The operating system must prevent non-privileged users from circumventing malicious code protection capabilities.

From Solaris 11 SPARC Security Technical Implementation Guide

Associated with: CCI-001248

SV-60835r2_rule The operating system must prevent non-privileged users from circumventing malicious code protection capabilities.

Vulnerability discussion

In order to minimize potential negative impact to the organization caused by malicious code, it is imperative that malicious code is identified and eradicated prior to entering protected enclaves via operating system entry and exit points. The requirement states that AV and malware protection applications must be used at entry and exit points. For the operating system, this means an anti-virus application must be installed on machines that are the entry and exit points.

Check content

The operator will ensure that anti-virus software is installed, operating, and updated at least weekly. Virus definitions will be updated regularly. The software will be maintained per vendor documentation. If the operator is unable to provide a documented configuration for an installed anti-virus software system or if the anti-virus software is not properly configured, maintained, or used, this is a finding.

Fix text

The operator will ensure that anti-virus software is installed, operating, and updated at least weekly. Virus definitions will be updated regularly.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.