Protection from malware

The organization must identify the types of websites that staff should and should not have access to.

The organization must consider blocking access to the following types of sites (either automatically or by other means):

• websites with a file upload function, unless this is permitted for a specific business need
• known or suspected malicious websites (e.g. distributing malware or containing phishing content)
• command and control servers
• websites distributing illegal content

The organization has defined policies that regularly collect up-to-date and reliable information about malware. Such can be e.g. mailing lists, magazines, blogs from security software vendors, or security news sites.

The purpose of the data sources is to verify the information on malware, to distinguish the scams from real malware and to ensure that the warnings received are truthful and informative.

Our organization has defined procedures and responsibilities for protecting systems from malware and trains staff to use the protections and to report and recover from malware attacks.

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs on mobile devices (e.g. smartphones, tablets).

We always use malware systems from multiple vendors to improve the likelihood of detecting malware.

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs.

Ensuring staff security awareness is an important part of protection against malware. Because of this, staff are regularly informed of new types of malware that may threaten them.