END-04 Malicious Code Protection (Antimalware)

Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

END-04_A01 the frequency for malicious code scans is defined.
Defined parameters: at least weekly
Assessment rigor: 1
Origin: 171A_3.14.5[a] 53A_R5_SI-03_ODP[01] 53A_R5_SI-03_ODP[02]
END-04_A02 malicious code scans are performed with the defined frequency.
Defined parameters: at least weekly
Assessment rigor: 1
Origin: 171A_3.14.5[b]
END-04_A03 malicious code protection mechanisms are configured to perform real-time scans of files from external sources as the files are downloaded, opened or executed.
Assessment rigor: 1
Origin: 171A_3.14.5[c]
END-04_A04 designated locations for malicious code protection are identified.
Defined parameters: to include endpoints and network entry and exit points
Assessment rigor: 1
Origin: 171A_3.14.2[a]
END-04_A05 protection from malicious code at designated locations is provided.
Assessment rigor: 1
Origin: 171A_3.14.2[b]
END-04_A06 action to be taken in response to malicious code detection are defined.
Defined parameters: to include blocking and quarantining malicious code
Assessment rigor: 3
Origin: 53A_R5_SI-03_ODP[04] 53A_R5_SI-03_ODP[05]
END-04_A07 personnel or roles to be alerted when malicious code is detected is/are defined.
Defined parameters: administrator or defined security personnel, alerted in near real time
Assessment rigor: 3
Origin: 53A_R5_SI-03_ODP[06]
END-04_A08 malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code.
Assessment rigor: 2
Origin: 53A_R5_SI-03_ODP[01] 53A_R5_SI-03a.[01] 171A_R3_A.03.14.02.a[01]
END-04_A09 malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.
Assessment rigor: 2
Origin: 53A_R5_SI-03_ODP[04] 53A_R5_SI-03a.[02] 171A_R3_A.03.14.02.a[02]
END-04_A10 malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures.
Assessment rigor: 3
Origin: 53A_R5_SI-03b.
END-04_A11 malicious code protection mechanisms are configured to perform periodic scans of the system frequency.
Defined parameters: at least weekly
Assessment rigor: 3
Origin: 53A_R5_SI-03c.01[01]
END-04_A12 malicious code protection mechanisms are configured to perform real-time scans of files from external sources as the files are downloaded, opened or executed in accordance with organizational policy.
Assessment rigor: 3
Origin: 53A_R5_SI-03c.01[02]
END-04_A13 malicious code protection mechanisms are configured to respond to malicious code detection.
Assessment rigor: 3
Origin: 53A_R5_SI-03c.02[01] 53A_R5_SI-03_ODP[04]
END-04_A14 malicious code protection mechanisms are configured to send alerts to personnel or roles in response to malicious code detection.
Assessment rigor: 3
Origin: 53A_R5_SI-03c.02[02]
END-04_A15 the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed.
Assessment rigor: 3
Origin: 53A_R5_SI-03d.
END-04_A16 malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.
Assessment rigor: 3
Origin: 53A_R5_SI-03a.[02]
END-04_A17 malicious code protection mechanisms are configured to block malicious code, quarantine malicious code, or take other actions in response to malicious code detection.
Assessment rigor: 2
Origin: 171A_R3_A.03.14.02.c.02
END-04_A18 the frequency at which malicious code protection mechanisms perform scans is defined.
Defined parameters: at least weekly
Assessment rigor: 2
Origin: 171A_R3_A.03.14.02.ODP[01]

Ticket collegati

Collegamenti
Tipo di collegamento	Ticket
blocks	Malicious Code Protection (Antimalware)

Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.