Regular malware inspection of data systems supporting critical business processes

Centrally select and install malware detection and repair programs and update them regularly for preventive or regular scanning of computers and media.

Programs should check at least the following:

• files received over the network or storage media are scanned for malware before use
• email attachments and downloaded files are scanned for malware before use
• websites are scanned for malware

The organisation must determine what are the requirements for protection against malware. The following should be considered:

• Risk assessment
• Legal and regulatory requirements
• Business and operational needs
• Technology environment
• Budget and resources

The organisation must define and implement organisational measures for protection against malware based on the defined requirments.

Haittaohjelmasuojauksen päivittämiseen on olemassa prosessi myös järjestelmille, joita ei ole kytketty kytketä julkiseen verkkoon. Haittaohjelmatunnisteiden päivitys voidaan järjestää esimerkiksi käyttämällä hallittua suojattua päivitystenhakupalvelinta, jonka tunnistekanta pidetään ajan tasalla esimerkiksi erillisestä internetiin kytketystä järjestelmästä tunnisteet käsin siirtämällä (esim. 1-3 kertaa viikossa), tai tuomalla tunnisteet hyväksytyn yhdyskäytäväratkaisun kautta. Tunnisteiden päivitystiheyden riittävyyden arviointi tulee suhteuttaa riskienarvioinnissa kyseisen ympäristön ominaispiirteisiin, erityisesti huomioiden ympäristön muun tiedonsiirron tiheyden.

Myös päivitysten eheydestä varmistumiseen tulisi olla ennalta suunniteltu menettelytapa (lähde, tarkistussummat, allekirjoitukset, jne.).

Organisaatio on tunnistanut tietojärjestelmät, joissa haittaohjelman torjuntaohjelmistoilla pystytään saamaan lisäsuojausta.

Only software approved by the organization can be run on the devices. The organization should:

• Actively approve software before it is deployed
• Maintain a list of approved software
• Prevent users from installing unapproved software
• Create a list of separately allowed extensions
• Unauthorized extensions should be blocked

The malware protection software must block connections to malicious websites using deny listing for example. Not doing this is acceptable only if there is clear documented business need not to and the organisation fully understands and accepts the associated risks.

The malware protection software used by the organisation must be configured to automatically scan websites. The scan should be done when accessing a website.

The anti-malware software used by the organisation must be configured to automatically scan files. The scan should be done when a file is downloaded, opened and when it is opened from network storage.

The organisation must make sure that all of it’s computers, networking equipment and other related devices have auto-run of software is disabled.

Auto-run can cause serious cyber attacks, like ransomware, to get into the organisation’s systems through downloaded software or compromised peripherals (e.g usb-stick).

Vahvistaaksemme haittaohjelmilta suojautumiselta organisaatiomme on määritellyt lisätoimenpiteet korkeamman suojaustason tiedoille:

• Arvioidaan tarve järjestelmien USB-porttien ja vastaavien liityntöjen käytölle.
• Tilanteissa, joissa liityntöjen käytölle ei ole kriittistä tarkastelua kestävää perustetta, liitynnät poistetaan käytöstä.
• Tilanteissa, joissa liityntöjen käytölle on kriittistä tarkastelua kestävät perusteet, arvioidaan tapauskohtaisesti edellytykset ja ehdot, minkä mukaisia laitteistoja ja välineitä (esim. USB-muisteja) järjestelmään voidaan kytkeä.

The organization has defined policies that regularly collect up-to-date and reliable information about malware. Such can be e.g. mailing lists, magazines, blogs from security software vendors, or security news sites.

The purpose of the data sources is to verify the information on malware, to distinguish the scams from real malware and to ensure that the warnings received are truthful and informative.

The data systems (and their content) that support critical business processes are regularly reviewed to locate malware. All unauthorized files and changes will be formally investigated.

The organization must identify the types of websites that staff should and should not have access to.

The organization must consider blocking access to the following types of sites (either automatically or by other means):

• websites with a file upload function, unless this is permitted for a specific business need
• known or suspected malicious websites (e.g. distributing malware or containing phishing content)
• command and control servers
• websites distributing illegal content

The security of the data processing environment is tested. Testing takes into account the appropriate level of security and the level of implementation, integration and configuration. Security must be taken care of throughout the entire life cycle of the environment.

At least the following should be considered here:

• The purposes of use of the software (applications, services, systems) and the roles that may implement the security of the software have been identified.
• The security needs of the software (applications, services, systems) have been assessed, taking into account in particular the intended use of the software and its possible role in implementing security, the attack surface area, and the nature and security class of the data being processed.
• The software (applications, services, systems) dependencies and interfaces have been identified. Dependencies and interfaces have been assigned the same requirements as software, taking into account, for example, the used libraries, interfaces (APIs) and hardware bindings. The requirements take into account both the server-side and the client-side parts.
• Critical software (applications, services, systems) is implemented or the implementation is checked as far as possible against a reliable standard and/or using safe programming guidelines.
• It has been ensured that the software (applications, services, systems) program code quality maintenance, development and change management meet the needs throughout the entire life cycle.
• It has been ensured that the software (applications, services, systems) meet the requirements derived from legislation.

Our organization has defined policies and measures to detect and prevent the usage of unauthorized hardware within the organization's network and infrastructure.

The organization implements a comprehensive strategy to block unauthorized scripts from executing by employing multiple security measures. These include the use of digital signatures to verify the authenticity of scripts, ensuring only signed by a trusted certificate authority are allowed to run.

The organization implements an allowlist for approved libraries by requiring digital signatures from trusted certificate authorities for all libraries.

The organization uses application whitelisting to ensure only approved libraries load and configures security policies to block unapproved libraries.

The organization configures anti-malware software to automatically scans a data transferred via removable media. This involves setting up the software to perform automatic scans on files when they are downloaded, opened, or accessed from network storage, including removable media like USB drives and other external storage devices. Any files transferred via these media are promptly scanned for malware before they can be utilized.

The protection of programs within the data processing environment is ensured by integrating and configuring features such as Microsoft Data Execution Prevention (DEP), Windows Defender Exploit Guard (WDEG), Apple System Integrity Protection (SIP), and Gatekeeper.

In parallel, system hardening is performed by adjusting settings and limiting systems to essential functionalities, thereby reducing potential vulnerabilities and aligning with anti-exploitation practices like those provided by DEP and WDEG.

The organization regularly trains staff on the use of utilized malware protection, reporting malware attacks, and recovering from malware attacks.

Ensuring staff security awareness is an important part of protection against malware. Because of this, staff are regularly informed of new types of malware that may threaten them.

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs.

We always use malware systems from multiple vendors to improve the likelihood of detecting malware.

Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs on mobile devices (e.g. smartphones, tablets).

The software that accompanies some documents (e.g. macros) also provides a large attack surface. To reduce this attack surface, one should remove unwanted software from external documents and emails before they reach the users, e.g. in the firewall, deactivate the option to run such software for users who do not need it, and explicitly allowlist software in documents that the users actually need, e.g. by using digital signatures.