Anti-virus and Malicious Code Policy Overview

Anti-virus and Malicious Code Policy Overview

• The policy aims to protect all networks, information processing facilities, and mobile devices from malicious software, including viruses, worms, Trojans, and spyware.
• It is designed to minimize the impact of malicious software on business and to comply with PCI DSS requirements.
• The scope covers all information processing facilities and mobile devices under the company's control, including network gateways, laptops, workstations, servers, and other mobile technology.
• The policy outlines the roles and responsibilities of client, server, and anti-virus administrators, IT security manager, users, and third-party vendors.
• It emphasizes the need for approved anti-virus software installation and regular updates, strict controls on obtaining files from external networks, and monitoring the effectiveness of anti-virus software.
• Users are responsible for being vigilant against suspicious emails, scanning media from unknown sources for viruses, and reporting any suspected or detected viruses to the IT helpdesk.
• Third-party vendors are required to provide updates in a timely manner and offer support and guidance as necessary.
• The policy mandates proactive and periodic scanning for viruses and scanning of files received on removable media from outside the trusted network.
• It specifies the platforms requiring anti-virus configuration, including systems running Microsoft Windows and Linux/Unix operating systems.
• Workstations, laptops, and servers have specific requirements for anti-virus protection, including automated updates and scheduled checks of files.
• Different anti-virus solutions are required for gateway virus scanning and email content scanning, with specific protocols for scanning web traffic and email attachments.
• Enforcement of the policy involves disciplinary action for employees found to have violated it, with deviation permitted only with a valid business case reviewed and approved by the Security Management Team and/or Legal Counsel.