Assessment Objective
Determine if:
- malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code.
- malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.
- malicious code protection mechanisms are updated as new releases are available in accordance with configuration management policy and procedures.
- malicious code protection mechanisms are configured to perform scans of the system [Assignment: frequency].
- malicious code protection mechanisms are configured to block malicious code, quarantine malicious code, or take other actions in response to malicious code detection.
- malicious code protection mechanisms are configured to perform real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed.
Assessment Methods
Examine
- system and information integrity policy and procedures
- configuration management policy and procedures
- procedures for malicious code protection
- records of malicious code protection updates
- system design documentation
- system configuration settings
- scan results from malicious code protection mechanisms
- record of actions initiated by malicious code protection mechanisms in response to malicious code detection
- system audit records
- system security plan
- other relevant documents or records
Interview
- personnel responsible for malicious code protection
- personnel with system installation, configuration, or maintenance responsibilities
- personnel with information security responsibilities
- system administrators
Test
- processes for employing, updating, and configuring malicious code protection mechanisms
- processes for addressing the detection of false positives and resulting potential impacts
- mechanisms for supporting or implementing, employing, updating, and configuring malicious code protection mechanisms
- mechanisms for supporting or implementing malicious code scanning and the execution of subsequent actions
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | 03.14.02 Malicious Code Protection |