Control Strategy SuspendInfectedProcess.Implementation

URI: CSG-SuspendInfectedProcess-Implementation-Runtime

Package: Network

< prev | next >

Description: Process Process has been disabled by the manager of its host HostManager to prevent it being exploited after being infected by malware. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user HostManager who is responsible for managing the device hosting Process. The Disabled Process control should be deselected only when the process has been restarted.

Blocked Threats (4)

DF.W.HPDADF.7

Malware insertion in flow of Data to FlowsTo by Process to : if process Process is infected by self-propagating malware, it may insert the malware into the copy of Data sent to process FlowsTo.

DS.A.HPsACDAdDS.7

Infected process Process encrypts or deletes data Data: the process having become infected by malware is able to delete or otherwise disable access to the stored copy of Data on its host device Host.

DS.W.HPsACDAdDS.7

Infected process Process infects data Data stored on host Host: the process having become infected by malware is able to insert itself into the stored copy of Data on its host device Host.

P.J.SHP-iT.7

Malware infection installs back door in process Process: if Process is infected by malware, it may install a back door in Process, which could be accessed remotely at a later time.