ISO 27001 A.10.4.1 - Detecting, Preventing and Recovering from Malicious Code Threats

[Richard Regalado]

Implementing this control will help the implementing organization in detecting, preventing and recovering from threats borne from malicious code.

Malicious code - viruses, logic bombs, trojan horse, root kits, etc.

This is an example of a control where a technical solution (e.g. anti-virus software) should be augmented by non-technical activities (e.g. user awareness training). Because no matter how expensive your anti-virus software is, if users keep on opening attachments from unknown senders or downloading programs from web, your anti-virus software investment would not be enough.

Tips in implementing this control:

1. installation of anti-virus software and regular update of the virus definition files to regularly scan computers and associated media to includes files received over networks and from the web.

2. establishing regular awareness interventions (e.g. training, email blasts, reminders on the intranet, posters, etc.) to educate users against opening attachments from unknown users, using illegal software and other similar activities which may increase the likelihood of getting malicious code into the network

3. including in the regular reviews and audits; be in particular look-out for the presence of illegal files

4. having an approved policy for the use of authorized software

5. preparing a business continuity plan for recovery efforts from malicious code attacks

6. having an incident management procedure including allocation of roles and responsibilities to responders for malicious code attacks


What other techniques can you think of for the proper and effective implementation of this control? Feel free to share! Good day!

 

[JSambrook]

Re: ISO 27001 A.10.4.1 Malicious Code

You can firewall different areas of the organization so that if you do get a virus, the damage it can do is limited.

For example, have Finance on a network that is tightly firewalled off from Marketing. I think we all know those folks in Marketing are always picking up viruses from the different sites (ahem) they visit.

 

[Richard Regalado]

Re: ISO 27001 A.10.4.1 Malicious Code

You can firewall different areas of the organization so that if you do get a virus, the damage it can do is limited.

For example, have Finance on a network that is tightly firewalled off from Marketing. I think we all know those folks in Marketing are always picking up viruses from the different sites (ahem) they visit.

Excellent contribution JSambrook! Let's talk about network segregation more on another topic.

 

[pldey42]

Re: ISO 27001 A.10.4.1 - Detecting, Preventing and Recovering from Malicious Code Thr

Some more ideas:

Use multiple firewalls from different vendors, so that if a virus gets past one, another might stop it.

Make sure the virus scanners scan USB devices prior to enabling them (or disable USB).

For software that's written in-house (including scripts) include an inspection process alongside testing – it's hard to get a logic bomb past another programmer.

Constantly remind everyone not to open attachments unless they're darn sure they're good (and make sure the virus scanner scans them). Remember that some viruses come from known users, whose e-mail address book has been hijaked by a virus. So if you get an odd or unexpected attachment from someone you know, especially one claiming to be a joke or an interesting picture, call them before opening it.

Keep all the servers, desktop machines and laptops fully up to date with (tested) patches.

Harden the machines so that only authorized staff can install new or modified software.

Take sensitive servers and databases entirely off-line if possible, and restrict electronic access to them. Along the same lines, only keep information for as long as necessary.

Encrypt the databases so that if a virus phones information home, it's useless without the encryption keys.

Define help desk processes that enable staff to quickly identify a possible virus attack and close down (parts of) the network quickly in order to quarantine it. Make sure someone has the skills to identify infected computers and clean them, and – critically – can make sure the virus does not get into the backups (or if it has, locate uninfected backups).

Engage an ethical hacking organization to perform penetration tests regularly, not just on the IT controls but also using social engineering techniques to assure people are on their toes and won't, for example, take a USB stick from the nice man in the parking lot and plug it into a machine in exchange for a few pennies ...

As has been said, keep everyone aware. One person, one mistake, and precious information gets compromised – and the bad guys spend their time looking for that one person.

Or – use Linux!

Hope this helps,
Pat