Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Learn more about the connected frameworks

12.2
ISO 27001

Haittaohjelmilta suojautuminen

12.2.1
ISO 27001

Haittaohjelmilta suojautuminen

8.7
ISO 27001

Protection against malware

DE.CM-4
NIST CSF

Malicious code detection

I09

Haittaohjelmasuojaus

Other tasks from the same security theme

Selection and use of malware detection software on all devices

Critical
High
Normal
Low

Centrally select and install malware detection and repair programs and update them regularly for preventive or regular scanning of computers and media.

Programs should check at least the following:

  • files received over the network or storage media are scanned for malware before use
  • email attachments and downloaded files are scanned for malware before use
  • websites are scanned for malware
I09: Haittaohjelmasuojaus
12.2.1: Controls against malware
ISO 27001
12.2: Protection from malware
ISO 27001
DE.CM-4: Malicious code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Automatically updating and running malware prevention software

Critical
High
Normal
Low

Malware protection systems automatically check for and install updates at desired intervals and also run the desired scans at the selected frequency without needed user actions.

12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
I09: Haittaohjelmasuojaus
DE.CM-4: Malicious code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Haittaohjelmasuojaus julkisista verkoista eristetyissä järjestelmissä (TL III)

Critical
High
Normal
Low

Haittaohjelmasuojauksen päivittämiseen on olemassa prosessi myös järjestelmille, joita ei ole kytketty kytketä julkiseen verkkoon. Haittaohjelmatunnisteiden päivitys voidaan järjestää esimerkiksi käyttämällä hallittua suojattua päivitystenhakupalvelinta, jonka tunnistekanta pidetään ajan tasalla esimerkiksi erillisestä internetiin kytketystä järjestelmästä tunnisteet käsin siirtämällä (esim. 1-3 kertaa viikossa), tai tuomalla tunnisteet hyväksytyn yhdyskäytäväratkaisun kautta. Tunnisteiden päivitystiheyden riittävyyden arviointi tulee suhteuttaa riskienarvioinnissa kyseisen ympäristön ominaispiirteisiin, erityisesti huomioiden ympäristön muun tiedonsiirron tiheyden.

Myös päivitysten eheydestä varmistumiseen tulisi olla ennalta suunniteltu menettelytapa (lähde, tarkistussummat, allekirjoitukset, jne.).

No items found.

Haittaohjelmasuojaus tietojärjestelmissä (TL IV)

Critical
High
Normal
Low

Organisaatio on tunnistanut tietojärjestelmät, joissa haittaohjelman torjuntaohjelmistoilla pystytään saamaan lisäsuojausta.

No items found.

Whitelisting

Critical
High
Normal
Low

Only software approved by your organization can run on devices. The organization must:

  • Actively approve software before deploying it
  • Maintain a list of approved software
  • Prevent users from installing non-approved software
No items found.

Blacklisting

Critical
High
Normal
Low

The malware protection software must block connections to malicious websites using deny listing for example. Not doing this is acceptable only if there is clear documented business need not to and the organisation fully understands and accepts the associated risks.

No items found.

Automatic website scan by malware protection software

Critical
High
Normal
Low

The malware protection software used by the organisation must be configured to automatically scan websites. The scan should be done when accessing a website.

No items found.

Automatic file scan by malware protection software

Critical
High
Normal
Low

The anti-malware software used by the organisation must be configured to automatically scan files. The scan should be done when a file is downloaded, opened and when it is opened from network storage.

No items found.

Disabling auto-run of software

Critical
High
Normal
Low

The organisation must make sure that all of it’s computers, networking equipment and other related devices have auto-run of software is disabled.

Auto-run can cause serious cyber attacks, like ransomware, to get into the organisation’s systems through downloaded software or compromised peripherals (e.g usb-stick).

No items found.

Laitteiden liityntöjen rajoittaminen (ST III-II)

Critical
High
Normal
Low

Vahvistaaksemme haittaohjelmilta suojautumiselta organisaatiomme on määritellyt lisätoimenpiteet korkeamman suojaustason tiedoille:

  • Arvioidaan tarve järjestelmien USB-porttien ja vastaavien liityntöjen käytölle.
  • Tilanteissa, joissa liityntöjen käytölle ei ole kriittistä tarkastelua kestävää perustetta, liitynnät poistetaan käytöstä.
  • Tilanteissa, joissa liityntöjen käytölle on kriittistä tarkastelua kestävät perusteet, arvioidaan tapauskohtaisesti edellytykset ja ehdot, minkä mukaisia laitteistoja ja välineitä (esim. USB-muisteja) järjestelmään voidaan kytkeä.
I09: Haittaohjelmasuojaus

Procedures and data sources for gathering reliable information about malware

Critical
High
Normal
Low

The organization has defined policies that regularly collect up-to-date and reliable information about malware. Such can be e.g. mailing lists, magazines, blogs from security software vendors, or security news sites.

The purpose of the data sources is to verify the information on malware, to distinguish the scams from real malware and to ensure that the warnings received are truthful and informative.

12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
ID.RA-2: Cyber threat intelligence
NIST CSF
8.7: Protection against malware
ISO 27001

Regular malware inspection of data systems supporting critical business processes

Critical
High
Normal
Low

The data systems (and their content) that support critical business processes are regularly reviewed to locate malware. All unauthorized files and changes will be formally investigated.

12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
PR.DS-6: Integrity checking
NIST CSF
DE.CM-4: Malicious code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Detecting and blocking access to dangerous websites

Critical
High
Normal
Low

The organization must identify the types of websites that staff should and should not have access to.

The organization must consider blocking access to the following types of sites (either automatically or by other means):

  • websites with a file upload function, unless this is permitted for a specific business need
  • known or suspected malicious websites (e.g. distributing malware or containing phishing content)
  • command and control servers
  • websites distributing illegal content
12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
8.7: Protection against malware
ISO 27001
8.23: Web filtering
ISO 27001

Protection of programs in the data processing environment from network attacks

Critical
High
Normal
Low

The security of the data processing environment is tested. Testing takes into account the appropriate level of security and the level of implementation, integration and configuration. Security must be taken care of throughout the entire life cycle of the environment.

At least the following should be considered here:

  • The purposes of use of the software (applications, services, systems) and the roles that may implement the security of the software have been identified.
  • The security needs of the software (applications, services, systems) have been assessed, taking into account in particular the intended use of the software and its possible role in implementing security, the attack surface area, and the nature and security class of the data being processed.
  • The software (applications, services, systems) dependencies and interfaces have been identified. Dependencies and interfaces have been assigned the same requirements as software, taking into account, for example, the used libraries, interfaces (APIs) and hardware bindings. The requirements take into account both the server-side and the client-side parts.
  • Critical software (applications, services, systems) is implemented or the implementation is checked as far as possible against a reliable standard and/or using safe programming guidelines.
  • It has been ensured that the software (applications, services, systems) program code quality maintenance, development and change management meet the needs throughout the entire life cycle.
  • It has been ensured that the software (applications, services, systems) meet the requirements derived from legislation.
No items found.

Instructing and training staff regarding malware

Critical
High
Normal
Low

The organization regularly trains staff on the use of utilized malware protection, reporting malware attacks, and recovering from malware attacks.

12.2: Protection from malware
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
12.2.1: Controls against malware
ISO 27001
I09: Haittaohjelmasuojaus
8.7: Protection against malware
ISO 27001

Informing staff about new, relevant malware

Critical
High
Normal
Low

Ensuring staff security awareness is an important part of protection against malware. Because of this, staff are regularly informed of new types of malware that may threaten them.

12.2: Protection from malware
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
12.2.1: Controls against malware
ISO 27001
8.2 (MIL1): Increase Cybersecurity Awareness
C2M2

Automatic blocking and detecting of unauthorized software

Critical
High
Normal
Low

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs.

12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
DE.CM-5: Unauthorized mobile code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Use malware systems from multiple vendors

Critical
High
Normal
Low

We always use malware systems from multiple vendors to improve the likelihood of detecting malware.

12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
DE.CM-4: Malicious code detection
NIST CSF

Detecting unconfirmed mobile apps

Critical
High
Normal
Low

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs on mobile devices (e.g. smartphones, tablets).

12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001