Which of the following is NOT typically installed as a result of an infection?

A logic bomb is a piece of malicious code intentionally inserted into a system that remains dormant until a specific condition or trigger occurs. It is typically placed by an insider, such as a disgruntled employee, who already has authorized access to the system. Unlike the other options, its placement is a deliberate, pre-planned action and not typically the result of an external infection process, such as a virus or worm downloading a payload. The malicious action is triggered by an event (e.g., a specific date or the deletion of an employee's record), not by a separate infection.

A. Keylogger: Keyloggers are a common type of spyware, frequently installed as a payload by malware (the infection) to capture keystrokes and steal sensitive information like passwords.

B. Trojan: A Trojan is a type of malware that masquerades as legitimate software and serves as the infection vector itself. It is designed to deliver a malicious payload, such as a backdoor or keylogger.

D. Backdoor: A backdoor is a covert method for bypassing security, and it is very commonly installed on a system as a result of an infection by a Trojan or worm to provide persistent remote access.

1. National Institute of Standards and Technology (NIST) - Glossary:

Logic Bomb: "A piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met." This definition highlights the intentional insertion

characteristic of an insider threat

rather than installation via an external infection.

Trojan Horse: "A computer program that appears to have a useful function

but also has a hidden and potentially malicious function that evades security mechanisms..." This describes a primary infection vector.

Source: NIST Computer Security Resource Center (CSRC) Glossary

https://csrc.nist.gov/glossary/term/logicbomb and https://csrc.nist.gov/glossary/term/trojanhorse.

2. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education.

Chapter 2

Section 2.3

"Malicious Code

" describes a logic bomb as code that "triggers an action when a particular condition occurs... Often a disgruntled programmer plants a logic bomb." This academic text explicitly links logic bombs to insiders planting the code

distinguishing it from malware delivered through typical infection channels.

3. Whitman

M. E.

& Mattord

H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning.

In the chapter on "Software Development Security

" the text explains that logic bombs are often created by developers or administrators within an organization. This contrasts with Trojans

viruses

and worms

which are described in the "Malicious Software" chapter as primary methods of external attack and infection that install payloads like backdoors and keyloggers.