800-53|SI-3

Title

MALICIOUS CODE PROTECTION

Description

The organization:

Supplemental

Information system entry and exit points include, for example, firewalls, electronic mail servers, web servers, proxy servers, remote-access servers, workstations, notebook computers, and mobile devices. Malicious code includes, for example, viruses, worms, Trojan horses, and spyware. Malicious code can also be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files, or hidden in files using steganography. Malicious code can be transported by different means including, for example, web accesses, electronic mail, electronic mail attachments, and portable storage devices. Malicious code insertions occur through the exploitation of information system vulnerabilities. Malicious code protection mechanisms include, for example, anti-virus signature definitions and reputation-based technologies. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Pervasive configuration management and comprehensive software integrity controls may be effective in preventing execution of unauthorized code. In addition to commercial off-the-shelf software, malicious code may also be present in custom-built software. This could include, for example, logic bombs, back doors, and other types of cyber attacks that could affect organizational missions/business functions. Traditional malicious code protection mechanisms cannot always detect such code. In these situations, organizations rely instead on other safeguards including, for example, secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to help ensure that software does not perform functions other than the functions intended. Organizations may determine that in response to the detection of malicious code, different actions may be warranted. For example, organizations can define actions in response to malicious code detection during periodic scans, actions in response to detection of malicious downloads, and/or actions in response to detection of maliciousness when attempting to open or execute files.

Reference Item Details

Related: CM-3,MP-2,SA-12,SA-13,SA-4,SA-8,SC-26,SC-44,SC-7,SI-2,SI-4,SI-7

Category: SYSTEM AND INFORMATION INTEGRITY

Family: SYSTEM AND INFORMATION INTEGRITY

Priority: P1

Baseline Impact: LOW,MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.13 Disable AutomountingUnixCIS Google Container-Optimized OS L1 Server v1.0.0
1.1.17 Ensure noexec option set on /dev/shm partitionUnixCIS Debian 9 Server L1 v1.0.1
1.1.17 Ensure noexec option set on /dev/shm partitionUnixCIS Debian 9 Workstation L1 v1.0.1
1.1.20 Ensure noexec option set on removable media partitionsUnixCIS Debian 9 Workstation L1 v1.0.1
1.1.20 Ensure noexec option set on removable media partitionsUnixCIS Debian 9 Server L1 v1.0.1
1.1.21 Disable AutomountingUnixCIS Debian 8 Workstation L2 v2.0.2
1.1.21 Disable AutomountingUnixCIS Debian 8 Server L1 v2.0.2
1.1.22 Disable AutomountingUnixCIS Red Hat 6 Workstation L2 v3.0.0
1.1.22 Disable AutomountingUnixCIS Oracle Linux 6 Workstation L2 v2.0.0
1.1.22 Disable AutomountingUnixCIS CentOS 6 Workstation L2 v3.0.0
1.1.22 Disable AutomountingUnixCIS Fedora 28 Family Linux Workstation L2 v1.0.0
1.1.22 Disable AutomountingUnixCIS Distribution Independent Linux Workstation L2 v2.0.0
1.1.22 Disable AutomountingUnixCIS Debian Family Server L1 v1.0.0
1.1.22 Disable AutomountingUnixCIS Debian 10 Workstation L2 v1.0.0
1.1.22 Disable AutomountingUnixCIS Red Hat 6 Server L1 v3.0.0
1.1.22 Disable AutomountingUnixCIS Fedora 28 Family Linux Server L1 v1.0.0
1.1.22 Disable AutomountingUnixCIS Oracle Linux 6 Server L1 v2.0.0
1.1.22 Disable AutomountingUnixCIS Ubuntu Linux 18.04 LXD Host L1 Server v1.0.0
1.1.22 Disable AutomountingUnixCIS CentOS 6 Server L1 v3.0.0
1.1.22 Disable AutomountingUnixCIS Distribution Independent Linux Server L1 v2.0.0
1.1.22 Disable AutomountingUnixCIS Debian 9 Server L1 v1.0.1
1.1.22 Disable AutomountingUnixCIS Debian 9 Workstation L2 v1.0.1
1.1.22 Disable AutomountingUnixCIS Debian 10 Server L1 v1.0.0
1.1.22 Disable AutomountingUnixCIS Debian Family Workstation L2 v1.0.0
1.1.23 Disable AutomountingUnixCIS Fedora 19 Family Linux Workstation L2 v1.0.0
1.1.23 Disable AutomountingUnixCIS Ubuntu Linux 20.04 LTS Workstation L2 v1.1.0
1.1.23 Disable AutomountingUnixCIS Fedora 19 Family Linux Server L1 v1.0.0
1.1.23 Disable AutomountingUnixCIS Ubuntu Linux 16.04 LTS Server L1 v2.0.0
1.1.23 Disable AutomountingUnixCIS Ubuntu Linux 20.04 LTS Server L1 v1.1.0
1.1.23 Disable AutomountingUnixCIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Red Hat 6 Workstation L2 v3.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Fedora 28 Family Linux Workstation L2 v1.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Debian 10 Server L1 v1.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Debian 10 Workstation L2 v1.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Oracle Linux 6 Server L1 v2.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Distribution Independent Linux Server L1 v2.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS CentOS 6 Workstation L2 v3.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Oracle Linux 6 Workstation L2 v2.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Distribution Independent Linux Workstation L2 v2.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Ubuntu Linux 18.04 LXD Host L1 Server v1.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Red Hat 6 Server L1 v3.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Fedora 28 Family Linux Server L1 v1.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS CentOS 6 Server L1 v3.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Debian Family Server L1 v1.0.0
1.1.23 Disable USB Storage - lsmodUnixCIS Debian Family Workstation L2 v1.0.0
1.1.23 Disable USB Storage - modprobeUnixCIS Red Hat 6 Workstation L2 v3.0.0
1.1.23 Disable USB Storage - modprobeUnixCIS CentOS 6 Workstation L2 v3.0.0
1.1.23 Disable USB Storage - modprobeUnixCIS Fedora 28 Family Linux Workstation L2 v1.0.0
1.1.23 Disable USB Storage - modprobeUnixCIS Distribution Independent Linux Workstation L2 v2.0.0
1.1.23 Disable USB Storage - modprobeUnixCIS Fedora 28 Family Linux Server L1 v1.0.0