Cyber Essentials: Malware Protection

Introduction

Deploying malicious software (like ransomware) is just one way that cyber criminals can impact organisations and people – having suitable protection in place is key to good cyber security posture. It helps to prevent malicious software from appearing on devices and running – effectively aimed at preventing damage and impact. Here, we explore the importance of malware protection, how it relates to Cyber Essentials, share tips and recommendations.

 

Why Malware Protection Is Important

Cybercriminals use malware to exploit system vulnerabilities, steal data, and disrupt operations. Effective malware protection is crucial to:

• Prevent data breaches and financial losses
• Ensure business continuity
• Comply with regulatory security standards
• Reduce the risk of ransomware and phishing attacks

A single malware infection can cause significant damage, making proactive prevention essential for any organisation.

 

Malware Protection in Cyber Essentials

To meet Cyber Essentials certification requirements, organisations must either:

• Use anti-malware software, for devices that support the software
• Use an application allow list, for all devices and/or those that don’t support anti-malware software

 

Considerations and Key Notes

When using anti-malware software for your organisation, it must:

• Be up to date and maintained
• Prevent malware from running and executing malicious code
• Prevent connections to malicious websites over the internet

When using an application allow list for your organisation:

• Use only approved applications, restricted by code signing – such as using ‘stores’
• Approve apps before deploying them
• Maintain a current list of approved apps, and not allow apps to be installed that are unsigned or have an invalid signature – such as those downloaded on alternative sites than ‘stores’

Key Notes

• Built-in anti-malware products (Windows / MacOS) are acceptable for Cyber Essentials
• Anti-malware products should be used for servers, desktops and laptops
• Mobile phones can be protected using an application allow list – using ‘stores’ can help minimise risk of downloading infected files

 

Example Scenario

Organisation uses a laptop and iPhone to access organisational data

• For this environment, focus is on malware protection for the laptop and iPhone
• Ensuring an up to date anti-malware product is running on the laptop – such as Microsoft Defender – is fundamental
• Ensuring malicious websites are blocked for browser can be achieved through Edge (SmartScreen) and Chrome (safe browsing) tests – browser extensions can be used for further protection
• Ensuring apps are sourced from Apple store only – no ‘jail break’ features – can be supported through policy and training

 

Tips and Recommendations

1. If using laptops, desktops or servers to access / store organisational data, ensure it has anti-malware software running and that the software is up to date / receiving regular updates
2. If using mobile phones (Android or Apple) to access / store organisational data, use an application allow list to ensure only trusted and (vendor) signed applications are installed
3. Choose to deploy and purchase anti-malware products if you wish, the in-built products for Windows and MacOs are acceptable for Cyber Essentials
4. Seek guidance and support from a NCSC Cyber Advisor – such as RB Consultancy Ltd

For more detailed guidance, review the IT Requirement for Infrastructure document and/or visit the IASME knowledge hub for Cyber Essentials

How We Help

At RB Consultancy Ltd we support organisations in ensuring malware protections are in place to meet Cyber Essentials and Cyber Essentials Plus requirements:

• We explain the importance of malware protection
• We help ensure malware protections are applied and working effectively
• We explain why the Cyber Essentials questions are being asked and how they intend to protect organisations in different ways
• We ensure malware protection settings and processes align with Cyber Essentials guidelines
• We assess and issue organisations with Cyber Essentials and Cyber Essentials Plus certifications

 

Conclusion

Malware protections are a critical component of cyber security and Cyber Essentials certification, helping to protect your business from cyber threats. Malicious software can impact your organisation in many ways – including ransomware and data exfiltration. By implementing best practices and ensuring compliance with Cyber Essentials technical controls, organisations can significantly reduce their cyber risk. If you need any assistance with malware protection, or Cyber Essentials / Cyber Essentials Plus certification, please contact us for support.