In this ultimate how to implement guide to ISO 27001 Annex A 8.7 Protection Against Malware, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
- 1. Deploy Next-Generation Endpoint Detection (EDR)
- 2. Automate Definition and Agent Updates
- 3. Enable Real-Time (On-Access) Scanning
- 4. Restrict Local Administrative Privileges
- 5. Implement Attack Surface Reduction (ASR) Rules
- 6. Configure Web Content Filtering
- 7. Enforce Removable Media Scanning
- 8. Sandbox Email Attachments
- 9. Establish Malware Incident Response Procedures
- 10. Conduct Phishing and Awareness Simulation
1. Deploy Next-Generation Endpoint Detection (EDR)
Control Requirement: Protection against malware must be implemented across all information processing facilities.
Required Implementation Step: Uninstall legacy, signature-based antivirus solutions. Deploy a Next-Gen Endpoint Detection and Response (EDR) agent (e.g., Microsoft Defender for Endpoint, CrowdStrike, SentinelOne) to every server, workstation, and remote laptop to detect behavioural anomalies, not just known file hashes.
Minimum Requirement: 100% coverage; a single unprotected endpoint is a bridgehead for ransomware.
2. Automate Definition and Agent Updates
Control Requirement: Detection mechanisms must remain current.
Required Implementation Step: Configure the update policy to “Auto-Update” every 60 minutes for signatures and apply agent engine updates within 24 hours of release. Verify that offline clients are forced to update immediately upon network reconnection before accessing file shares.
Minimum Requirement: Signatures older than 24 hours render the protection obsolete.
3. Enable Real-Time (On-Access) Scanning
Control Requirement: Files must be scanned before execution.
Required Implementation Step: Hard-configure the EDR policy to enable “Real-Time Protection” or “On-Access Scanning”. Ensure that scanning applies to all file types (read and write), archive files (.zip, .rar), and network drives.
Minimum Requirement: Scheduled weekly scans are insufficient; protection must be instantaneous.
4. Restrict Local Administrative Privileges
Control Requirement: Prevent unauthorised software installation.
Required Implementation Step: Revoke “Local Administrator” rights from all standard user accounts via Group Policy (GPO) or Intune. If a user cannot install software, they cannot inadvertently install a Trojan disguised as a PDF converter.
Minimum Requirement: Zero standard users with install privileges.
5. Implement Attack Surface Reduction (ASR) Rules
Control Requirement: Block common malware delivery techniques.
Required Implementation Step: Enable ASR rules in the OS or security agent to “Block JavaScript or VBScript from launching downloaded executable content” and “Block all Office applications from creating child processes”. This kills the primary vector for macro-based malware.
Minimum Requirement: Macros must be disabled by default for documents originating from the internet.
6. Configure Web Content Filtering
Control Requirement: Prevent access to known malicious websites.
Required Implementation Step: Configure your DNS filter (e.g., Cisco Umbrella) or firewall to block access to “Malware”, “Phishing”, and “Command and Control (C2)” categories. This prevents a compromised machine from “phoning home” to the attacker.
Minimum Requirement: Blocking the download URL is as important as blocking the file itself.
7. Enforce Removable Media Scanning
Control Requirement: Prevent infection via physical drives.
Required Implementation Step: Configure the EDR policy to automatically mount and scan any USB drive immediately upon insertion. Alternatively, block the mounting of non-encrypted or unapproved USB storage entirely.
Minimum Requirement: “AutoRun” must be disabled on all endpoints.
8. Sandbox Email Attachments
Control Requirement: Filter malicious content in communication channels.
Required Implementation Step: Enable “Safe Attachments” or “Sandboxing” on your email gateway. This feature detonates attachments in a virtual environment to observe their behaviour before delivering the file to the user’s inbox.
Minimum Requirement: Block high-risk file extensions (.exe, .scr, .vbs, .js) at the gateway level.
9. Establish Malware Incident Response Procedures
Control Requirement: Procedures to recover from malware attacks.
Required Implementation Step: Define a specific “Runbook” for malware alerts: 1. Isolate the host from the network. 2. Capture memory dump for forensics. 3. Re-image the machine (do not attempt to “clean” it). 4. Reset user credentials.
Minimum Requirement: The immediate capability to remotely isolate an infected host.
10. Conduct Phishing and Awareness Simulation
Control Requirement: User awareness regarding malware risks.
Required Implementation Step: Run monthly simulated phishing campaigns using current malware hooks (e.g., “Urgent Invoice”). Users who click must be auto-enrolled in remedial training. Malware usually enters via a click, not a hack.
Minimum Requirement: Evidence of testing human sensors, not just software sensors.
About the author
