A.8.7 Protection against Malware would include:
-
Anti-Malware Software: Documentation of the use of reliable anti-malware software on all endpoints, servers, and network devices within the organization's IT infrastructure.
-
Anti-Malware Configuration: Evidence of appropriate configurations for anti-malware software, including scheduled scans, automatic updates, and real-time monitoring.
-
Malware Incident Reports: Records of any detected malware incidents, including the actions taken to contain and mitigate the impact of malware infections.
-
Malware Detection and Prevention Logs: Logs and reports from anti-malware software that provide details of detected malware, quarantine actions, and blocked threats.
-
Regular Malware Scanning: Evidence of regular malware scans conducted on all systems to identify and remove any malware infections.
-
Employee Training: Records of security awareness training provided to employees to educate them about the risks of malware and safe practices to prevent malware infections.
-
Incident Response Plans: Documentation of incident response plans that include procedures for responding to malware incidents, including containment, eradication, and recovery.
-
Patch Management: Evidence of a robust patch management process to ensure that operating systems, applications, and software are up-to-date, reducing the risk of vulnerabilities exploited by malware.
-
Network Segmentation: Documentation of network segmentation measures to prevent the spread of malware from one part of the network to another.
-
Regular Security Updates: Records of security updates applied to firewalls, intrusion detection/prevention systems, and other security devices to enhance malware protection.
-
Email Filtering: Evidence of email filtering solutions in place to detect and block malware-laden attachments and malicious links.
-
Incident Monitoring: Logs and reports from security monitoring systems that track malware-related events and potential intrusion attempts.
-
Third-Party Security Assessments: Evidence of periodic security assessments and audits of third-party vendors and suppliers to ensure their systems are also protected against malware.
These pieces of evidence to assess the effectiveness of the organization's measures for protecting against malware threats. This includes evaluating their ability to prevent, detect, and respond to malware incidents to safeguard sensitive data and maintain the integrity of their IT environment.
