The firewall log contains an alert message at 14:03:19 on Dec 1 identifying the file invoice.exe originating from the IP address 81.161.63.253. The file integrity monitoring report confirms that invoice.exe was added to a user's downloads folder at 14:03:55. Furthermore, the malware domain list explicitly lists 81.161.63.253 as a known malicious host. The firewall alert is the earliest record of the malware entering the organization's network.

This incident follows a standard cyber-attack kill chain. The most effective control at each stage would be:

1. Phishing email: Email filtering is the primary control to detect and block malicious emails before they reach the user.
2. Active links: Converting emails to plain text email format removes clickable hyperlinks, forcing the user to manually copy and paste the URL, which reduces the risk of accidental clicks.
3. Malicious website access: An IP blocklist on the firewall would prevent any connection to known malicious IP addresses, such as the one identified in the malware domain list.
4. Malware download: A firewall file type filter can be configured to block the download of potentially malicious file types, like executables (.exe), from untrusted sources.
5. Malware install: The vulnerability scan noted that users had excessive privileges. Enforcing restricted local user permissions would prevent a standard user from installing unauthorized software.
6. Malware execution: If the malware is installed, an updated antivirus solution is the last line of defense to detect and quarantine the malicious process upon execution.
7. File encryption: In a worst-case scenario where the malware successfully encrypts files, having reliable backups is the only way to restore the data and recover from the attack.

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. (Discusses email security gateways (filtering), access control based on user permissions, and the role of antivirus software in Ch. 9 and Ch. 21).

Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. (Covers principle of least privilege, corresponding to restricted permissions, and describes firewall filtering policies in Ch. 8).

Kim, D., & Solomon, M. G. (2016). Fundamentals of Information Systems Security (3rd ed.). Jones & Bartlett Learning. (Details layered security and defense-in-depth, illustrating how controls like IP blocking, file filtering, and backups function at different stages of an attack).