[Introduction to Incident Handling and Response] Dan is a newly appointed information security professional in a renowned organization. He is supposed to follow multiple security strategies to eradicate malware incidents. Which of the following is not considered as a good practice for maintaining information security and eradicating malware incidents?

The fundamental principle of secure software management is to obtain applications exclusively from trusted and verified sources, such as official vendor websites or curated application stores. Advising against this practice is incorrect and dangerous. Options A, B, and C represent established best practices for user security hygiene. Avoiding downloads from untrusted third-party sources, refraining from clicking on unsolicited pop-ups (a common malvertising vector), and being cautious with executable file types are all critical steps in preventing malware infections. Therefore, the statement that is not a good practice is to avoid trusted sources.

A. Downloading from unverified third-party sources is a primary vector for malware distribution; avoiding this is a recommended security practice.
B. Web browser pop-ups are frequently used for malvertising, phishing, and drive-by-downloads, making avoidance a crucial security measure.
C. Files with executable extensions from unknown or untrusted sources are a common method for delivering malicious payloads; avoiding them is a good practice.

1. National Institute of Standards and Technology (NIST) Special Publication 800-83 Rev. 1

"Guide to Malware Incident Prevention and Handling for Desktops and Laptops."

Section 3.2.2

User Awareness and Training

Page 3-4: This section emphasizes that users should be trained to "not install or run software from unknown sources" and "not open suspicious email attachments

" which directly supports the validity of options A and C as good practices. The document implicitly supports using trusted sources by advising against unknown ones.

2. Cybersecurity and Infrastructure Security Agency (CISA)

"Security Tip (ST04-016): Avoiding Social Engineering and Phishing Attacks."

Section: What You Can Do to Avoid Being a Victim: This official guidance explicitly states

"Only download files from trusted sources." This directly contradicts option D

identifying it as poor security advice and thus the correct answer to the question.

3. Carnegie Mellon University

Software Engineering Institute

"Best Practices for Preventing and Responding to Malware."

Section: User Education

Page 7: The document highlights the importance of educating users to "be suspicious of unsolicited attachments

links

or files" and to "obtain software from trusted sources." This reinforces that options A

B

and C are good practices

while D is not.