Lecture 6 : Security in Networks

In this lecture, we are introduced on what is meant by a computer network, personnel who causes security problems, network security issues and its controls.
Basically a network is a computing environment with more than one independent processor. Network resources include computers, OS, programs, processes and people.
Below is the illustration on the network architecture.



A network enables us the send and receive messages, executing programs, obtaining status information on local and other network users.
The types of network is shown below:



The basic network topologies that we are all already familiar with are star, mesh, ring and bus topology.
We have also learned the Open Systems Interconnection model.
The seven layers of the OSI model is as shown below:



Individuals who cause security problems are hackers, spies, students, businessmen, ex-employees, stockbrokers, terrorists, and etc.
The areas where network security problems can occur are as follows:
• Authentication
• Secrecy
• Non-repudiation
• Integrity control
Disadvantages of computer networks:
• Accidental sharing because inadequate access control.
• Complexity where a network may consist of two or more systems with different OS and different mechanisms for hosting a connection.
• Unknown perimeters where one host maybe a node on two or more networks.
• Many points of vulnerabilities
• Unknown paths
• Label format differences
• Anonymity
Hacking phases involve:
• Reconnaissance
• Scanning
• Gaining access
• Maintaining access
• Covering tracks
We have security exposures as a threat in networks, in terms of privacy, data integrity, authenticity, covert channels, impersonating, eavesdropping and denial of service. Packet replay is another network threat, which refers to recording and retransmitting of message packets in a network. Packet modification involves a system intercepting and modifying a packet destined for another system.
Network security controls consists of encryption, strong authentication, Kerberos and firewalls.
Encryption has two types being link encryption and end-to-end encryption, SSH encryption
A firewall is an access control device that filters all network traffic (internal access and external services). There are four types of firewall being:
• Packet filter
• Circuit level proxy
• Stateful packet filter
• Application level proxy
There are many ways in configuring a firewall because third party software has them. Please visit the software manufacturer website for further details.
Internet Protocol security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream.
Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
Intrusion Detection System is a device or software tool that monitors activity to identify malicious or suspicious events.
IDS components include:
• Sensor to generate security events
• Console to monitor events and alerts and control the sensors
• Central engine that records logged by the sensors in a database and uses system rules to generate alerts from security events received
Types of IDS include:
• Signature-based IDS
• Heuristic-based IDS
Limitations of IDS:
• Compensating for weak or missing security mechanisms in the protection infrastructure.
• Instantaneously detecting, reporting, and responding to an attack, when there is a heavy network or processing load.
• Detecting newly published attacks or variants of existing attacks
• Effectively responding to attacks launched by sophisticated attackers
• Automatically investigating attacks without human intervention.
• Resisting attacks that are intended to defeat or circumvent them
• Compensating for problems with the fidelity of information sources
• Dealing effectively with switched networks

Lab 5 Application Security

In this lab, we are focusing on security in web applications. We should be able to describe the flaw of web application and its exploitation, exploit web applicaion vulnerabilities, as well as explaining the prevention methods that can be taken to overcome web application vulnerabilities.
We have been introduced on the Open Web Application Security Project (OWASP), an open community focusing on improving the security of application software. Free materials are provided, such as articles on secure programming, security testing guide, and much more. So, join in the OWASP community at http://www.owasp.org
We have also being exposed with the usage of WebGoat and WebScarab. WebGoat is basically a simulation toolkit used to demonstrate how to exploit the vulnerabilities of a poorly designed web application. WebGoat is designed with the J2EE framework for convenience of users in understanding security issues by applying security knowledge they have into exploting a real vulnerability in WebGoat application.
Along with this simulation tool there is the WebScarab, a tool for anyone who needs to expose the workings of an HTTP(S) based application, whether to allow developers to debug application problems, or to allow a security specialist to identify vulnerabilities in such a way that the application has been designed or implemented.
In our first task, we did a hacking simulation using WebGoat and WebScarab.
For more information on how to use WebScarab and WebGoat
http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
and
http://yehg.net/lab/pr0js/training/webgoat.php

Cross-side scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into webpages viewed by other users. An exploited XSS vulnerability can be used by hackers to bypass access controls.
Several steps in preventing XSS include:
Input validation
Strong output encoding
Specify the output encoding
Do not use "blacklist" validation
Watch out for canonicalization errors

We also learned how to do an XSS attack. The basic idea is to apply a script such as shown below to create a false login page so that you can harvest the username and password keyed in by the user.



Script Example


Phishing with XSS

The script is then pasted on the above screen. A login page will be created using the Javascript page above. User then logs in with username and password. The username and password will be send across the world to a server that gathers login information.

The next thing we've learnt is about the injection flaws. This flaw allows attackers to relay malicious code through a web application to another system. Various attacks include calls to the operating system via system calls, the use of external programs via shell commands, as well as calls to backend databases via SQL ( or referred to as SQL injection).



The example PHP code shown above can be manipulated by entering



in which it returns all the data from the User Table.
To learn more about injection flaws, please visit http://www.owasp.org/index.php/Injection_Flaws

Malicious File execution is another web application vulnerabilities caused by failing to control application input. In this attack, attacker will exploit the weaknesses by performing
Remote code execution
Remote root kit installation and complete system compromise
On Windows, internal system compromise may be possible through the use of PHP’s SMB file wrappers

This vulnerability can be prevented by:-
• Strongly validate user input using "accept known good" as a strategy
• Add firewall rules to prevent web servers making new connections to external web sites and internal systems. For high value systems, isolate the web server in its own VLAN
or private subnet
• Check user supplied files or filenames cannot obviate other controls, such as tainting data in the session object, avatars and images, PDF reports, temporary files, and so on
• Consider implementing a chroot jail or other sand box mechanisms such as virtualization to isolate applications
from each other
PHP: Disable allow_url_fopen and allow_url_include in
php.ini and consider building PHP locally to not include this functionality. Very few applications need this functionality
and thus these settings should be enabled on a per
application basis
• PHP: Disable register_globals and use E_STRICT to find
uninitialized variables
• PHP: Ensure that all file and streams functions (stream_*)
are carefully vetted

Lecture 5 Database Security

In this lecture Encik Mohd Zaki covered on the security which focuses on the database domain. It is very essential to secure data in the database, considering that information is a very valuable asset in enterprise companies. People actually wants ro secure confidential information from hackers, as well as from legal parties, to restrict and deny unauthorized access. The basic database concepts had also been covered in this lecture such as database, DBA and DBMS. A database offers many advantages over a simple file system, such as shared access, minimal data redundancy, data consistency, data integrity, and controlled user access. 

Basically there are four levels of enforcing database security that we should know about. This includes the physical security, OS security, DBMS security, and data encryption. The first three levels of security are not satisfatory in providing solutions to security issues because of the following:

• Difficulty of controlling the disclosure of raw data

• Invalid to control the disclosure of sensitive data

• Hard to control the disclosure of confidential data in a distributed database system.

• Hard to verify that the origin of a data item is authentic.

Therefore, using data encryption is appropriate at this point, which eliminates data disclosure. Besides that, intruders are unable to alter ciphertext without encryption key, which means data integrity is preserved.

A database must achieve a level that users are able to trust the accuracy of data values. In accordance to that, data must be protected from corruption from outside influences. Updates from authorized-only individuals are necessary. Backing up is easiest way of protecting data.

With means of maintaining element integrity, the DBMS does the following:

• Field checks

• User access control

• Changelogs

Auditability is essential in a database, which involves the trailing user transactions with the database, but trailing all accesses is impractical. The audit trail includes the access at the record, field and element levels. There seems to be a possibility that auditability can be done over reporting, but what if some data problems are ignored and not reported?

Access control for database is almost similar to the OS access control, except that there are more complicated database problems when dealing with records and fields. This type access control concerns with inference of one field from another.

The DBMS can require rigorous user authentication. The DBMS usually runs an application on top of the OS. This system design implies that there is no trusted path from the DBMS to the operating system. With this, the DBMS is forced to do its own authentication.

There are problems in availability of data for multiple users that accesses the database. There is a need for arbitration of two users' request for the same record inside a database. Or in any case that the DBMS may withhold non-protected data to avoid revealing protected data.

A DBMS usually suffers the failure of the computing system in the middle of modifying data. So, a solution to that is the two-phase update. The first phase involves the intent phase (DBMS gathers resources to perform update) and the commit phase(writing a commit flag to the database). The second phase would be making permanent changes. Actions before the commit phase cannot be repeated, but the updates of phase two can be repeated. Data repair can also be done in the second phase, in case that the system fails during the second phase and the database consequently contains incomplete data.

The DBMS also maintains additonal information in detecting internal data inconsistencies Types of additonal information include:

• Error Detection and Correction Codes

-Parity Checks

-Cyclic Redundancy Checks (CRC)

-Hamming Codes

• Shadow Fields

  -Copy of entire attributes or records

  -Second copy as replacement

• Recovery

  -Backup

  -Changelogs

• Concurrency/Consistency

  -Simultaneous read

  -Modification requires one to be locked out

  -Query-update cycle as single uninterrupted operation

• Monitors

  -Range Comparison

  -State constraints

  -Transition constraints

Sensitive data is well defined as data that should not be made public. They are called that way because inherently and declared sensitive, they're of a sensitive record, not to mention sensitive in accordance to previously disclosed information.

The DBMS also makes decisions on whether to permit an access to a user, considering the following factors:

• Availability of data

• Assurance of authenticity

• Acceptability of access

Types of sensitive data disclosures includes:

• Exact data

• Bounds

• Negative result

• Existence

• Probable value

It is difficult to determine which data are sensitive and how to protect sensitive data. In the end, we need to achieve a balance in securing data in a precise manner.

Security vs Precision

Inference is how do you derive sensitive data from non-sensitive ones. The inference problem is a subtle vulnerability in database security.

There are ways to do direct and indirect attacks on a database. In a direct attack, one determines values of sensitive fields by seeking them directly with queries that yield a few records. The indirect attack infers a final result on one or more intermediate statistical results, but this approach requires work outside the database. To explain in specific, a statistical attack seeks to use some apparently anonymous statistical measure to infer individual data.

The controls for statistical attack includes suppression, concealing, limited response suppression, and combining results.

To conclude, three basic paths to controlling the inference problem are as follows:

• suppress obviously sensitive information

• track what the user knows

• disguise the data

Lab 4 Symmetric and Asymmetric Cryptography

In this lab we are focusing on understanding symmetric and asymmetric cryptography, as well as implementing Caesar Cipher, Vigenere Cipher and the RSA algorithm. 

As we all know that there are two types of encipherment in cryptosystems namely symmetric and asymmetric encipherment. Symmetric encipherment can be in the form of substitution, transposition or both. In substitution encipherment, alphabets in the plain text is replaced with another alphabetic character. There are two types of substitution namely monoalphabetic(eg. Caesar cipher) and polyalphabetic(eg. Vigenere cipher) substitution. The transposition encipherment changes the location of characters. Transposition can be either keyed or unkeyed. The asymmetric encipherment uses two keys, which are public key and private key, to encrypt and decrypt.

The Caesar Cipher is formed by shifting the letters of the original alphabet. The example of shift 3 Caesar Cipher is shown below:

plaintext alphabet A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

ciphertext key D E F G H I J K L M N O P Q R S T U V W X Y Z A B C

Cracking the Caesar ciphertext is easy by using brute-force cryptanalysis. The reasons of using the brute-force cryptanalysis are as follows:

• The encryption and decryption algorithms are known

• There are only 26 keys to try

• The language of the plaintext is known and easily recognizable. The pattern is obvious.

Considering that the Caesar ciphertext is easily broken by using the brute-force attack, the Vigenere cipher is introduced in order to improve the deciphering process. The Vigenere cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. Generally, a key is needed to encrypt a plaintext using Vigenere cipher, either using a word or a phrase. 

Vigenere Cipher

Asymmetric encipherment uses keypairs namely the public and private key for encryption and decryption. The public key is known to all but the private key is kept secret. The asymmetric keys are usually generated using the RSA algorithm. The following steps involving calculations are required:

1. Choose two distinct prime numbers, p and q

2. Compute n=pq

3. Compute totient(n) = (p-1)(q-1)
4. Choose an integer e such that  1
5. Determine d (using modular arithmetic) which satisfies the congruence relation  
6. Regarding encryption, if a person A transmits a public key of (c,e) to person B and keeps the private key secret, person B send a message M to person A. To encrypt message M, it is turned into an integer 0

   For decryption however, person A can recover m from c by using the calculation below:

   m=c^d (mod n)

Lecture 4 Operating System Security

In this lecture session, we were introduced on the operating system security. In OS security, there are six aspects that protection is necessary to be implemented on: 

• memory

• sharable I/O devices

• serially reusable I/O devices, such as printers and tape drives

• sharable programs and subprocedures

• networks

• sharable data

Separation is the basis of protection, which means to keep one user's objects separate from each other users. There are four types of separation process:

• Physical separation – different processes use different physical objects.

• Temporal separation – processes have different security requirements executed at different times.

• Logical separation – users operate under the illusion that no other processes exist, as when an OS constrains a program's accesses so that the program cannot access objects outside permitted domain.

• Cryptographic separation – processes conceal their data and computations in a way that they are unintelligible to outside processes.

A security mechanism can offer different levels of protection, such as:

• No protection at all

• Isolation

• Share all or share nothing

• Share via access limitation

• Share by capabilities

• Limit use of an object

The main concern of multiprogramming is preventing a program from affecting data and programs in other users' memory space. Aside from using system software to do all that, protection can also be built using hardware which controls efficient use of memory. Thus, solid protection can be provided at essentially no additional cost.

Methods used for memory protection include:

• fence

• relocation

• base/bound registers

• tagged architecture

• segmentation

• paging

• paging + segmentation

The fence is the simplest form of memory protection introduced in single-user operating systems to prevent a faulty user program from destroying part of the resident portion of the operating system. Two implementations of fence are the fixed fence which its memory address was predefined, and the fence register which uses a hardware register.

Relocation is the process of taking a program written as if it began at address 0 and changing all addresses to reflect the actual address at which the program is located in memory.

The variable fence register has the ability to relocate. This fence register has two kinds of registers namely base register which has the addresses offset from the base address in a program (the lower address limit), and the bound register is the upper address limit. With a pair of base/bound registers, a user is perfectly protected from outside users, or you should say that outside users are protected from errors in any other user's programs. However this is not quite effective because erronous addresses inside a user's address space can still affect a program. This problem is solved by adding another pair of base/bounds registers, one for instructions the second for the data space.

Due to the contiguous nature and the all-for-nothing sharing solution of base/bounds registers, the tagged architecture serves as an alternative, where in every word of machine memory has one or more access rights to that word. Operating system instructions has the privilege to set these access bits.

Another protection method is the segmentation, which involves the simple notion of dividing a program into separate parts that has logical unity – exhibits a relationship among all of its code. Segments can be separately relocated, allowing any segment to be placed in any available memoy locations. The security benefits of segmentation are:

• each address reference is checkec for protection

• many different classes of data items can be assigned different levels of protection

• two or more users can share access to a segment, with potentially different access rights

• a user cannot generate an address or access to an unpermitted segment

The paging method of protection divides programs into equal-sized "pages", and memory divided into equal-sized units called "page frames". In paging, all pages in the paging approach are of the same size, which makes fragmentation an ease, but the pages have no logical unity. A certain change to a program pushes all subsequent instructions to lower addresses andd moves a few bytes from the end of each page to the start of the next.

We see the benefits of paging and segmentation. By combining the two approaches, desirable features are utilized. This approach retains the logical unity of a segment and permitted differentiated protection for the segments, but it adds an additional layer of translation for each address. Plus, additional hardware improves the efficiency of the implementation.

In multiprogramming environments, there are a number of general objects that are necessary to be protected:

• memory

• a file or dataset on an auxiliary storage device

• a directory of files

• a hardware device

• a data structure, such as a stack

• a table of the operating system

• instructions, especially privileged instructions

• passwords and the user authentication mechanism

• the protection mechanism itself

Several goals in protecting objects would be:

• to check every user access to an object

• to enforce least privilege, meaning that a subject should have access to the least number of objects necessary to perform tasks.

• Verify acceptable usage, meaning that it is necessary to check that activities performed on objects are appropriate.

The simplest method of protecting objects is to use the file directory mechanism. With that, no user can be allowed to write in other user's file directory. Access rights for users can be set in file directories, such as allowing or restricting the read, write and execute command of users. This method is easy to implement because it uses one list per user. However the drawback of this method is that the list can become too large, eg many shared objects are accessible to all users.

Another method that can be used to protect objects is using the access control matrix, which uses a table where each row represents a subject, each column represents an object, and each entry is the set of access rights for the particular subject to the object. The example of access control matrix is shown below:

Access Control Matrix

Another protection method is using the access control list, in which there is one access control list assigned to the object.

                             Object1: {{A: OWR}, {B: R}, {C: R}, {D: R}}

                             Object2: {{A: R}, {B: OWR}, {C: R}, {E: R}}

                             Object3: {{A: OWR}}

                             Object4: {{B: OWR}, {*: WR}}

                             Object5: {{B: OWR}, {E: R}}

Access Control List

Basic forms of file protection mechanism are as follows:

• Allnone protection which assumes that all users can be trusted

• Group protection which separate all users into groups

We did see the drawbacks of the above file protection mechanisms, individual permissions can be set, such as passwords to protect individual files, shortfalls, and temporary acquired permission.

The authentication method of protection can take many forms, such as using passwords, identity badges, and the biometrics.

Lab 3 Authentication and Basic Cryptography

In this lab session, we were being explained about what is meant by authentication and cryptography. We are required to implement Data Encryption and Local Password Policy on Windows 2003 Server Edition. Aside from the operating system, we are required to implement asymmetric cryptography by using an encryption software called Pretty Good Privacy (PGP).

The basic idea of authentication is that when a subject claims that something or an identity is true, verification is necessary. So, authentication enables verifiers to gain confidence that claims are legitimate.

Cryptography is the science of hiding information in such a way that its meaning is not unintelliglble to an unauthorized person. Encryption is the process of encoding a message so that its meaning is not obvious while decryption is the reverse process. The common terms for encrypting and decrypting are encoding and decoding.

Cryptosystems use cryptography algorithms, which can be classififed into two categories being the symmetric and asymmetric encipherment. The sole difference that can distinguish symmetric and asymmetric algorithms is the number of keys used in the encryption and decryption process.

Data encryption can also be done using the NTFS. This encryption method is convenient for laptop users because their data stored in the hard drive is encrypted and secure, which makes their data secure and unreadble just in case their laptops are stolen and hacked.

Windows 2003 has a utility which makes it easy to encrypt files to an NTFS partition.

For information on how to encrypt files to an NTFS partition, please visit:

http://technet.microsoft.com 

Windows 2003 also has the local password policy setup for the password length. For suthentication in work environments, usernames and passwords are required. What is to be focused here is the password length because short passwords are easy to crack and guessable. With Windows 2000/2003, the local password policy allows you to specify the minimum length for passwords.

For more information on how to setup local password policy for password length, please visit:

http://technet.microsoft.com/en-us/library/cc781633(WS.10).aspx

The local password policy can also be set for complexity. The main focus here is the usage of various password characters such as letters, numbers and symbols. So, the local password policy can also specify password characters to be used.

For more information on how to set the local password policy for password complexity, please visit:

http://technet.microsoft.com/en-us/library/cc781633(WS.10).aspx

Windows 2003 has the utility of setting the account lockout polisy where this policy disables an account for a specific amount of time after a certain amount of failed login attempts.

For more information on how to set an account lockup policy, please visit:

http://technet.microsoft.com/en-us/library/cc781491(WS.10).aspx

For encryption and decryption of plaintext, we use the third party software called Pretty Good Privacy. PGP is referred to as a hybrid cryptosystem because it has the best features of both conventional and public key cryptography. With PGP,

For more information on how PGP works, please visit:

http://www.pgpi.org/doc/pgpintro/

Lecture 3 Program Security

In this lecture, we learnt about what it means by a secure program, malicious codes, and the web application vulnerabilities. Besides that, we had also touched on the measures on how to counter malicious code and vulnerabilities by applying software engineering principles and practices, and the protections against program flaws during execution.

From what I’ve understand from the lecture is that a secure program is defined by different perspectives of who is going to evaluate software quality. There are also a number of approaches in judging program security. This includes fixing faults by patching software after conducting penetration tests. There is no doubt that fixes might trigger more faults later results in software failures. There are flaws in software in the software market, but flaws are not the causes of faults followed by failures.

The common flaws that we see in programs are:

• validation error

• domain error

• serialization and aliasing

• inadequate identification and authentication

• boundary condtion violation

• other exploitable logic errors

Non-malicious program errors occur because of unintentional mistakes made by software developers, which causes malfunction. Examples of non-malicious program errors are buffer overflows, incomplete mediation (exposed and uncontrolled data), and Time of Check to Time of Use. These non-malicious program errors may lead to exploitation of malicious programmers, or commonly known as hackers. As I've said earlier in the ealier posts, with small amount of knowledge, a commoner can easily exploit unintentional program errors.

To describe buffer overflow, it is almost similar to attempting to pour two liters of water into a one-liter bottle. Incomplete mediation has something to do with manipulating exposed data such as date and time to cause errors (Note: Usually exposed and uncontrolled data exists in URLs). The Time-to-check to time-to-use flaw is pertaining to mediation that is performed with the "bait and switch" method in the middle, or further known as a serialization or synchronization flaw. It is possible that these three flaws can be combined together as a multistep attack to cause harm to a system.

This is why malicious programmers create malicious codes in order to cause harm or exploit a particular system. Furthermore, malicious codes have the ability to cause as much harm, as well as its prolonged existence, either created by accident or intended.

Types of malicious code that existed today are as follows:

Spywares are a new type of malicious/non-malicious code. It is a term for tracking software deployed without adequate notice, consent, or control for the user. Often the tracking is done by reporting information (anything from browsing history to credit-card or personal details) to a third party.

Below are the effects of viruses and causes:

Virus Effect	Causes
Attach to executable program	Modify file directory Write to executable program
Attach to data or control file	Modify directory Rewrite data Append to data Append data to itself
Remain in memory	Intercept interrupt by modifying interrupt handler address table Load self in non-transient memory area
Infect disks	Intercept interrupt Intercept operating system
Conceal self	Intercept system calls that would reveal self and falsify result classify self as "hidden" file
Spread infection	Infect boot sector Infect systems program Infect ordinary program Infect data ordinary program reads to control its execution
Prevent deactivation	Activate before deactivating program and block deactivation Store sopy to reinfect after deactivation

The above notes regarding malicious codes are anonymous codes that are not targeted to a specific system, application or a particular purpose. The main focus of the targeted malicious code are trapdoors and salami attack.

Trapdoors are undocumented entry point to a module. It is usually inserted by software developers during code development testing. Its initial purpose is to provide "hooks" by which to connect future modifications and enhancements, or basically to just allow access if the module should have future failures. Aside from its legitimate use, trapdoors allow a programmer access to a program once it is placed in production. The main causes of trapdoors includes programmer's forgetfulness of removing them, programmer's intention to leave them for testing, maintenance, and or later covert means of access.

As for the salami attack, this code merges bits of seemingly inconsequenial data to yield powerful results, for instance programs that often disregard small amounts of money in their interest computations.

The top ten web application vulnerabilities that we normally see in the world today are:

• Cross-site scripting

• Injection flaws

• Malicious file execution

• Insecure direct object reference

• Cross site request forgery

• Information leakage and improper error handling

• Broken authentication and session management

• Insecure crypto storage

• Insecure communications

• Failure to restrict URL access

There are a few aspects to control against program threats. We can see some signs that show that there are viruses within a system because they leave certain trails, however sometimes they can be very hard to detect because they can self-modify. A program scanner with a considerably good checksum can be used to detect changes in self-modifying codes.

Viruses may be invisible and hiding in large programs, compilers, database or file managers. The popular hiding place for viruses in within an attachment of emails or a public download file. A virus has phases to go through before it is fully activated – Dormant phase, propagation phase, triggering phase and execution phase.

For preventing virus infection, a system should have a virus detection and identification tool a.k.a. scanners. Removal tools are also essential to clean viruses. What I personally think is that a system should have an internet security package that has antivirus protection to actively protect files from infection. This protection mechanism should include real-time file system protection, document protection, email client protection and web access protection. Nevertheless, daily updates of virus definitions is necessary.

Other ways of preventing virus detection include using only well-known software, do software testing in an isolated PC, and not opening unknown email attachments. Besides that, backups are necessary too.