure how long it takes. Two targets guide planning: the recovery point objective, how much recent data the organization can afford to lose, such as one day, which sets how often backups run; and the recovery time objective, how quickly a system must be working again, which shapes where backups are kept and how restores are done.