Regular malware inspection of data systems supporting critical business processes

Centrally select and install malware detection and repair programs and update them regularly for preventive or regular scanning of computers and media.

Programs should check at least the following:

• files received over the network or storage media are scanned for malware before use
• email attachments and downloaded files are scanned for malware before use
• websites are scanned for malware

Malware protection systems automatically check for and install updates at desired intervals and also run the desired scans at the selected frequency without needed user actions.

The organisation must determine what are the requirements for protection against malware. The following should be considered:

• Risk assessment
• Legal and regulatory requirements
• Business and operational needs
• Technology environment
• Budget and resources

The organisation must define and implement organisational measures for protection against malware based on the defined requirments.

Haittaohjelmasuojauksen päivittämiseen on olemassa prosessi myös järjestelmille, joita ei ole kytketty kytketä julkiseen verkkoon. Haittaohjelmatunnisteiden päivitys voidaan järjestää esimerkiksi käyttämällä hallittua suojattua päivitystenhakupalvelinta, jonka tunnistekanta pidetään ajan tasalla esimerkiksi erillisestä internetiin kytketystä järjestelmästä tunnisteet käsin siirtämällä (esim. 1-3 kertaa viikossa), tai tuomalla tunnisteet hyväksytyn yhdyskäytäväratkaisun kautta. Tunnisteiden päivitystiheyden riittävyyden arviointi tulee suhteuttaa riskienarvioinnissa kyseisen ympäristön ominaispiirteisiin, erityisesti huomioiden ympäristön muun tiedonsiirron tiheyden.

Myös päivitysten eheydestä varmistumiseen tulisi olla ennalta suunniteltu menettelytapa (lähde, tarkistussummat, allekirjoitukset, jne.).

Organisaatio on tunnistanut tietojärjestelmät, joissa haittaohjelman torjuntaohjelmistoilla pystytään saamaan lisäsuojausta.

Vain organisaation hyväksymät ohjelmistot voidaan ajaa laitteilla. Organisaation on:

• Aktiivisesti hyväksyttävä ohjelmistoja ennen kuin niitä otetaan käyttöön
• Ylläpidettävä listaa hyväksytyistä ohjelmistoista
• Estettävä käyttäjiä asentamasta ei hyväksyttyä ohjelmistoa
• Luotava lista erikseen sallituista laajennuksista

The malware protection software must block connections to malicious websites using deny listing for example. Not doing this is acceptable only if there is clear documented business need not to and the organisation fully understands and accepts the associated risks.

The malware protection software used by the organisation must be configured to automatically scan websites. The scan should be done when accessing a website.

The anti-malware software used by the organisation must be configured to automatically scan files. The scan should be done when a file is downloaded, opened and when it is opened from network storage.

The organisation must make sure that all of it’s computers, networking equipment and other related devices have auto-run of software is disabled.

Auto-run can cause serious cyber attacks, like ransomware, to get into the organisation’s systems through downloaded software or compromised peripherals (e.g usb-stick).

Vahvistaaksemme haittaohjelmilta suojautumiselta organisaatiomme on määritellyt lisätoimenpiteet korkeamman suojaustason tiedoille:

• Arvioidaan tarve järjestelmien USB-porttien ja vastaavien liityntöjen käytölle.
• Tilanteissa, joissa liityntöjen käytölle ei ole kriittistä tarkastelua kestävää perustetta, liitynnät poistetaan käytöstä.
• Tilanteissa, joissa liityntöjen käytölle on kriittistä tarkastelua kestävät perusteet, arvioidaan tapauskohtaisesti edellytykset ja ehdot, minkä mukaisia laitteistoja ja välineitä (esim. USB-muisteja) järjestelmään voidaan kytkeä.

The organization has defined policies that regularly collect up-to-date and reliable information about malware. Such can be e.g. mailing lists, magazines, blogs from security software vendors, or security news sites.

The purpose of the data sources is to verify the information on malware, to distinguish the scams from real malware and to ensure that the warnings received are truthful and informative.

The data systems (and their content) that support critical business processes are regularly reviewed to locate malware. All unauthorized files and changes will be formally investigated.

The organization must identify the types of websites that staff should and should not have access to.

The organization must consider blocking access to the following types of sites (either automatically or by other means):

• websites with a file upload function, unless this is permitted for a specific business need
• known or suspected malicious websites (e.g. distributing malware or containing phishing content)
• command and control servers
• websites distributing illegal content

The security of the data processing environment is tested. Testing takes into account the appropriate level of security and the level of implementation, integration and configuration. Security must be taken care of throughout the entire life cycle of the environment.

At least the following should be considered here:

• The purposes of use of the software (applications, services, systems) and the roles that may implement the security of the software have been identified.
• The security needs of the software (applications, services, systems) have been assessed, taking into account in particular the intended use of the software and its possible role in implementing security, the attack surface area, and the nature and security class of the data being processed.
• The software (applications, services, systems) dependencies and interfaces have been identified. Dependencies and interfaces have been assigned the same requirements as software, taking into account, for example, the used libraries, interfaces (APIs) and hardware bindings. The requirements take into account both the server-side and the client-side parts.
• Critical software (applications, services, systems) is implemented or the implementation is checked as far as possible against a reliable standard and/or using safe programming guidelines.
• It has been ensured that the software (applications, services, systems) program code quality maintenance, development and change management meet the needs throughout the entire life cycle.
• It has been ensured that the software (applications, services, systems) meet the requirements derived from legislation.

Our organization has defined policies and measures to detect and prevent the usage of unauthorized hardware within the organization's network and infrastructure.

The organization regularly trains staff on the use of utilized malware protection, reporting malware attacks, and recovering from malware attacks.

Ensuring staff security awareness is an important part of protection against malware. Because of this, staff are regularly informed of new types of malware that may threaten them.

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs.

We always use malware systems from multiple vendors to improve the likelihood of detecting malware.

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs on mobile devices (e.g. smartphones, tablets).