Selection and use of malware detection software on all devices

Critical
High
Normal
Low

Centrally select and install malware detection and repair programs and update them regularly for preventive or regular scanning of computers and media.

Programs should check at least the following:

  • files received over the network or storage media are scanned for malware before use
  • email attachments and downloaded files are scanned for malware before use
  • websites are scanned for malware
Connected other frameworks and requirements:
I09: Haittaohjelmasuojaus
12.2.1: Controls against malware
ISO 27001
12.2: Protection from malware
ISO 27001
DE.CM-4: Malicious code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Automatically updating and running malware prevention software

Critical
High
Normal
Low

Malware protection systems automatically check for and install updates at desired intervals and also run the desired scans at the selected frequency without needed user actions.

Connected other frameworks and requirements:
I09: Haittaohjelmasuojaus
12.2.1: Controls against malware
ISO 27001
12.2: Protection from malware
ISO 27001
DE.CM-4: Malicious code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Procedures and data sources for gathering reliable information about malware

Critical
High
Normal
Low

The organization has defined policies that regularly collect up-to-date and reliable information about malware. Such can be e.g. mailing lists, magazines, blogs from security software vendors, or security news sites.

The purpose of the data sources is to verify the information on malware, to distinguish the scams from real malware and to ensure that the warnings received are truthful and informative.

Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
ID.RA-2: Cyber threat intelligence
NIST CSF
8.7: Protection against malware
ISO 27001

Regular malware inspection of data systems supporting critical business processes

Critical
High
Normal
Low

The data systems (and their content) that support critical business processes are regularly reviewed to locate malware. All unauthorized files and changes will be formally investigated.

Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
PR.DS-6: Integrity checking
NIST CSF
DE.CM-4: Malicious code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Detecting and blocking access to dangerous websites

Critical
High
Normal
Low

The organization must identify the types of websites that staff should and should not have access to.

The organization must consider blocking access to the following types of sites (either automatically or by other means):

  • websites with a file upload function, unless this is permitted for a specific business need
  • known or suspected malicious websites (e.g. distributing malware or containing phishing content)
  • command and control servers
  • websites distributing illegal content
Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
8.7: Protection against malware
ISO 27001
8.23: Web filtering
ISO 27001

Instructing and training staff regarding malware

Critical
High
Normal
Low

The organization regularly trains staff on the use of utilized malware protection, reporting malware attacks, and recovering from malware attacks.

Connected other frameworks and requirements:
I09: Haittaohjelmasuojaus
12.2.1: Controls against malware
ISO 27001
12.2: Protection from malware
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
8.7: Protection against malware
ISO 27001

Automatic blocking and detecting of unauthorized software

Critical
High
Normal
Low

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs.

Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
12.2.1: Controls against malware
ISO 27001
DE.CM-5: Unauthorized mobile code detection
NIST CSF
8.7: Protection against malware
ISO 27001

Training the use of security systems and reporting of malware attacks

Critical
High
Normal
Low

Our organization has defined procedures and responsibilities for protecting systems from malware and trains staff to use the protections and to report and recover from malware attacks.

Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
12.2.1: Controls against malware
ISO 27001
8.7: Protection against malware
ISO 27001
No items found.