6.9 Protection against malicious and unauthorised software

Requirement

The relevant entities shall protect their network and information systems against malicious and unauthorised software.

Requirement

For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response software, which is updated regularly in accordance with the risk assessment carried out pursuant to point 2.1 and the contractual agreements with the providers.

Guidance

• Employ mechanisms for detecting and protecting against malicious and unauthorised software at system entry and exit points and at workstations, servers and mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses or removable media or inserted through the exploitation of system vulnerabilities.
• Configure malicious code protection mechanisms to:
  • be active all the time;
  • perform periodic scans of the system regularly and real-time scans of files from external sources as the files are downloaded, opened or executed;
  • generate notifications when suspected malicious and unauthorised software is detected;
  • disinfect and quarantine infected files; and
  • restore system settings and ensure that critical settings cannot be disabled or restricted.
• Apply application whitelisting and monitor unauthorised activities and system behaviour, where appropriate.
• Make sure that the malicious and unauthorised protection mechanisms are centrally managed, where appropriate.
• Make sure that there are mechanisms that prevent users from circumventing malicious and unauthorised software protection capabilities.
• Make sure that spam protection mechanisms are employed at system entry points such as workstations, servers or mobile computing devices on the network.
• Update malicious code protection mechanisms (including signature definitions) whenever new releases are available in accordance with configuration rules and the entity’s patch management procedures.
• Address issues related to false positives during malicious code detection and eradication and the resulting potential impact on system availability.
• Align rules for monitoring and logging malicious and unauthorised detection and repair software with the entity’s monitoring and logging tools and procedures (Annex to the regulation, point 3.2) and with the entity’s access control (Annex to the regulation, point 11.1) and asset-handling policy.

Examples of evidence

• Endpoint protection systems (EPS), such as endpoint protection platform (EPP) and endpoint detection and response (EDR), across the network.
• Malware detection system present and up to date.
• Tools for monitoring unauthorised software is in place and up to date.
• Firewall configurations, IDS/IPS and secure web gateways containing malicious and unauthorised software protection measures.
• Use of whitelisting solutions, which restrict the execution of non-approved software and code.
• Rules and configurations related to application whitelisting up to date.
• Documented description of centrally managed tools.
• Records of recent updates of mechanisms for detecting and protecting against malicious/unauthorised software showing that they are regularly patched and updated to protect against known vulnerabilities.
• Records of periodic scans.
• Monitoring and logging of network and information systems, at intervals to identify malicious code and unauthorized code execution.
• Logs of blocked or detected threats.
• Logs recorded and maintained covering:
  • user activities;
  • exceptions; and
  • information security incidents.
• Documented spam protection mechanism.
• Risk assessment to determine the level of logs monitoring required.

Tips: guidance

• Consider that the use of malicious and unauthorised detection and repair software alone is not usually adequate or may not be available, so it should be complemented by additional measures such as (indicative, non-exhaustive list):
  • implementing rules and measures that prevent or detect the use of unauthorised software;
  • implementing measures that prevent or detect the use of known or suspected malicious websites;
  • reducing vulnerabilities that can be exploited by malicious software;
  • controlling the running of applications on user workstations or user end devices (including smartphones or tablets);
  • employing web application filters to reduce exposure to malicious content.
• Consider email filters as essential tools for detecting and blocking malicious and unauthorised software. Different types of filter are (indicative, non-exhaustive list):
  • content filter;
  • blocklist filter;
  • antivirus filter;
  • phishing filters; and
  • machine learning filters.

Tips: examples of evidence

• Documented alternative countermeasures such as:
  • securing all physical and logical data interfaces;
  • network isolation and implementation of segmented network security zones that limit the impact of a malicious software incident;
  • comprehensive system-hardening measures to minimise the risk of malicious software incidents.
  • logs confirming that administrative privileges are controlled and monitored.
• Logs from email filters.