Questions: A security analyst has discovered a workstation infected with malware that has spread to other systems on the network. The analyst has determined that they cannot easily remove the malware and that re-imaging the workstation is necessary. However, the workstation has important data that the analyst has not backed up. After re-imaging the infected workstation, what is the best practice to prevent future malware infections?

The answer is the second one: Implement a security policy that prohibits downloading unauthorized software.

Explanation for each option:

• Disable USB ports on all workstations: While this can prevent certain types of malware that spread via USB devices, it is not a comprehensive solution. Malware can still enter the network through other means, such as email or internet downloads.

• Implement a security policy that prohibits downloading unauthorized software: This is a proactive measure that addresses a common vector for malware infections. By restricting the download and installation of unauthorized software, the organization can significantly reduce the risk of malware entering the network.

• Install anti-virus software on all workstations: This is an important step in detecting and removing malware, but it is reactive rather than preventive. Anti-virus software can help mitigate infections but may not catch all threats, especially new or sophisticated ones.

• Educate end-users on safe browsing and email practices: User education is crucial for preventing malware infections, as many infections occur due to user actions. However, education alone is not sufficient without supporting policies and technical controls.

Summary: The best practice to prevent future malware infections is to implement a security policy that prohibits downloading unauthorized software. This approach addresses a common entry point for malware and, when combined with other measures like user education and anti-virus software, can significantly enhance the organization's security posture.