Virus Security Management Must Be Established To Prevent And Detect The Introduction Of Viruses And Other Malicious Software.
The objective is to protect the integrity of software and information assets
It is extremely important that our information systems are properly protected against virus threats. Although user awareness and education is a key factor in reducing the incidence of virus outbreaks, this must be complemented with appropriate anti-virus systems and controls at the infrastructure level.
Education and Awareness
It is important that all employees particularly specialists in the IT Department are familiar with the escalation procedures relating to virus outbreaks and that they have adequate training on security measures, virus prevention measures, and safe recovery procedures.
User awareness programs should be established, focusing on security measures and good practice to prevent virus outbreaks. Employees should also know how to report virus infection and actions to take at the desktop level.
Anti-Virus Management
Anti-virus software should be installed on all personal computers. This should be supplemented by anti-virus software on servers as an additional precaution. All mail attachments should be scanned for viruses at the local mail server to prevent propagation of viruses both inbound and outbound.
The majority of viruses introduced to The Organization systems are done so via email attachments, in particular by those viruses, which exploit the propagation capability of the email system to transmit large numbers of infected messages to Global Address List recipients. See also email security policy.
Anti-virus systems are available which scan either the mailbox database or the message transfer agent of the email system. Further advice can be obtained from the Information Security Management Department. Anti-virus software definition files should be updated as they are released by the vendor. In addition, patches are often released on an ad-hoc basis to target specific new viruses. These should also be installed as soon as possible.
Virus Prevention
In order to prevent infection by a virus, a virus scan should be conducted whenever installing a device or software onto a computer. To speed up the recovery process after a virus infection, ensure that the details of all software installed on a system are kept up to date.
Original programs should be stored securely. Write-protect any disks and make a backup copy. System users should be restricted from writing to the directories where shared programs are stored, and ensure programs are deleted when no longer required.
In order to prevent a virus infection resulting from unauthorized access, ensure that network devices and management information relating to those devices are kept secure, particularly where the device is connected to an outside network.
System access logs (especially the external firewalls) should be analyzed regularly to check for any unauthorized access, and monitor the operation of the systems for irregularities that may indicate the presence of a virus. In order to improve the effectiveness of virus prevention measures, independent system audits are undertaken on a regular basis and ensure that recommendations for improvement are implemented.
Virus Infection
In order to prevent any spread of damage from virus infection, the following actions should be taken:
- Stop using the infected system.
- Inform users.
- Isolate the infected machine by disconnecting from the network.
- For major outbreaks, consider disconnecting the Exchange server link to the router.
- Identify virus and the scope of infection.
- Virus infections propagated via email system must be immediately reported through the appropriate channels.
- Work on the recovery of the infected system(s) only after a safe recovery plan has been established.
- Business continuity plans may need to be activated in the event of a major outbreak.
Once the virus infection has been controlled and removed, a thorough analysis of the incident should be carried out, and additional preventive measures implemented if necessary.
Check out related article about assets classification and control in the management of the information Security system within the organization.
See also:
Recent Comments