ISO 27002:2022 8.7: Protection against malware

Malware protection is to be implemented and backed by appropriate user awareness. Purpose: protect information and associated assets from malware. Guidance: protection combines detection and repair software with awareness, suitable system access and change controls, since detection software alone is rarely enough. Consider: measures that stop or spot unapproved software, such as application allowlisting (8.19, 8.32); controls that prevent or detect visits to sites known or suspected to be malicious, such as blocklists; reducing vulnerabilities malware could exploit through vulnerability management (8.8, 8.19); regular automated validation of system software and data, especially for critical processes, investigating unapproved files or changes; protections against risks from obtaining files and software from or through external networks or other media; installing and keeping updated detection and repair software that scans computers and media, including scanning data received over networks or on media before use, scanning email and messaging attachments and downloads before use at several points such as mail servers, desktops and the network boundary, and scanning web pages when accessed; placing and configuring tools according to risk assessment, applying defence in depth (for example at network gateways for email, file transfer and web, and on endpoints and servers) and accounting for evasion such as encrypted files or encrypted transport; guarding against malware introduced during maintenance and emergency procedures that bypass normal controls; a process to authorize temporary or permanent disabling of protections, with approval authorities, documented justification and a review date; continuity arrangements for recovery after a malware attack with online and offline backups and recovery measures (8.13); isolating environments where outcomes could be catastrophic; procedures and responsibilities for malware protection, including training, reporting and recovery; awareness and training for all users on recognizing and limiting infected emails, files and programs (6.3); regularly gathering information on new malware from mailing lists or relevant sites; and checking that malware warnings come from qualified, reputable sources and are accurate. Other information: some systems such as certain industrial control systems cannot run anti-malware software, and some malware infects operating systems and firmware so deeply that a full reimage, sometimes including firmware, is needed.