Preventing reinfection, and the handful of controls that actually hold

Why this matters

A machine that has been cleaned is a machine in exactly the state it was in before it was infected — same software, same user, same habits, same route in. Prevention is what changes that, and it is the point at which a technician stops treating symptoms.

This lesson is the security domain's capstone because prevention uses all of it: patching from the update lesson, least privilege from the accounts lesson, the browser settings, the network hardening, and the education from the social engineering lesson. It is also where the honest ranking matters, because the controls people spend money on are not the ones that prevent the most.

The lesson

Patching, which prevents more infections than any product does

Patching prevents more compromises than any product a technician can install, and it is worth being blunt about the ranking because it is counter-intuitive.

The overwhelming majority of successful attacks on ordinary machines use vulnerabilities for which a patch already existed, often months earlier. The attacker did not find anything; they used something published, against a machine that had not applied the fix.

What to patch, in order of how often it matters:

• The operating system, monthly and promptly.
• The browser, which updates itself and only completes the update when it is restarted — a browser left open for three weeks is an unpatched browser.
• Document readers, runtimes and plug-ins, which are attacked heavily and update least reliably.
• Anything with a network service — remote access tools, media servers, file sharing.
• Firmware on network equipment, which is the hardening lesson's point and is almost never done.

And the case where patching is not available: software whose vendor has stopped issuing updates. There is no configuration that makes that safe. The options are replacement, or isolation — no internet access, on its own network segment, with the risk accepted explicitly by someone entitled to accept it. That is a legitimate answer for an instrument or a machine tool and it is not a legitimate answer for a workstation someone reads mail on.

Least privilege, application allow-lists, and macro settings

Three controls that cost nothing and stop a large proportion of what patching does not.

Least privilege. Daily work in a standard account. Something hostile that runs as a standard user can damage that user's files and cannot install a driver, disable protection, create a service, or reach other users. This single change converts most infections from a machine compromise into a file problem, and it is the most valuable configuration decision in this whole domain.

Application allow-listing. Only approved software runs. In its full form this is an enterprise control needing real administration; in its practical form it is available to anyone — Windows can be set to allow only store applications or to warn about everything else, and macOS ships with a comparable control enabled by default. For a machine with a defined job, this is extremely effective.

Macro settings. Macros in documents from the internet are a long-standing delivery route, and the defaults have tightened for exactly that reason. The settings worth confirming: macros disabled by default, documents from the internet opened in protected view, and no blanket exception for a shared folder. The failure to avoid is a user who was told once to click "enable content" and now does it reflexively.

Two more in the same category: turn off autorun for removable media, and make file extensions visible, so invoice.pdf.js looks like what it is.

Endpoint protection: what it catches, what it misses, and configuring it once

Endpoint protection is necessary and is not the centre of a defence, and being clear about what it does is part of configuring it well.

What it catches: known malicious files by signature, which is most of the high-volume commodity threats; suspicious behaviour, which catches some novel things; and known-bad network destinations.

What it misses: anything new enough not to be known, anything living in memory or in legitimate system tools rather than as a file, anything delivered by a person being persuaded rather than by a file, and — the important category — anything that arrives as a legitimate remote access tool the user was talked into installing.

Configuring it once, properly:

• Real-time protection on, definitions updating automatically.
• A scheduled full scan at a time the machine is actually on.
• Tamper protection enabled, so it cannot be disabled by something running on the machine.
• Alerts going somewhere a person reads. An alert nobody sees is not a control.
• One product. Two real-time scanners interfere with each other and produce a slower machine with no additional coverage.

And the built-in question: on Windows, the included protection is competent, free, well integrated and tamper-resistant. For most machines it is the right answer, and a paid product is worth it for central management and reporting rather than for detection alone. A technician who installs a third-party product by reflex should be able to say what it adds.

Email and web filtering as the two doors most infections arrive through

Almost everything arrives through mail or the web, so the two filters are where prevention has the most leverage.

Mail filtering does several distinct jobs, and knowing which is which helps:

• Attachment control — blocking executable and script attachments outright. This is crude and extremely effective.
• Link rewriting — checking a link at the moment it is clicked rather than at delivery, which catches pages that turn hostile after sending.
• Sender authentication — SPF, DKIM and DMARC, which make it much harder to forge a domain. A technician does not usually configure these and should know what a failure means.
• Impersonation detection — flagging messages whose display name matches someone internal but whose address does not. This is the control against business email compromise.
• External-sender banners, which sound trivial and measurably help.

Web filtering is mostly DNS-based on a small network, and the hardening lesson covers what it can and cannot do. Its most valuable function here is not content control but blocking known-malicious domains, which stops a large share of drive-by and command-and-control traffic at no cost to anybody.

The gap worth naming: neither filter helps when the user is persuaded to do something on a legitimate service — a real cloud storage link, a real payment page, a real remote support tool. That gap is exactly the size of the next section.

User education that works, and the training that only produces resentment

Training has a bad reputation because most of it is bad. It is also the only control that addresses the gap the technical controls leave.

What works:

• Specific and recent. "This message went to fourteen of us on Tuesday, here is what gave it away" beats any annual module.
• Short and frequent, rather than an hour once a year.
• Teaching one habit: verify through a channel you chose. That single behaviour defeats phishing, vishing, smishing and most fraud, and it is something a person can actually do under pressure.
• Making reporting easy and safe. A reporting button, a known address, and a culture where reporting a mistake is met with thanks. Reporting speed is the largest factor in how bad an incident gets.
• Including the people with the most access, which is usually the technicians and the executives, and is usually where the exceptions get made.

What produces resentment and nothing else:

• Blame, publicly or privately. It suppresses reporting, which is the opposite of the goal.
• Punitive simulated phishing used as a performance measure. Simulations are useful for measuring the organisation and destructive when used against individuals.
• Obsolete advice — spelling mistakes, padlocks, "never write a password down" — which teaches people to look for signals that no longer exist and to trust messages that lack them.
• Modules that cannot be applied on Monday.

And the technician's own version of all this: be the person who makes it easy to report, who explains what happened without condescension, and who says the specific thing that would have helped. That is prevention too, and it is the part of it that is entirely within your control.