ISO-27001-Annex -A.12.2-Protection-from-Malware

ISO 27001 Annex : A.12.2 Protection from Malware

ISO 27001 Annex : A.12.2 Protection from Malware It’s objective is ensuring that malware protection is provided to information and information processing facilities.

A.12.2.1  Controls Against Malware

Control- In combination with appropriate user awareness, the detection, prevention, and recovery controls to protect against malware should be implemented.

Implementation guidance

Malware protection should be supported by malware detection and repair software, awareness of the safety of information, and adequate system access and management reviews on changes. The guidance should be considered as follows:

  1. a create formal policy barring the use of unauthorized software;  
  2. Implementation of controls preventing or detecting the use of unauthorized software;
  3. Implement controls which avoid or detect the use of malicious websites known or suspected (e.g. blacklisting);
  4. Create a structured risk management policy, which indicates what protective measures should be taken to secure obtaining file and information, either from or through external networks;
  5. Reducing malware-exploitable vulnerabilities, e.g. by management of technical vulnerabilities;
  6. conduct frequent software and data quality reviews of applications that help critical processes; a formal investigation will take place into the existence of unapproved files or unauthorized amendments;
  7. Installing and regularly updating malware and repair software as precautionary or routine test for scanning computers and media; Administered scanning should include:
  • scan for malware before using any files received via networks or any storage device;
  • Scanning of E-mail attachments and downloads for malware; the scan will be performed in different places, e.g. electronic mail servers, mobile computers and when accessing the organization’s network;
  • Malware scanning of web pages;
  1. define malware protection procedures and responsibilities on systems, training in their use, reporting and recovery from malware:
  2. Establishing appropriate business continuity plans, including all necessary software backup and recovery arrangements to recover from malware attacks;
  3. implementation of information gathering procedures, such as a subscription to mailing lists or websites providing new malware information;
  4. Implementing malware information verification procedures to ensure the accuracy and information quality of advisory bulletins; managers should ensure the differentiation between rogues and real malware is achieved using a qualified source, e.g. reputable journals, reliable internet sites or software suppliers;
  5. Isolate environments that could result in catastrophic effects.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

“One single vulnerability is all an attacker needs”
– Window Synder

 The organization wishes to maintain the CIA triads. They also ensure that the operation in their business have been implemented with proper security controls to protect the confidentiality, authenticity and/or integrity of the organization’s information and information processing facilities, and also free from virus or malware attacks. This malware protection control is covered in Annex 12.2 of ISO 27001. This famous certification of lead auditor and lead implementer covers all the annexes to the security of information by implementing appropriate access controls to ensure authorized access to protect the organization’s critical information. Infosavvy, a Mumbai-based institute, offers certifications and training for multiple-domain-like management of information security, cybersecurity, and many others, including the IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). This certification covers several audits to keep an organization safe from the intended destructor. Infosavvy will help you to understand and identify the full extent of the security controls of your organization that is necessary to protect the operations and information equipment (assets)of your organization from attacks even at the time of their demise. We have trained trainers who have ample know-how and experience in order to make sure that the information security is effectively handled. The applicant will, therefore, gain the skills needed to conduct the ISMS audit using commonly agreed audit concepts, procedures and techniques

Also Read : ISO 27001 Annex : 12 Operations Security

Other information – The use of two or more software products protecting malware from various providers and technology throughout the information processing environment can improve malware protection efficiency.
Protection from malware introduction during maintenance and emergency procedures, which could bypass normal malware protection controls, should be taken with care.
Malware protection could under certain conditions cause operational disturbances.
The use of malware detection and software repair alone as a malware control is usually unsuited and usually accompanied by malware operations.

Questions related to this topic
  1. What are the 4 main types of vulnerability in cyber security?
  2. Explain ISO 27001 Annex : A.12.2 Protection from Malware?
  3. What is System vulnerability and abuse?
  4. What are the vulnerabilities to computer systems?
  5. Is malware a vulnerability?
  6. Explain controls of ISO 27001 Annex : A.12.2 Protection from Malware?

ISO 27001 Requirements

Clause 4.2 Understanding the needs and expectations of interested parties 
Clause 4.4 Information security management system
Clause 4.3 Determining the scope of the information security management system
Clause 5.1 Leadership and commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities 
Clause 6.1 Actions to address risks and opportunities
Clause 6.1.2 Information security risk assessment process
Clause 6.1.3 Information security risk treatment
Clause 6.2 Information security objectives & planning
Clause 7.1 Resources
Clause 7.2 Competence
Clause 7.3 Awareness
Clause 7.4 Communication
Clause 7.5 Documented information Implementation Guideline
Clause 8.1 Operational planning & control
Clause 8.2 Information security risk assessment
Clause 8.3 Information security risk treatment
Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation
Clause 9.2 Internal audit
Clause 9.3 Management review
Clause 10.1 Non conformity and corrective action
Clause 10.2 Continual Improvement 

ISO 27001 Annex A Controls

Annex A.5 Information Security Policies
Annex A.6 Organization of Information Security
Annex A.6.2 Mobile Devices and Teleworking
Annex A.7 Human Resource Security
Annex A.7.2 During Employment
Annex A.7.3 Termination and Change of Employment
Annex A.8 Asset Management
Annex A.8.1.3 Acceptable Use of Assets & A.8.1.4 Return of Assets
Annex A.8.2 Information Classification
Annex A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets
Annex A.8.3 Media Handling
Annex A.9 Access Control
Annex A.9.1.2 Access to Networks and Network Services
Annex A.9.2 User Access Management
Annex A.9.2.3 Management of Privileged Access Rights  
Annex A.9.2.4 Management of Secret Authentication Information of Users
Annex A.9.2.5 Review of User Access Rights 
Annex A.9.2.6 Removal or Adjustment of Access Rights
Annex A.9.3 User Responsibilities
Annex A.9.4 System and Application Access Control
Annex A.9.4.4 Use of Privileged Utility Programs 
Annex A.9.4.5 Access Control to Program Source Code
Annex A.10 Cryptography
Annex A.11 Physical and Environmental Security
Annex A.11.2 Equipment
Annex A.11.1.3 Securing Offices, Rooms and Facilities
Annex A.11.1.4 Protecting Against External and Environmental Threats
Annex A.11.1.5 Working in Secure Areas
Annex A.11.1.6 Delivery and Loading Areas
Annex A.11.2.4 Equipment Maintenance
Annex A.11.2.5 Removal of Assets
Annex A.11.2.6 Security of Kit and Assets Off-Premises
Annex A.11.2.7 Secure Disposal or Re-use of Equipment
Annex A.11.2.8 Unattended User Equipment
Annex A.11.2.9 Clear Desk and Clear Screen Policy
Annex A.12 Operations Security
Annex A.12.2 Protection from Malware
Annex A.12.3 Backup
Annex A.12.4 Logging and Monitoring
Annex A.12.5 Control of Operational Software
Annex A.12.6 Technical Vulnerability Management
Annex A.12.7 Information Systems Audit Considerations
Annex A.13 Communications Security
Annex A.13.2 Information Transfer
Annex A.13.2.3 Electronic Messaging
Annex A.13.2.4 Confidentiality or Non-Disclosure Agreements
Annex 14 System Acquisition, Development and Maintenance
Annex A.14.1.2 Securing Application Services on Public Networks
Annex A.14.1.3 Protecting Application Services Transactions
Annex A.14.2 Security in Development and Support Processes
Annex A.14.2.3 Technical Review of Applications after Operating Platform Changes
Annex A.14.2.4 Restrictions on Changes to Software Packages
Annex A.14.2.5 Secure System Engineering Principles
Annex A.14.2.6 Secure Development Environment
Annex A.14.2.7 Outsourced Development
Annex A.14.2.8 System Security Testing
Annex A.14.2.9 System Acceptance Testing
Annex A.14.3 Test data
Annex A.15 Supplier Relationships
Annex A.15.1.2 Addressing Security Within Supplier Agreements
Annex A.15.1.3 Information and Communication Technology Supply Chain
Annex A.15.2 Supplier Service Delivery Management
Annex A.16 Information Security Incident Management
Annex A.16.1.2 Reporting Information Security Events
Annex A.16.1.3 Reporting Information Security Weaknesses
Annex A.16.1.4 Assessment of and Decision on Information Security Events
Annex A.16.1.5 Response to Information Security Incidents
Annex A.16.1.6 Learning from Information Security Incidents
Annex A.16.1.7 Collection of Evidence
Annex A.17 Information Security Aspects of Business Continuity Management
Annex A.17.1.3 Verify, Review and Evaluate Information Security Continuity
Annex A.18 Compliance
Annex A.18.1.3 Protection of Records
Annex A.18.1.4 Privacy and Protection of Personally Identifiable Information
Annex A.18.1.5 Regulation of Cryptographic Controls
Annex 18.2 Information Security Reviews

About ISO 27002

This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us –

Leave a Comment