OPS.1.1.4 Protection Against Malware

A concept that describes which IT systems must be protected against malware MUST be drawn up. It MUST include IoT devices and production systems. Furthermore, it MUST be specified how protection is to be implemented. If no reliable protection is possible, the identified IT systems SHOULD NOT be operated. The concept SHOULD be documented in a comprehensible manner and kept up to date.

The protection mechanisms provided by the IT systems used, as well as by the operating systems and applications used on them, MUST be checked. Such mechanisms MUST be used unless there is at least an equal substitute or good reasons against their use. If they are not used, this MUST be explained and documented.

A program MUST be selected and installed for the specific purpose of virus protection depending on the operating system used, the other protection mechanisms present, and the availability of suitable virus protection programs. A suitable virus protection program MUST be selected and installed for gateways and IT systems used for data exchange.

The products used MUST be designed for enterprise environments and include services and support that are tailored to the needs of the organisation in question. Products for purely home-based users or products without manufacturer support MUST NOT be used for professional production operations.

Cloud services designed to improve the detection performance of virus protection programs SHOULD be used. If the cloud functions of such products are used, it MUST be ensured that there are no conflicts regarding data or confidentiality protection. In addition to real-time and on-demand scans, it MUST also be possible to scan compromised and encrypted data for malware with the solution chosen.

Virus protection programs MUST be configured appropriately for their operational environment. The focus SHOULD be on detection performance unless data protection or performance reasons influence this in individual cases. If the security-relevant functions of a virus protection program are not used, this SHOULD be explained and documented. In the case of protection programs that are specially optimised for desktop virtualisation, it SHOULD be transparently documented whether certain detection procedures have been omitted in favour of performance. Care MUST be taken to ensure that users are not able to make any security-related changes to the settings of anti-virus programs.

The scan engines and malware signatures of virus protection programs MUST be updated regularly and promptly on the corresponding IT systems.

Users MUST be informed regularly of the threats posed by malware. They MUST comply with the basic codes of conduct at hand to reduce the risk of malware infection. Files, e-mails, websites, and other content from untrusted sources SHOULD NOT be opened. Users MUST be aware of the appropriate persons to contact in the event of a suspected malware infection. Users MUST inform their designated contacts if they suspect an infection involving a malicious program.

The virus protection program used SHOULD block and report malware infections automatically. These automatic reports SHOULD be sent to a central location. The employees responsible SHOULD then decide how to proceed based on the current situation. The procedure to be followed in case of reports and alarms from virus protection programs SHOULD be planned, documented, and tested. In particular, the actions to be taken in case of a confirmed infection SHOULD be specified.

Automated analyses in a special test environment (based on sandboxes, or separate virtual or physical systems) SHOULD also be used for assessing suspicious data.

To improve detection performance, virus protection programs with several alternative scan engines SHOULD be used for IT systems that require special protection (e.g. gateways and IT systems for data exchange).

Before connecting storage media from third parties to the IT systems of an organisation, the media SHOULD be checked in a storage media lock.

If it is necessary to open untrusted files, this SHOULD only be done on an isolated IT system. In this system, the corresponding files SHOULD be converted into a secure format or printed (for example) if doing so will reduce the risk of a malware infection.

The use and added value of products and services that offer an extended scope of protection compared to conventional anti-virus programs SHOULD be examined. Security products like these SHOULD be used against targeted attacks, such as when running files in special analysis environments, hardening clients, or encapsulating processes. Before a decision is taken to purchase a particular security product, the effectiveness of its protection and its compatibility with the IT environment of the organisation in question SHOULD be tested.