Chapter 6 — Protection software
Lesson map
Lesson 06 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Built-in protection"]
N2["6.2 Checking status"]
N3["6.3 Tamper protection"]
N4["6.4 Responding to alerts"]
N5["Scans, performance and quarantine"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Built-in protection"]
N2["6.2 Checking status"]
N3["6.3 Tamper protection"]
N4["6.4 Responding to alerts"]
N5["Scans, performance and quarantine"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX021"]
[Learning outcomes]
|
v
[6.1 Built-in protection]
|
v
[6.2 Checking status]
|
v
[6.3 Tamper protection]
|
v
[6.4 Responding to alerts]
|
v
[Scans, performance and quarantine]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) check antivirus status; (2) understand tamper protection; (3) respond to alerts.
6.1 Built-in protection
Microsoft Defender Antivirus is built into Windows and is enough for many small offices when kept updated and managed centrally. It scans files, watches behaviour and checks downloads. The firm's supplier manages it from a cloud console showing every PC's status. For a firm of thirty PCs, a built-in, centrally managed product avoids the cost and complexity of another tool. The console lets the supplier see when a PC stops reporting or finds a threat. Nadia's job is to check that every PC actually appears there.
6.2 Checking status
Nadia compares the console's list with the PC inventory and finds two PCs missing. One was rebuilt and never enrolled; the other had Defender turned off when a staff member installed a different free antivirus. Both are fixed and the free product removed. Comparing the console with the inventory finds PCs the console cannot show: one that never enrolled, and one whose protection was off. Running two antivirus products together can cause problems, which is another reason to remove the free product. Nadia records both fixes in the inventory, including the date the rebuilt PC was enrolled and the free antivirus was removed.
6.3 Tamper protection
Tamper protection stops users and programs from turning off Defender. The supplier enables it across all PCs. At Harlow & Pike, tamper protection would have stopped Defender being turned off when the free antivirus was installed. It also stops malware disabling protection after it arrives. Nadia confirms in the console that the setting is on for every PC, including the one that was rebuilt and never enrolled, which the supplier has now added. She adds tamper protection to the monthly console check, so a PC where it has been switched off is noticed within weeks.
6.4 Responding to alerts
When Defender blocks something, the alert appears in the console. Most are routine. If an alert says a threat was found but not removed, Nadia disconnects the PC from the network and tells the supplier immediately. Disconnecting first stops a threat spreading to the file server while the supplier investigates. Nadia records each serious alert with what she did and when. Routine alerts, such as a blocked download, are reviewed weekly with the supplier to check for patterns. Lena is phoned about any threat that was found but not removed, because she decides whether client work on that PC must stop.
Scans, performance and quarantine
Staff sometimes complain that antivirus slows their PC, which is why one turned it off before Nadia arrived. The supplier now schedules full scans for lunchtime and relies on real-time protection the rest of the day. Explaining this to staff removes the reason they turned protection off, which works better than relying only on tamper protection. Nadia also checks that protection updates arrive daily; a PC with old definitions is flagged. Blocked files go to quarantine, where they cannot run. Only the supplier may restore a quarantined file, after confirming it is safe, so a worried staff member cannot release something harmful by accident.
Worked example
The adware incident would now show as a blocked potentially unwanted application, because the supplier enables that protection setting.
Synthetic case. Events are synthetic.
Errors and limits
Installing a second antivirus usually causes conflicts and can disable the managed one.
Exercises
- EX021 — Coverage check. How do you find PCs without protection? Rubric: 3 = compare console with inventory;; 2 = console;; 1 = vague;; 0 = none.
- EX022 — Second antivirus. Why avoid installing a second antivirus? Rubric: 3 = conflicts, disables managed one;; 2 = conflicts;; 1 = vague;; 0 = none.
- EX023 — Unremoved threat. What do you do when a threat is not removed? Rubric: 3 = disconnect and tell supplier;; 2 = tell supplier;; 1 = ignore;; 0 = none.
- EX024 — PUA setting. Which Defender setting would have stopped the adware? Rubric: 3 = potentially unwanted application protection;; 2 = a setting;; 1 = vague;; 0 = none.
Synthesis
Managed, tamper-protected antivirus with a checked coverage list is a solid base.
Continue studying — chapter 06 of 18
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →