ISO 27001 A.8.7: Protection Against Malware

Quick Reference (60 Seconds)

Bottom Line: Malware is one of the most common and damaging threats to organizations. A single malware infection can lead to data theft, ransomware encryption, system compromise, and business disruption. Protection against malware requires a multi-layered defense: prevention, detection, and response. This is not just about antivirus, it's about a complete anti-malware strategy.

What the Standard Actually Requires

Figure · Process

What A.8.7 asks you to do

ISO 27001:2022 Annex A.8.7 states:

ISO 27001:2022 Annex A 8.7 asks organizations to protect information and associated assets against malware, supported by user awareness.

ISO 27002:2022 expands this into practical guidance covering:

1. Anti-malware policy and procedures, Documented rules for malware prevention and response
2. Anti-malware software, Deploy and maintain anti-malware solutions on all systems
3. Regular scanning, Scan all systems, files, and removable media for malware
4. Signature and definition updates, Keep anti-malware definitions current (daily or real-time)
5. User awareness, Train users on malware risks, safe computing practices, and reporting
6. Removable media controls, Scan all removable media before use; restrict unauthorized media
7. Email and web protection, Scan email attachments and web downloads for malware
8. Incident response, Define and practice malware incident response procedures
9. System hardening, Reduce attack surface through secure configuration
10. Mobile device protection, Protect mobile devices against mobile malware

Why Protection against malware Matters

The Malware Threat Landscape

Malware is a persistent, evolving threat that affects organizations of all sizes. From ransomware that encrypts entire networks to spyware that steals credentials, malware is a primary attack vector for cybercriminals.

Key Statistics

• 560,000 new malware variants are detected every day globally
• Ransomware attacks occur every 11 seconds (Cybersecurity Ventures)
• 70% of malware infections begin with a phishing email
• India ranks 3rd globally in malware detection volume (after the US and Russia)
• 43% of cyberattacks target small and medium businesses (Verizon DBIR)
• Average ransomware demand in India: –5 crore (Singahi incident data)
• Downtime from ransomware averages 21 days (Coveware)
• Only 65% of organizations have anti-malware deployed on all endpoints (Ponemon Institute)

Real-World Consequences

• A manufacturing company in Pune was hit by ransomware (LockBit) that encrypted all 500 endpoints and servers. The attacker demanded . The company had no backups and no incident response plan. They paid in Bitcoin and still lost 2 weeks of production data. Total overhead: including recovery, downtime, and reputation loss.
• A bank employee clicked a phishing link that downloaded a banking trojan. The trojan stole credentials for 200 customer accounts. The bank had to freeze accounts, reset passwords, and notify regulators. The RBI imposed a penalty for inadequate malware protection.
• A healthcare clinic's systems were infected with spyware that exfiltrated 50,000 patient records over 6 months. The clinic had no endpoint detection. The data was sold on the dark web. The clinic faced DPDP Act penalties and lawsuits from patients.
• A logistics company's dispatch system was infected with a worm that spread across the entire network in 2 hours. All delivery tracking, routing, and invoicing systems were down for 3 days. The company lost in delayed deliveries and penalties.
• An employee used a USB drive from a cyber café on an office laptop. The USB contained a worm that infected the entire network, spreading to 200 machines. The company had no removable media scanning policy. Recovery took 2 weeks.

Regulatory and Business Drivers

• RBI Cyber Security Framework mandates anti-malware on all endpoints and servers with regular updates and scanning
• SEBI Cybersecurity Circular requires trading systems to have malware protection with real-time monitoring
• DPDP Act 2023 requires reasonable security safeguards, including protection against malware that could compromise personal data
• IT Act 2000 (Section 43) imposes penalties for failure to protect computer systems from malware
• ISO 27001 requires A.8.7 as part of the ISMS
• PCI DSS v4.0 Requirement 5 mandates anti-malware on all systems susceptible to malware
• SOC 2 CC7.2 requires detection of malicious software and unauthorized software
• Cyber Insurance policies increasingly require proof of anti-malware controls as a condition of coverage

Scope and Applicability

What Is Covered

• All endpoint devices (desktops, laptops, tablets, mobile phones, thin clients)
• All servers (physical, virtual, cloud instances, containers)
• All network infrastructure (firewalls, routers, switches, load balancers, VPN concentrators)
• All email systems (on-premise, cloud-based, hybrid)
• All web gateways and proxies
• All removable media (USB drives, external hard drives, SD cards, CDs/DVDs)
• All file shares and storage systems
• All cloud services and SaaS applications with file upload/download capabilities
• All remote access endpoints and VPN clients
• All IoT devices and embedded systems
• All development and test environments

What Is Not Covered

• Air-gapped systems with no connectivity and no removable media (though physical security controls apply)
• Systems with approved exceptions (documented, risk-assessed, and approved by CISO)
• Personal devices not used for business (BYOD policies may require anti-malware)

Applicability by Organization Type

Key Definitions and Terminology

Relationship to Other Controls

Implementation Roadmap (Week-by-Week)

Week 1: Malware Risk Assessment and Inventory

• Assess current malware threat landscape for the organization
• Inventory all endpoints, servers, network devices, and mobile devices
• Identify current anti-malware solutions and their coverage gaps
• Review recent malware incidents and near-misses
• Identify high-risk users and systems (executives, finance, admins, developers)
• Assess email security and web filtering capabilities
• Review removable media usage and controls
• Document current state and risk assessment

Week 2: Policy and Strategy Development

• Draft anti-malware policy and procedures
• Define anti-malware strategy (prevention, detection, response)
• Define deployment requirements (all endpoints, all servers, mobile devices)
• Define scanning schedules (real-time, daily, weekly, on-demand)
• Define update requirements (signature updates, engine updates, heuristics)
• Define removable media policy (scanning, restrictions, exceptions)
• Define email and web protection requirements
• Define incident response procedures for malware infections
• Define user awareness and training requirements

Week 3: Anti-Malware Solution Selection and Deployment

• Evaluate anti-malware solutions (traditional AV, EDR, XDR, cloud-native)
• Select solution based on coverage, detection rates, performance
• Deploy anti-malware on all endpoints (desktops, laptops, mobile devices)
• Deploy anti-malware on all servers (physical, virtual, cloud)
• Deploy email security gateway (if not already present)
• Deploy web security gateway (if not already present)
• Configure real-time scanning and on-access protection
• Configure scheduled scanning (daily quick scan, weekly full scan)
• Configure automatic updates for signatures and engine

Week 4: Advanced Detection and Response (EDR/XDR)

• Deploy Endpoint Detection and Response (EDR) for advanced threat detection
• Configure behavioral analysis and machine learning detection
• Configure sandboxing for suspicious files
• Set up threat intelligence feeds and IoC integration
• Configure automated response actions (isolate, kill process, quarantine)
• Deploy XDR if budget allows (correlates endpoint, network, email, cloud)
• Configure alert rules and severity levels
• Integrate EDR/XDR with SIEM for centralized monitoring
• Test detection and response capabilities with simulated malware

Week 5: Removable Media and Email/Web Controls

• Implement removable media scanning (scan all USB drives before use)
• Deploy Data Loss Prevention (DLP) for USB monitoring (if needed)
• Configure email security gateway to scan all attachments and URLs
• Implement URL rewriting and sandboxing for email links
• Configure web filtering to block malicious websites and downloads
• Implement download scanning for all web downloads
• Configure macro security for Office documents (disable macros by default)
• Implement attachment sandboxing for suspicious email attachments
• Configure anti-phishing and anti-spoofing in email gateway

Week 6: User Training and Awareness

• Develop malware awareness training program
• Train all users on phishing, safe browsing, and removable media
• Conduct phishing simulation exercises
• Create malware incident reporting procedures and channels
• Distribute quick reference guides for malware identification and reporting
• Train IT staff on malware incident response and forensics
• Train help desk on malware triage and initial response
• Create awareness materials (posters, emails, intranet content)

Week 7: Testing, Validation, and Hardening

• Test anti-malware detection with EICAR test file and safe malware samples
• Test EDR behavioral detection with simulated attack scenarios
• Test email security gateway with test phishing emails
• Test web filtering with known malicious URLs
• Verify removable media scanning with test files
• Conduct vulnerability scan to identify malware entry points
• Harden systems (disable unnecessary services, restrict macros, patch vulnerabilities)
• Test malware incident response procedure with tabletop exercise
• Validate backup and recovery procedures for ransomware scenarios

Week 8: Documentation, Monitoring, and Audit

• Document all anti-malware configurations and policies
• Create malware incident response playbook
• Set up monitoring dashboards for anti-malware status and alerts
• Configure reporting for compliance (coverage, detection rates, update status)
• Conduct internal audit of malware protection implementation
• Verify all systems have anti-malware installed and updating
• Verify email and web protection is operational
• Prepare for external audit
• Plan for continuous improvement

Detailed Implementation Guidance

Anti-Malware Architecture

Defense-in-Depth Layers:

Anti-Malware Deployment Strategy

Endpoint Deployment:

Server-Specific Anti-Malware Considerations:

• Exclude database files, log files, and temporary files from real-time scanning to avoid performance impact
• Schedule full scans during maintenance windows
• Use lightweight agents for high-performance servers (databases, trading systems)
• Ensure anti-malware does not interfere with backup operations
• Test anti-malware impact on server performance before production deployment

Email and Web Protection

Email Security Gateway Configuration:

Web Security Gateway Configuration:

Removable Media Controls

Removable Media Policy:

Ransomware-Specific Protection

Ransomware Defense Strategy:

Ransomware Response Checklist:

1. Isolate infected systems immediately (disconnect from network)
2. Identify the ransomware strain (use ID Ransomware, VirusTotal, or EDR)
3. Determine scope of infection (which systems, which data, encrypted vs. stolen)
4. Preserve evidence for forensics (memory dumps, logs, encrypted files)
5. Notify incident response team, CISO, legal, and leadership
6. Do not pay ransom without legal and law enforcement consultation
7. Assess backup availability and integrity (verify backups are not encrypted)
8. Initiate recovery from clean backups if available
9. Report to law enforcement (CERT-In for India, local police cyber cell)
10. Conduct post-incident review and strengthen defenses
11. Notify affected customers and regulators if data was compromised
12. Review cyber insurance policy and initiate claim if applicable

Mobile and IoT Malware Protection

Mobile Threat Defense (MTD):

IoT/OT Malware Protection:

• IoT devices often cannot run traditional anti-malware
• Use network-based detection (IDS/IPS, network traffic analysis)
• Segment IoT/OT networks from IT networks (A.8.22)
• Monitor IoT device behavior for anomalies (unexpected traffic, C2 communication)
• Implement firmware signing and secure boot where supported
• Use IoT security platforms (Armis, Claroty, Dragos) for specialized protection
• Regularly update IoT firmware and patch vulnerabilities

Tools, Technologies, and Solutions

Endpoint Anti-Malware and EDR

Email Security Gateways

Web Security and DNS Filtering

Mobile Threat Defense (MTD)

IoT/OT Security

Policy and Procedure Templates

Anti-Malware Policy Template

Risk Assessment and Treatment

Risk Assessment Matrix for Protection against malware

Audit and Compliance Checklist

Internal Audit Checklist (30 Questions)

Policy and Governance (5 Questions)

1. Is an anti-malware policy documented and approved?
2. Are anti-malware procedures documented (deployment, scanning, response)?
3. Is the policy reviewed annually?
4. Are roles and responsibilities for anti-malware management defined?
5. Is there a malware incident response plan?

Endpoint Protection (5 Questions)

6. Is anti-malware installed on all endpoints (desktops, laptops, mobile devices)?
7. Is real-time scanning enabled on all endpoints?
8. Are scheduled scans configured (daily quick, weekly full)?
9. Are anti-malware definitions up to date (within 24 hours)?
10. Is EDR deployed on all endpoints (or at least high-risk endpoints)?

Server Protection (5 Questions)

11. Is anti-malware installed on all servers?
12. Is server scanning configured to minimize performance impact?
13. Are server anti-malware definitions up to date?
14. Is EDR deployed on all servers?
15. Are cloud instances and containers protected?

Email and Web Protection (5 Questions)

16. Is an email security gateway deployed and scanning all attachments?
17. Is URL rewriting and sandboxing configured for email links?
18. Is a web security gateway or DNS filter deployed?
19. Are downloads scanned for malware?
20. Is SSL/TLS inspection enabled for web traffic?

Removable Media (5 Questions)

21. Is removable media scanned before use?
22. Is USB device control implemented (block unauthorized devices)?
23. Is autorun/autoplay disabled on all systems?
24. Is removable media usage logged and monitored?
25. Are personal USB devices prohibited on corporate systems?

User Awareness and Response (5 Questions)

26. Have all users received malware awareness training?
27. Are phishing simulations conducted regularly?
28. Is there a clear malware reporting channel for users?
29. Is the malware incident response procedure tested?
30. Are post-incident reviews conducted and documented?

Audit Scoring

• 30–27: Excellent (Green), Full compliance
• 26–22: Good (Yellow), Minor gaps, address within 30 days
• 21–15: Needs Improvement (Orange), Significant gaps, address within 60 days
• 14–0: Critical (Red), Major non-compliance, immediate action required

Metrics and KPIs

Key Performance Indicators

Common Pitfalls and How to Avoid Them

Pitfall 1: "Antivirus is Enough"

Problem: Organizations rely solely on traditional signature-based antivirus and believe they are protected. Modern malware (fileless, polymorphic, zero-day) easily bypasses signature-based detection. Ransomware encrypts entire networks while antivirus watches helplessly. Solution: Deploy Endpoint Detection and Response (EDR) with behavioral analysis, machine learning, and threat hunting. Use a multi-layered defense: email gateway, web filtering, EDR, network monitoring, user training. Traditional antivirus is a baseline, not a complete solution. EDR is essential for modern malware defense.

Pitfall 2: No Coverage for Non-Windows Systems

Problem: Organizations assume Linux and macOS don't need anti-malware. Linux servers are increasingly targeted by ransomware and cryptominers. Mac malware is growing rapidly (Silver Sparrow, XLoader, OSX/Stealer). Unprotected non-Windows systems become the weak link. Solution: Deploy anti-malware/EDR on all operating systems: Windows, macOS, Linux, iOS, Android. Use cloud-native agents for Linux servers. Ensure mobile devices have MTD. No operating system is immune to malware. Attackers target the platforms that are unprotected, not just the most common ones.

Pitfall 3: "Users Will Know Better"

Problem: Organizations assume users won't click phishing links or open malicious attachments. 70% of malware infections start with a phishing email. Users are human, they make mistakes, especially when emails look legitimate and urgent. Solution: Train users regularly, but also implement technical controls that don't rely on user judgment. Use email gateways to block malicious emails before they reach users. Use web filtering to block malicious downloads. Use EDR to detect and respond even if users make mistakes. Build a defense that assumes users will click and protects them anyway.

Pitfall 4: Ignoring Mobile and BYOD Devices

Problem: Organizations focus on laptops and servers but ignore mobile devices. Mobile malware is growing, especially for banking trojans (Anubis, EventBot) and spyware. BYOD devices accessing corporate email and data are often unprotected. Solution: Deploy Mobile Threat Defense (MTD) on all corporate devices and require it for BYOD. Use MDM to enforce security policies. Containerize corporate data on BYOD devices. Monitor mobile app behavior. Mobile devices are endpoints, treat them with the same security as laptops.

Pitfall 5: No Removable Media Controls

Problem: Organizations allow unrestricted USB usage with no scanning. A single infected USB can spread malware across the entire network in minutes. Stuxnet, the most famous industrial malware, spread via USB. Solution: Implement USB device control (block unauthorized devices, allow only approved devices). Enable automatic scanning of all removable media. Disable autorun/autoplay. Use DLP to monitor data copying. Educate users on the risks of using personal USB drives on corporate systems. Removable media is a classic attack vector that is still highly effective.

Pitfall 6: No Ransomware-Specific Preparation

Problem: Organizations have generic malware protection but no specific ransomware preparedness. When ransomware hits, they have no immutable backups, no incident response plan, no communication strategy, and no legal guidance. They panic and pay the ransom. Solution: Implement ransomware-specific defenses: (1) Application control/allowlisting to block unauthorized executables, (2) Immutable backups (air-gapped, offline, cloud with versioning), (3) EDR with ransomware behavior detection, (4) File integrity monitoring, (5) Incident response plan specific to ransomware, (6) Legal pre-approval for response actions, (7) Cyber insurance with ransomware coverage, (8) Annual ransomware response drill. Ransomware is not "if" but "when", prepare accordingly.

Pitfall 7: Outdated Signatures and No Behavioral Detection

Problem: Anti-malware is deployed but signatures are weeks old. The system relies entirely on signature-based detection with no heuristics or behavioral analysis. New malware variants walk right past the outdated defenses. Solution: Configure automatic updates for signatures and engines (multiple times per day). Use behavioral detection and machine learning to catch zero-day threats. Monitor update status centrally and alert on outdated definitions. Test detection regularly with safe test samples. Anti-malware with old signatures is only slightly better than no anti-malware.

Pitfall 8: No Incident Response Practice

Problem: Organizations have a malware incident response plan but never practice it. When a real incident occurs, the team doesn't know who to call, what to do first, or how to contain the infection. The response is chaotic and ineffective. Solution: Conduct tabletop exercises quarterly for malware incidents. Practice with simulated infections (use safe test malware or purple team exercises). Test backup recovery procedures. Validate communication chains. Time the response and identify bottlenecks. Update the plan based on lessons learned. An untested plan is just a document, not a capability.

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian Manufacturing SME, Ransomware Recovery (Growing company)

Organization: A 250-employee manufacturing SME in Ahmedabad producing automotive components Challenge: The company had no EDR, no email security gateway, and no immutable backups. Their "anti-malware" was a free antivirus on 30% of endpoints that hadn't been updated in 6 months. An employee clicked a phishing email that appeared to be from a supplier. The email contained a malicious Excel macro that downloaded LockBit ransomware. Within 4 hours, the ransomware had encrypted all 200 endpoints, 15 servers, and the file server containing 5 years of engineering drawings, production schedules, and financial records. The attacker demanded in Bitcoin. The company had no incident response plan. They tried to pay but the ransom payment process failed (they didn't know how to buy Bitcoin). They eventually paid through an intermediary but the decryption key only worked on 60% of files. The remaining 40% were lost permanently. The company was offline for 3 weeks. They lost a major automotive client due to missed delivery deadlines. Total overhead: . Before State:

• Free antivirus on 30% of endpoints; 70% had no anti-malware
• No anti-malware on servers ("it slows them down")
• No email security gateway; phishing emails reached users directly
• No web filtering; users could access any website
• No removable media controls; USB drives used freely
• No EDR or behavioral detection
• No user training on malware or phishing
• No immutable backups; backups were on a network share that was also encrypted
• No incident response plan; no ransomware-specific procedures
• No cyber insurance

Implementation (Post-Incident): Month 1: Emergency security overhaul. Deployed CrowdStrike Falcon EDR on all endpoints and servers. Implemented email security gateway (Microsoft Defender for Office 365). Deployed web filtering (Cisco Umbrella). Month 2: Implemented immutable backups (Veeam with air-gapped backup and cloud storage with versioning). Implemented application control (allowlisting) on all servers and critical endpoints. Month 3: Conducted company-wide malware awareness training. Implemented quarterly phishing simulations. Established clear malware reporting channels. Month 4: Implemented USB device control and removable media scanning. Disabled autorun on all systems. Month 5: Implemented network segmentation (separated production, office, and guest networks). Deployed IDS/IPS for east-west traffic monitoring. Month 6: Developed and tested ransomware incident response plan. Conducted tabletop exercise with leadership, legal, and IT. Purchased cyber insurance. Month 7: Implemented Mobile Threat Defense for all company mobile devices. Enrolled devices in MDM. Month 8: Conducted internal audit. All systems compliant. Zero malware incidents in 6 months.

Results (After 12 Months):

• 100% endpoint and server coverage with EDR
• 100% email security gateway coverage
• 100% web filtering coverage
• 100% immutable backup implementation with quarterly recovery testing
• 100% user training completion; phishing simulation pass rate: 85%
• Zero malware incidents in 12 months (vs. 3 in the previous year)
• Network segmentation reduced potential spread by 80%
• Cyber insurance purchased with ransomware coverage
• Incident response plan tested and validated quarterly
• Total investment: Investment: (EDR, email security, web filtering, backups, training, network segmentation, MDM, cyber insurance) ROI: The ransomware incident nearly bankrupted the company. The investment in proper malware protection is 3% of the impact of the incident. The company regained customer trust and won back the automotive client after demonstrating the security overhaul. For growing manufacturers, malware protection is not just IT security, it is business survival.

Key Lesson: A single malware incident can destroy a growing company. The impact of proper protection is trivial compared to the impact of an incident. Ransomware is not an IT problem, it is a business continuity, legal, financial, and reputational problem.

Illustrative Scenario 2: Large Indian Bank, Advanced Malware Defense Transformation

Organization: A large private sector bank with 1,500 branches, 25 million customers, and 10,000 employees Challenge: The bank had traditional antivirus on endpoints and servers but no EDR, no email sandboxing, and no behavioral detection. The bank experienced 3 malware incidents in 6 months: (1) A banking trojan (Dridex) stole credentials from 50 customer service representatives, (2) A worm spread through the branch network, causing 200 branches to lose connectivity for a day, (3) A ransomware attack on the development environment encrypted test data and source code. The RBI issued a show-cause notice and required a complete malware defense overhaul within 90 days. The bank's CISO was given a mandate to implement bank-grade malware protection. Before State:

• Traditional signature-based antivirus on 80% of endpoints; 20% had no protection
• No EDR on any endpoint or server
• No email security gateway (relied on basic Office 365 filtering)
• No web filtering or DNS security
• No removable media controls
• No network segmentation between branches and data center
• No malware-specific incident response plan
• No threat intelligence integration
• Quarterly user training (ineffective, outdated content)
• No mobile threat defense for banking apps
• 3 malware incidents in 6 months; average MTTR: 48 hours

Implementation: Phase 1 (Months 1–2): Emergency EDR deployment. Deployed Palo Alto Cortex XDR across all 10,000 endpoints and 500 servers. Integrated with existing SIEM. Implemented threat intelligence feeds. Deployed email security gateway (Proofpoint TAP) with sandboxing and URL rewriting. Phase 2 (Months 3–4): Network and perimeter security. Deployed web security gateway (Zscaler) with SSL inspection. Implemented DNS filtering (Cisco Umbrella). Deployed network segmentation between branches, data center, and cloud. Implemented IDS/IPS for east-west traffic. Phase 3 (Months 5–6): Advanced detection and response. Implemented threat hunting team (3 FTEs). Deployed deception technology (honeypots) in the data center. Implemented file integrity monitoring (FIM) on critical files. Integrated EDR with SOAR for automated response. Phase 4 (Months 7–8): User awareness and training. Implemented complete malware awareness program. Quarterly phishing simulations with gamification. Executive briefing on malware risks. Branch staff training on removable media and phishing. Phase 5 (Months 9–10): Mobile and application security. Deployed Mobile Threat Defense (Lookout) for all corporate mobile devices. Implemented app security for mobile banking apps. Containerized corporate data on BYOD devices. Phase 6 (Months 11–12): Ransomware-specific preparedness. Implemented immutable backups (Veeam with air-gapped tape and cloud). Application control (allowlisting) on all servers and critical workstations. Tested ransomware response plan with full-scale drill. Purchased cyber insurance with ransomware coverage.

Results (After 18 Months):

• 100% EDR coverage on all endpoints and servers
• 100% email security gateway coverage with sandboxing
• 100% web filtering and DNS security coverage
• 100% network segmentation between branches, DC, and cloud
• 100% removable media control and scanning
• 100% immutable backup implementation with quarterly recovery testing
• 100% user training completion; phishing simulation pass rate: 92%
• Threat hunting team identified 15 potential threats before they became incidents
• Deception technology detected 3 intrusion attempts in the first 6 months
• SOAR automated response reduced MTTR from 48 hours to 2 hours
• Zero successful malware incidents in 18 months (vs. 3 in 6 months before)
• RBI show-cause notice resolved; no penalty imposed
• Bank received "Best Security Practices" award from industry association

Investment: (EDR, email security, web filtering, network segmentation, deception, SOAR, training, backups, mobile security, cyber insurance) ROI: Avoided RBI penalties estimated at . The 3 malware incidents overhead in recovery, customer notification, and remediation. Prevented potential customer data breach that could have overhead in fines and lawsuits. The investment in advanced malware defense was justified by risk reduction and regulatory compliance. The bank's security posture became a competitive advantage in customer acquisition.

Key Lesson: For large, regulated organizations like banks, malware protection is not just about tools, it is about a complete program with people, processes, and technology. The RBI's pressure accelerated transformation, but the bank's proactive approach turned a compliance mandate into a security advantage. Advanced malware defense (EDR, XDR, threat hunting, deception) is the new standard for enterprise security.

Multi-Framework Mapping

ISO 27001:2022 A.8.7 to Other Frameworks

NIST 800-53 Rev 5:

• SI-3: Malicious Code Protection, Maps to anti-malware deployment, updates, and scanning
• SI-4: Information System Monitoring, Maps to EDR and advanced detection
• AT-2: Security Awareness Training, Maps to user awareness and phishing training
• MP-7: Media Use, Maps to removable media controls
• SC-7: Boundary Protection, Maps to email and web gateway security

PCI DSS v4.0:

• Requirement 5.1: Anti-malware processes and procedures for all systems
• Requirement 5.2: Anti-malware mechanisms (personal firewall, anti-malware for mobile)
• Requirement 5.3: Anti-malware for mobile and employee-owned devices
• Requirement 12.6: Security awareness training

SOC 2 CC7.2:

• System monitoring for malicious software and unauthorized software

CIS Controls v8:

• CIS Control 10: Malware Defenses, Anti-malware deployment, scanning, removable media, phishing, EDR

Regulatory and Industry Context

India-Specific Regulatory Requirements

RBI Cyber Security Framework:

• All endpoints and servers must have anti-malware with real-time scanning
• Anti-malware definitions must be updated at least daily
• Email and web security gateways are mandatory for banks
• Malware incidents must be reported to RBI within 2 hours of detection
• Annual cyber audit must review anti-malware coverage, effectiveness, and incident response
• Ransomware preparedness is mandatory (immutable backups, incident response plan)
• Application control (allowlisting) is recommended for critical systems

SEBI Cybersecurity Circular:

• Trading systems must have anti-malware with behavioral detection
• Email and web security must be implemented for all staff
• Malware incidents affecting trading systems must be reported immediately
• Annual compliance audit must include anti-malware review
• Insider trading surveillance systems must be protected from malware tampering

IRDAI Guidelines:

• Insurance company systems must have anti-malware on all endpoints and servers
• Customer data systems must have enhanced malware protection (EDR, email security)
• Malware incidents affecting customer data must be reported to IRDAI

CERT-In Guidelines:

• Organizations must report malware incidents (especially ransomware) to CERT-In
• CERT-In provides malware analysis and IoC sharing for Indian organizations
• Organizations are encouraged to participate in threat intelligence sharing
• Ransomware incidents must be reported within 24 hours

IT Act 2000 (as amended):

• Section 43: Penalty for failure to protect computer systems from malware
• Section 66: Computer-related offenses involving malware creation and distribution
• Section 66C: Identity theft via malware (phishing, keyloggers)
• Section 66D: Cheating by personation via malware

Industry-Specific Context

BFSI:

• Banking trojans (Dridex, TrickBot, QakBot) are the top malware threat
• Ransomware attacks on banks are increasing (LockBit, Cl0p, BlackCat)
• ATM malware (Ploutus, Cutlet Maker) targets cash dispensing
• SWIFT fraud malware (Dridex, Odinaff) targets international transfers
• RBI mandates anti-malware on all systems; penalties for non-compliance
• Mobile banking apps must be protected against mobile malware
• Trading systems must have behavioral detection for fileless malware

Healthcare:

• Healthcare is the #1 target for ransomware (WannaCry, NotPetya, Ryuk)
• Medical devices are vulnerable to malware (pacemakers, MRI machines, infusion pumps)
• Patient data is valuable on the dark web, driving spyware and data theft
• NABH accreditation requires anti-malware and incident response
• COVID-19 increased healthcare malware attacks by 45%
• DPDP Act penalties for patient data breaches are severe (up to )

Manufacturing:

• Industrial malware (Stuxnet, TRITON, Industroyer) targets SCADA/ICS systems
• Ransomware attacks on manufacturing cause production shutdowns
• IP theft via malware is a major concern for manufacturing R&D
• Supply chain malware ( SolarWinds-style) affects manufacturing software
• IoT devices on the factory floor are vulnerable to botnets and cryptominers
• IS/IEC 62443 (industrial cybersecurity) requires malware protection for ICS

Government/Defense:

• Nation-state APT malware (APT29, APT28, Lazarus) targets government systems
• Critical infrastructure malware (power grid, water supply, telecom) is a national security threat
• Ransomware attacks on government portals (municipal corporations, state departments) are common
• Ministry of Home Affairs and NCIIPC provide malware threat intelligence for critical infrastructure
• Government systems must report malware to CERT-In and NCIIPC
• Defense systems require air-gapping and specialized malware protection

SaaS/Cloud:

• Cloud-native malware (cryptominers in containers, serverless abuse) is a growing threat
• Supply chain attacks (malicious npm packages, PyPI packages, Docker images) affect SaaS development
• API abuse and credential theft via malware are common SaaS threats
• Multi-tenant SaaS must protect against cross-tenant malware spread
• Cloud workload protection platforms (CWPP) are essential for cloud malware defense
• Customer trust requires demonstrated malware protection in SaaS operations

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Continuous Improvement

Maturity Model for A.8.7

Continuous Improvement Activities

Monthly:

• Anti-malware coverage and currency review
• Malware detection and incident analysis
• Signature update status verification
• Phishing simulation results analysis
• User-reported suspicious email analysis
• EDR alert review and tuning

Quarterly:

• Anti-malware policy review
• Threat landscape update and defense adjustment
• Phishing simulation exercise
• Malware incident response tabletop exercise
• Backup and recovery test (ransomware scenario)
• EDR/AV effectiveness review and tuning
• Internal audit of anti-malware controls
• User training refresh

Annually:

• Full anti-malware policy review
• Complete malware risk assessment
• Technology evaluation (new EDR, new threat intel, new detection methods)
• Benchmark against industry best practices
• External audit preparation
• Maturity assessment against target level
• Cyber insurance review and renewal
• Vendor security assessment (anti-malware vendor)

Trigger-Based:

• After any malware incident (especially ransomware)
• Upon new threat intelligence (new malware family, new IoCs)
• Upon new regulatory requirement
• After significant audit findings
• Upon new technology or vendor capability
• After industry peer incident ("could this happen to us?")

FAQ

Q1: Is traditional antivirus still necessary, or is EDR enough? A: Traditional antivirus (signature-based) is still a useful baseline, but it is not sufficient on its own. EDR provides behavioral detection, machine learning, threat hunting, and response capabilities that AV lacks. Best practice: Use both. Use AV for known malware and baseline protection. Use EDR for advanced threats, zero-day malware, and incident response. Many modern EDR platforms include AV functionality (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon). If budget is limited, prioritize EDR over standalone AV.

Q2: How often should anti-malware signatures be updated? A: At minimum, daily. Modern threats require more frequent updates. Best practice: Configure automatic updates every 1–4 hours. Use real-time cloud lookups for instant threat intelligence. Ensure that "out-of-date" definitions are flagged as a compliance issue. Some organizations update every 15 minutes for critical systems. The faster the update cycle, the better the protection against emerging threats.

Q3: What is the difference between EDR and XDR? A: EDR (Endpoint Detection and Response) focuses on endpoints only. It detects and responds to threats on desktops, laptops, and servers. XDR (Extended Detection and Response) extends detection across multiple security layers: endpoints, network, email, cloud, identity. XDR correlates data from these sources to detect complex, multi-stage attacks. EDR is essential for all organizations. XDR is valuable for larger organizations with mature security programs. Start with EDR; add XDR when you have the resources and need for cross-correlation.

Q4: How do we protect against fileless malware? A: Fileless malware operates in memory without writing files to disk, evading signature-based detection. Protection: (1) EDR with memory scanning and behavioral detection, (2) PowerShell constraints and logging (PowerShell is a common fileless vector), (3) Application control (allowlisting) to block unauthorized scripts, (4) WMI and registry monitoring for persistence mechanisms, (5) Network monitoring for C2 communication, (6) Threat hunting for anomalous memory activity. Fileless malware requires behavioral and memory-based detection, not just file scanning.

Q5: Should we pay the ransom if hit by ransomware? A: Generally, no. Paying the ransom does not guarantee decryption, does not prevent data publication, funds criminal activity, and may violate laws (OFAC sanctions, anti-money laundering). Alternatives: (1) Restore from immutable backups, (2) Use free decryption tools if available (NoMoreRansom.org), (3) Engage law enforcement and incident response firms, (4) Rebuild systems from scratch. Only consider paying as an absolute last resort after legal consultation, and never without involving law enforcement. The best ransomware defense is preparation (backups, IR plan, EDR) so that paying is unnecessary.

Q6: How do we handle malware on Linux systems? A: Linux malware is growing (cryptominers, ransomware, rootkits). Protection: (1) Deploy Linux-compatible EDR (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint), (2) Use application control (SELinux, AppArmor) to restrict executable permissions, (3) Monitor for unauthorized cron jobs and systemd services (common persistence mechanisms), (4) Monitor network connections for C2 communication, (5) Use file integrity monitoring (FIM) for critical system files, (6) Keep Linux kernels and packages updated, (7) Use container scanning for Linux container images. Do not assume Linux is immune to malware.

Q7: What is the most common audit finding for A.8.7? A: The most common findings are: (1) Anti-malware not on all endpoints (especially Linux, macOS, and non-Windows servers), (2) Outdated signatures (>24 hours old), (3) No EDR or behavioral detection, (4) No email security gateway, (5) No web filtering, (6) No removable media controls, (7) No user training, (8) No malware-specific incident response plan, (9) No ransomware preparedness (no immutable backups, no application control). Auditors will check coverage, currency, detection capabilities, and incident response readiness.

Q8: How do we balance security with user productivity (anti-malware performance impact)? A: Modern EDR solutions are designed to have minimal performance impact. Strategies: (1) Use lightweight agents for high-performance servers, (2) Schedule full scans during maintenance windows, (3) Exclude database files, log files, and temp directories from real-time scanning, (4) Use cloud-based scanning to reduce local resource usage, (5) Optimize scan settings for business-critical systems, (6) Choose EDR solutions with proven low system impact, (7) Monitor system performance after deployment and tune accordingly. The performance impact of modern EDR is typically <5% CPU. The security benefit far outweighs the minimal performance overhead.

Q9: How do we protect against supply chain malware (e.g., SolarWinds, Kaseya)? A: Supply chain malware is delivered through trusted software vendors. Protection: (1) Vendor security assessment before procurement, (2) Software integrity verification (code signing, hash verification) before installation, (3) Network segmentation for vendor management systems, (4) Monitor vendor software for anomalous behavior (EDR, network monitoring), (5) Least privilege for vendor software accounts, (6) Regular vendor security reviews, (7) Threat intelligence on vendor compromises, (8) Have a response plan for vendor security incidents. Supply chain attacks are difficult to prevent but detectable with good monitoring and segmentation.

Q10: What is the impact of implementing A.8.7 for a growing company? A: For a 200-person company with 250 endpoints and 50 servers: EDR (–/year), email security gateway (–/year), web filtering (–/year), backup/immutability (–/year), training (–/year). Total: –/year. Many solutions are bundled (Microsoft 365 E5 includes Defender for Endpoint, Defender for Office 365, and cloud security). The impact of a single ransomware incident for a growing company is –20 crore. The investment in malware protection is 1–5% of the potential incident overhead.

Q11: How do we handle malware in cloud-native environments (containers, serverless)? A: Cloud-native malware protection requires specialized approaches: (1) Scan container images for malware before deployment (Snyk, Aqua, Twistlock), (2) Use runtime protection for containers (Falco, Aqua, Sysdig), (3) Monitor serverless functions for anomalous behavior, (4) Use cloud-native EDR (Microsoft Defender for Cloud, CrowdStrike Falcon for cloud), (5) Implement container network segmentation, (6) Monitor cloud API calls for unauthorized access, (7) Use infrastructure-as-code security scanning. Cloud-native malware is a growing threat, cryptominers in containers, malicious serverless functions, and compromised cloud credentials are common.

Q12: What is the role of threat intelligence in malware protection? A: Threat intelligence provides context about current malware threats, IoCs, and attacker tactics. It enhances malware protection by: (1) Feeding IoCs into EDR/SIEM for detection, (2) Informing email/web filtering rules, (3) Guiding threat hunting activities, (4) Providing early warning of new malware families, (5) Supporting incident response with attribution and context, (6) Informing security awareness training content. Threat intelligence transforms reactive anti-malware into proactive defense. Sources: commercial feeds (Recorded Future, Mandiant), government feeds (CERT-In, NCIIPC), open-source feeds (MISP, AlienVault OTX), and industry sharing (ISACs).

Q13: How do we handle malware on air-gapped or isolated systems? A: Air-gapped systems cannot receive online updates but still need protection: (1) Install anti-malware with local signatures and manual update procedures, (2) Update signatures via approved removable media that is scanned before use, (3) Implement strict removable media controls (no personal media, only approved media), (4) Use application control (allowlisting) to block unauthorized executables, (5) Monitor system behavior for anomalies, (6) Implement physical security controls (A.7) to prevent unauthorized access, (7) Use deception technology (honeypots) to detect intrusion attempts. Air-gapped systems are protected by isolation, but they are not immune, Stuxnet proved that. Physical security and media controls are critical.

Q14: What is the difference between blacklisting and allowlisting (application control)? A: Blacklisting (default allow) blocks known bad applications and allows everything else. It is easier to implement but less secure (unknown malware is allowed). Allowlisting (default deny) allows only approved applications and blocks everything else. It is more secure but harder to implement (requires inventorying and approving all legitimate applications). For malware protection, allowlisting is far superior: it blocks ransomware, unknown malware, and unauthorized software by default. Blacklisting catches known malware but misses unknown variants. Best practice: Use allowlisting for critical systems (servers, finance, trading) and blacklisting for general user endpoints. Implement allowlisting gradually to avoid business disruption.

Q15: How do we measure the effectiveness of our malware protection program? A: Measure effectiveness through metrics: (1) Coverage (100% of endpoints/servers with anti-malware), (2) Currency (98%+ with up-to-date definitions), (3) Detection rate (malware detected before harm), (4) False positive rate (<1%), (5) Time to detect (MTTD), (6) Time to respond (MTTR), (7) Incident count (trending down), (8) User reporting rate (users actively reporting suspicious activity), (9) Phishing simulation pass rate (≥80%), (10) Backup recovery success rate (100% for ransomware tests). Also conduct red team/purple team exercises to test detection and response. The ultimate measure is: "How many malware incidents caused business impact?" The target is zero.

References and Further Reading

Standards and Frameworks

• ISO/IEC 27001:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Management Systems, Requirements
• ISO/IEC 27002:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Controls
• NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-83, Guide to Malware Incident Prevention and Handling
• PCI DSS v4.0, Payment Card Industry Data Security Standard
• CIS Controls v8, CIS Controls Version 8
• COBIT 2019, Control Objectives for Information and Related Technologies

Indian Regulations

• RBI Cyber Security Framework for Banks
• SEBI Circular CIR/ISD/2019 on Cyber Security and Cyber Resilience
• CERT-In Guidelines for Information Security Practices
• Information Technology Act, 2000 (as amended)
• Digital Personal Data Protection Act, 2023 (India)

Books and Publications

• ISO 27001/27002: A Pocket Guide by Alan Calder
• The Art of Deception by Kevin Mitnick (social engineering and malware delivery)
• Malware Analyst's Cookbook by Michael Ligh, Steven Adair, Blake Hartstein, and Matthew Richard
• Practical Malware Analysis by Michael Sikorski and Andrew Honig
• NIST 800-83: Guide to Malware Incident Prevention and Handling (NIST)

Threat Intelligence Resources

• CERT-In: https://www.cert-in.org.in
• NCIIPC: https://www.nciipc.gov.in
• MISP (Malware Information Sharing Platform): https://www.misp-project.org
• NoMoreRansom: https://www.nomoreransom.org
• VirusTotal: https://www.virustotal.com
• ID Ransomware: https://id-ransomware.malwarehunterteam.com