Introduction
Deploying malicious software (like ransomware) is just one way that cyber criminals can impact organisations and people – having suitable protection in place is key to good cyber security posture. It helps to prevent malicious software from appearing on devices and running – effectively aimed at preventing damage and impact. Here, we explore the importance of malware protection, how it relates to Cyber Essentials, share tips and provide an example scenario to help explain the Cyber Essentials requirements.
Why Malware Protection Is Important
Cybercriminals use malware to exploit system vulnerabilities, steal data, and disrupt operations. Effective malware protection is crucial to:
- Prevent data breaches and financial losses
- Ensure business continuity
- Comply with regulatory security standards
- Reduce the risk of ransomware and phishing attacks
A single malware infection can cause significant damage, making proactive prevention essential for any organisation.
Malware Protection in Cyber Essentials
To meet Cyber Essentials certification requirements, organisations must either:
- Use anti-malware software, for devices that support the software
- Use an application allow list, for all devices and/or those that don’t support anti-malware software
Considerations and Key Notes
When using anti-malware software for your organisation, it must:
- Be up to date and maintained
- Prevent malware from running and executing malicious code
- Prevent connections to malicious websites over the internet
When using an application allow list for your organisation:
- Use only approved applications, restricted by code signing – such as using ‘stores’
- Approve apps before deploying them
- Maintain a current list of approved apps, and not allow apps to be installed that are unsigned or have an invalid signature – such as those downloaded on alternative sites than ‘stores’
Key Notes
- Built-in anti-malware products (Windows / MacOS) are acceptable for Cyber Essentials
- Anti-malware products should be used for servers, desktops and laptops
- Mobile phones can be protected using an application allow list – using ‘stores’ can help minimise risk of downloading infected files
Example Scenario
Organisation uses a laptop and iPhone to access organisational data
- For this environment, focus is on malware protection for the laptop and iPhone
- Ensuring an up to date anti-malware product is running on the laptop – such as Microsoft Defender – is fundamental
- Ensuring malicious websites are blocked for browser can be achieved through Edge (SmartScreen) and Chrome (safe browsing) tests – browser extensions can be used for further protection
- Ensuring apps are sourced from Apple store only – no ‘jail break’ features – can be supported through policy and training
Tips and Recommendations
- If using laptops, desktops or servers to access / store organisational data, ensure it has anti-malware software running and that the software is up to date / receiving regular updates
- If using mobile phones (Android or Apple) to access / store organisational data, use an application allow list to ensure only trusted and (vendor) signed applications are installed
- Choose to deploy and purchase anti-malware products if you wish, the in-built products for Windows and MacOs are acceptable for Cyber Essentials
- Seek guidance and support from a NCSC Cyber Advisor – such as RB Consultancy Ltd
For more detailed guidance, review the IT Requirement for Infrastructure document and/or visit the IASME knowledge hub for Cyber Essentials
How We Help
At RB Consultancy Ltd we support organisations in ensuring malware protections are in place to meet Cyber Essentials and Cyber Essentials Plus requirements:
- We explain the importance of malware protection
- We help ensure malware protections are applied and working effectively
- We explain why the Cyber Essentials questions are being asked and how they intend to protect organisations in different ways
- We ensure malware protection settings and processes align with Cyber Essentials guidelines
- We assess and issue organisations with Cyber Essentials and Cyber Essentials Plus certifications
Conclusion
Malware protections are a critical component of cyber security and Cyber Essentials certification, helping to protect your business from cyber threats. Malicious software can impact your organisation in many ways – including ransomware and data exfiltration. By implementing best practices and ensuring compliance with Cyber Essentials technical controls, organisations can significantly reduce their cyber risk. If you need any assistance with malware protection, or Cyber Essentials / Cyber Essentials Plus certification, please contact us for support.
Written by Remo Belisari, Managing Director of RB Consultancy Ltd, an experienced cyber security professional cyber advisor. Remo holds certifications relating to CISSP, ISSAP, ISO 27001, Cyber Essentials, IASME Cyber Assurance, and has many years experience in IT and cyber security. Remo has a history of supporting organisations from all over the world – including a Fortune 500 in USA and over 100 organisations across the UK. The views expressed in this blog are those of the author and do not necessarily reflect the views of RB Consultancy Ltd, its clients, partners, or affiliated organisations. The content is intended for general information only and should not be taken as legal advice.
