On Drovorub: Linux Kernel Security Best Practices

McAfee summarizes the NSA/FBI advisory on Drovorub, a Linux kernel rootkit attributed to APT28, outlining that older kernels (<= 3.7) without module-signing enforcement are vulnerable, describing detection challenges and suggested forensic techniques (rootkit scanners, Volatility), and recommending mitigations including UEFI Secure Boot, kernel module signing, Linux Lockdown, sysctl hardening, and enabling SELinux/AppArmor.