ISO 27001 A.8.7: Protection Against Malware

Quick Reference (60 Seconds)

Bottom Line: Malware is one of the most common and damaging threats to organizations. A single malware infection can lead to data theft, ransomware encryption, system compromise, and business disruption. Protection against malware requires a multi-layered defense: prevention, detection, and response. This is not just about antivirus, it's about a complete anti-malware strategy.

What the Control Asks For

In short:

ISO 27001:2022 Annex A 8.7 asks organizations to protect information and associated assets against malware, supported by user awareness.

Do you need this control?

A.8.7 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Almost every organisation includes it. The usual adaptation is choosing the mix of measures (EDR, allowlisting, email and web filtering, user awareness) for your environment, including systems that cannot run anti-malware.

What ISO 27002:2022 Adds

27002 8.7 (paraphrased) says protection should combine malware detection and repair software with awareness, appropriate access control and change management: anti-malware software alone is not usually enough. It suggests:

• (a) rules and controls to prevent or detect unauthorised software, such as application allowlisting (see 8.19, 8.32)
• (b) controls to prevent or detect use of known or suspected malicious websites (blocklisting)
• (c) reducing exploitable vulnerabilities (8.8, 8.19)
• (d) regular automated validation of software and data on critical systems, investigating unapproved files or changes
• (e) protection against risks from files and software obtained from external networks or media
• (f) installing and updating malware detection, scanning data received over networks or media, email and messaging attachments and downloads (at several points, such as mail servers and endpoints), and web pages when accessed
• (g) placing detection tools by risk, using defence in depth (gateways, endpoints, servers) and allowing for evasive techniques such as encrypted files and encrypted transport
• (h) protecting against malware introduced during maintenance and emergency procedures, which can bypass normal controls
• (i) a formal process to disable anti-malware temporarily or permanently, with an approver, documented justification and review date
• (j) business continuity plans for recovering from malware, with online and offline backups (8.13)
• (k) isolating environments where consequences could be catastrophic
• (l) procedures and responsibilities, including training, reporting and recovery
• (m) awareness for all users (6.3)
• (n) and (o) regularly collecting information on new malware from reputable sources and checking warnings are genuine

27002 also notes that some systems (for example industrial control systems) cannot run anti-malware, so other controls must protect them.

Why Protection against malware Matters

The Malware Threat Landscape

Malware is a persistent, evolving threat that affects organizations of all sizes. From ransomware that encrypts entire networks to spyware that steals credentials, malware is a primary attack vector for cybercriminals.

Key Statistics

• Ransomware was present in 44% of breaches reviewed in the Verizon DBIR 2025, up from 32% the year before
• Phishing and malicious attachments remain leading delivery routes for malware
• Malware-based attacks are reportable in India: the CERT-In Directions (2022) list ransomware and malicious code attacks among incidents to report within 6 hours of noticing

How It Goes Wrong (hypothetical patterns)

• A manufacturing company in Pune was hit by ransomware (LockBit) that encrypted all 500 endpoints and servers. The attacker demanded a ransom. The company had no backups and no incident response plan. Total cost included recovery, downtime, and reputation loss.
• A bank employee clicked a phishing link that downloaded a banking trojan. The trojan stole credentials for 200 customer accounts. The bank had to freeze accounts, reset passwords, and notify regulators. The bank reported the incident to RBI and CERT-In and faced supervisory scrutiny.
• A healthcare clinic's systems were infected with spyware that exfiltrated 50,000 patient records over 6 months. The clinic had no endpoint detection. The data was sold on the dark web. Once the DPDP Rules apply, a breach like this must be intimated to the Data Protection Board and every affected patient, and lawsuits from patients.
• A logistics company's dispatch system was infected with a worm that spread across the entire network in 2 hours. All delivery tracking, routing, and invoicing systems were down for 3 days. The company lost revenue to delayed deliveries and contractual penalties.
• An employee used a USB drive from a cyber café on an office laptop. The USB contained a worm that infected the entire network, spreading to 200 machines. The company had no removable media scanning policy. Recovery took 2 weeks.

Regulatory and Business Drivers

• CERT-In Directions (2022): ransomware and malicious code attacks are reportable within 6 hours of noticing
• RBI, SEBI CSCRF (2024) and IRDAI (2023) expect anti-malware and incident reporting within their own windows (RBI typically 2 to 6 hours)
• DPDP Act 2023 requires reasonable security safeguards, including protection against malware that could compromise personal data
• IT Act 2000 s.43 and s.66 make introducing malware an offence; s.43A covers negligence with sensitive personal data (until DPDP s.44(2) commences)
• ISO 27001: A.8.7 is one of the Annex A controls you consider when treating risk (clause 6.1.3). If your risk assessment calls for it, it goes in your Statement of Applicability with how it is implemented; if not, you record why it is excluded
• PCI DSS v4.0.1 Requirement 5 requires anti-malware on systems at risk, with periodic evaluation of those not at risk (5.2.3)
• SOC 2 CC6.8 requires preventing or detecting unauthorised or malicious software
• Cyber Insurance policies increasingly require proof of anti-malware controls as a condition of coverage

Scope and Applicability

What Is Covered

• All endpoint devices (desktops, laptops, tablets, mobile phones, thin clients)
• All servers (physical, virtual, cloud instances, containers)
• All network infrastructure (firewalls, routers, switches, load balancers, VPN concentrators)
• All email systems (on-premise, cloud-based, hybrid)
• All web gateways and proxies
• All removable media (USB drives, external hard drives, SD cards, CDs/DVDs)
• All file shares and storage systems
• All cloud services and SaaS applications with file upload/download capabilities
• All remote access endpoints and VPN clients
• All IoT devices and embedded systems
• All development and test environments

What Is Not Covered

• Air-gapped systems with no connectivity and no removable media (though physical security controls apply)
• Systems with approved exceptions (documented, risk-assessed, and approved by CISO)
• Personal devices not used for business (BYOD policies may require anti-malware)

Applicability by Organization Type

Key Definitions and Terminology

Relationship to Other Controls

Implementation Roadmap (Week-by-Week)

Week 1: Malware Risk Assessment and Inventory

• Assess current malware threat landscape for the organization
• Inventory all endpoints, servers, network devices, and mobile devices
• Identify current anti-malware solutions and their coverage gaps
• Review recent malware incidents and near-misses
• Identify high-risk users and systems (executives, finance, admins, developers)
• Assess email security and web filtering capabilities
• Review removable media usage and controls
• Document current state and risk assessment

Week 2: Policy and Strategy Development

• Draft anti-malware policy and procedures
• Define anti-malware strategy (prevention, detection, response)
• Define deployment requirements (all endpoints, all servers, mobile devices)
• Define scanning schedules (real-time, daily, weekly, on-demand)
• Define update requirements (signature updates, engine updates, heuristics)
• Define removable media policy (scanning, restrictions, exceptions)
• Define email and web protection requirements
• Define incident response procedures for malware infections
• Define user awareness and training requirements

Week 3: Anti-Malware Solution Selection and Deployment

• Evaluate anti-malware solutions (traditional AV, EDR, XDR, cloud-native)
• Select solution based on coverage, detection rates, performance
• Deploy anti-malware on all endpoints (desktops, laptops, mobile devices)
• Deploy anti-malware on all servers (physical, virtual, cloud)
• Deploy email security gateway (if not already present)
• Deploy web security gateway (if not already present)
• Configure real-time scanning and on-access protection
• Configure scheduled scanning (daily quick scan, weekly full scan)
• Configure automatic updates for signatures and engine

Week 4: Advanced Detection and Response (EDR/XDR)

• Deploy Endpoint Detection and Response (EDR) for advanced threat detection
• Configure behavioral analysis and machine learning detection
• Configure sandboxing for suspicious files
• Set up threat intelligence feeds and IoC integration
• Configure automated response actions (isolate, kill process, quarantine)
• Deploy XDR if budget allows (correlates endpoint, network, email, cloud)
• Configure alert rules and severity levels
• Integrate EDR/XDR with SIEM for centralized monitoring
• Test detection and response capabilities with simulated malware

Week 5: Removable Media and Email/Web Controls

• Implement removable media scanning (scan all USB drives before use)
• Deploy Data Loss Prevention (DLP) for USB monitoring (if needed)
• Configure email security gateway to scan all attachments and URLs
• Implement URL rewriting and sandboxing for email links
• Configure web filtering to block malicious websites and downloads
• Implement download scanning for all web downloads
• Configure macro security for Office documents (disable macros by default)
• Implement attachment sandboxing for suspicious email attachments
• Configure anti-phishing and anti-spoofing in email gateway

Week 6: User Training and Awareness

• Develop malware awareness training program
• Train all users on phishing, safe browsing, and removable media
• Conduct phishing simulation exercises
• Create malware incident reporting procedures and channels
• Distribute quick reference guides for malware identification and reporting
• Train IT staff on malware incident response and forensics
• Train help desk on malware triage and initial response
• Create awareness materials (posters, emails, intranet content)

Week 7: Testing, Validation, and Hardening

• Test anti-malware detection with EICAR test file and safe malware samples
• Test EDR behavioral detection with simulated attack scenarios
• Test email security gateway with test phishing emails
• Test web filtering with known malicious URLs
• Verify removable media scanning with test files
• Conduct vulnerability scan to identify malware entry points
• Harden systems (disable unnecessary services, restrict macros, patch vulnerabilities)
• Test malware incident response procedure with tabletop exercise
• Validate backup and recovery procedures for ransomware scenarios

Week 8: Documentation, Monitoring, and Audit

• Document all anti-malware configurations and policies
• Create malware incident response playbook
• Set up monitoring dashboards for anti-malware status and alerts
• Configure reporting for compliance (coverage, detection rates, update status)
• Conduct internal audit of malware protection implementation
• Verify all systems have anti-malware installed and updating
• Verify email and web protection is operational
• Prepare for external audit
• Plan for continuous improvement

Detailed Implementation Guidance

Anti-Malware Architecture

Defense-in-Depth Layers:

Anti-Malware Deployment Strategy

Endpoint Deployment:

Server-Specific Anti-Malware Considerations:

• Exclude database files, log files, and temporary files from real-time scanning to avoid performance impact
• Schedule full scans during maintenance windows
• Use lightweight agents for high-performance servers (databases, trading systems)
• Ensure anti-malware does not interfere with backup operations
• Test anti-malware impact on server performance before production deployment

Email and Web Protection

Email Security Gateway Configuration:

Web Security Gateway Configuration:

Removable Media Controls

Removable Media Policy:

Ransomware-Specific Protection

Ransomware Defense Strategy:

Ransomware Response Checklist:

1. Isolate infected systems immediately (disconnect from network)
2. Identify the ransomware strain (use ID Ransomware, VirusTotal, or EDR)
3. Determine scope of infection (which systems, which data, encrypted vs. stolen)
4. Preserve evidence for forensics (memory dumps, logs, encrypted files)
5. Notify incident response team, CISO, legal, and leadership
6. Do not pay ransom without legal and law enforcement consultation
7. Assess backup availability and integrity (verify backups are not encrypted)
8. Initiate recovery from clean backups if available
9. Report to law enforcement (CERT-In for India, local police cyber cell)
10. Conduct post-incident review and strengthen defenses
11. Notify affected customers and regulators if data was compromised
12. Review cyber insurance policy and initiate claim if applicable

Mobile and IoT Malware Protection

Mobile Threat Defense (MTD):

IoT/OT Malware Protection:

• IoT devices often cannot run traditional anti-malware
• Use network-based detection (IDS/IPS, network traffic analysis)
• Segment IoT/OT networks from IT networks (A.8.22)
• Monitor IoT device behavior for anomalies (unexpected traffic, C2 communication)
• Implement firmware signing and secure boot where supported
• Use IoT security platforms (Armis, Claroty, Dragos) for specialized protection
• Regularly update IoT firmware and patch vulnerabilities

Tools, Technologies, and Solutions

Endpoint Anti-Malware and EDR

Email Security Gateways

Web Security and DNS Filtering

Mobile Threat Defense (MTD)

IoT/OT Security

Policy and Procedure Templates

Anti-Malware Policy Template

Risk Assessment and Treatment

Risk Assessment Matrix for Protection against malware

Audit and Compliance Checklist

Internal Audit Checklist (30 Questions)

Policy and Governance (5 Questions)

1. Is an anti-malware policy documented and approved?
2. Are anti-malware procedures documented (deployment, scanning, response)?
3. Is the policy reviewed annually?
4. Are roles and responsibilities for anti-malware management defined?
5. Is there a malware incident response plan?

Endpoint Protection (5 Questions)

6. Is anti-malware installed on all endpoints (desktops, laptops, mobile devices)?
7. Is real-time scanning enabled on all endpoints?
8. Are scheduled scans configured (daily quick, weekly full)?
9. Are anti-malware definitions up to date (within 24 hours)?
10. Is EDR deployed on all endpoints (or at least high-risk endpoints)?

Server Protection (5 Questions)

11. Is anti-malware installed on all servers?
12. Is server scanning configured to minimize performance impact?
13. Are server anti-malware definitions up to date?
14. Is EDR deployed on all servers?
15. Are cloud instances and containers protected?

Email and Web Protection (5 Questions)

16. Is an email security gateway deployed and scanning all attachments?
17. Is URL rewriting and sandboxing configured for email links?
18. Is a web security gateway or DNS filter deployed?
19. Are downloads scanned for malware?
20. Is SSL/TLS inspection enabled for web traffic?

Removable Media (5 Questions)

21. Is removable media scanned before use?
22. Is USB device control implemented (block unauthorized devices)?
23. Is autorun/autoplay disabled on all systems?
24. Is removable media usage logged and monitored?
25. Are personal USB devices prohibited on corporate systems?

User Awareness and Response (5 Questions)

26. Have all users received malware awareness training?
27. Are phishing simulations conducted regularly?
28. Is there a clear malware reporting channel for users?
29. Is the malware incident response procedure tested?
30. Are post-incident reviews conducted and documented?

Audit Scoring

• 30–27: Excellent (Green), Full compliance
• 26–22: Good (Yellow), Minor gaps, address within 30 days
• 21–15: Needs Improvement (Orange), Significant gaps, address within 60 days
• 14–0: Critical (Red), Major non-compliance, immediate action required

Metrics and KPIs

Key Performance Indicators

Common Pitfalls and How to Avoid Them

Pitfall 1: "Antivirus is Enough"

Problem: Organizations rely solely on traditional signature-based antivirus and believe they are protected. Modern malware (fileless, polymorphic, zero-day) easily bypasses signature-based detection. Ransomware encrypts entire networks while antivirus watches helplessly. Solution: Deploy Endpoint Detection and Response (EDR) with behavioral analysis, machine learning, and threat hunting. Use a multi-layered defense: email gateway, web filtering, EDR, network monitoring, user training. Traditional antivirus is a baseline, not a complete solution. EDR is essential for modern malware defense.

Pitfall 2: No Coverage for Non-Windows Systems

Problem: Organizations assume Linux and macOS don't need anti-malware. Linux servers are increasingly targeted by ransomware and cryptominers. Mac malware is growing rapidly (Silver Sparrow, XLoader, OSX/Stealer). Unprotected non-Windows systems become the weak link. Solution: Deploy anti-malware/EDR on all operating systems: Windows, macOS, Linux, iOS, Android. Use cloud-native agents for Linux servers. Ensure mobile devices have MTD. No operating system is immune to malware. Attackers target the platforms that are unprotected, not just the most common ones.

Pitfall 3: "Users Will Know Better"

Problem: Organizations assume users won't click phishing links or open malicious attachments. 70% of malware infections start with a phishing email. Users are human, they make mistakes, especially when emails look legitimate and urgent. Solution: Train users regularly, but also implement technical controls that don't rely on user judgment. Use email gateways to block malicious emails before they reach users. Use web filtering to block malicious downloads. Use EDR to detect and respond even if users make mistakes. Build a defense that assumes users will click and protects them anyway.

Pitfall 4: Ignoring Mobile and BYOD Devices

Problem: Organizations focus on laptops and servers but ignore mobile devices. Mobile malware is growing, especially for banking trojans (Anubis, EventBot) and spyware. BYOD devices accessing corporate email and data are often unprotected. Solution: Deploy Mobile Threat Defense (MTD) on all corporate devices and require it for BYOD. Use MDM to enforce security policies. Containerize corporate data on BYOD devices. Monitor mobile app behavior. Mobile devices are endpoints, treat them with the same security as laptops.

Pitfall 5: No Removable Media Controls

Problem: Organizations allow unrestricted USB usage with no scanning. A single infected USB can spread malware across the entire network in minutes. Stuxnet, the most famous industrial malware, spread via USB. Solution: Implement USB device control (block unauthorized devices, allow only approved devices). Enable automatic scanning of all removable media. Disable autorun/autoplay. Use DLP to monitor data copying. Educate users on the risks of using personal USB drives on corporate systems. Removable media is a classic attack vector that is still highly effective.

Pitfall 6: No Ransomware-Specific Preparation

Problem: Organizations have generic malware protection but no specific ransomware preparedness. When ransomware hits, they have no immutable backups, no incident response plan, no communication strategy, and no legal guidance. They panic and pay the ransom. Solution: Implement ransomware-specific defenses: (1) Application control/allowlisting to block unauthorized executables, (2) Immutable backups (air-gapped, offline, cloud with versioning), (3) EDR with ransomware behavior detection, (4) File integrity monitoring, (5) Incident response plan specific to ransomware, (6) Legal pre-approval for response actions, (7) Cyber insurance with ransomware coverage, (8) Annual ransomware response drill. Ransomware is not "if" but "when", prepare accordingly.

Pitfall 7: Outdated Signatures and No Behavioral Detection

Problem: Anti-malware is deployed but signatures are weeks old. The system relies entirely on signature-based detection with no heuristics or behavioral analysis. New malware variants walk right past the outdated defenses. Solution: Configure automatic updates for signatures and engines (multiple times per day). Use behavioral detection and machine learning to catch zero-day threats. Monitor update status centrally and alert on outdated definitions. Test detection regularly with safe test samples. Anti-malware with old signatures is only slightly better than no anti-malware.

Pitfall 8: No Incident Response Practice

Problem: Organizations have a malware incident response plan but never practice it. When a real incident occurs, the team doesn't know who to call, what to do first, or how to contain the infection. The response is chaotic and ineffective. Solution: Conduct tabletop exercises quarterly for malware incidents. Practice with simulated infections (use safe test malware or purple team exercises). Test backup recovery procedures. Validate communication chains. Time the response and identify bottlenecks. Update the plan based on lessons learned. An untested plan is just a document, not a capability.

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian Manufacturing SME, Ransomware Recovery (Growing company)

Organization: A 250-employee manufacturing SME in Ahmedabad producing automotive components Challenge: The company had no EDR, no email security gateway, and no immutable backups. Their "anti-malware" was a free antivirus on 30% of endpoints that hadn't been updated in 6 months. An employee clicked a phishing email that appeared to be from a supplier. The email contained a malicious Excel macro that downloaded LockBit ransomware. Within 4 hours, the ransomware had encrypted all 200 endpoints, 15 servers, and the file server containing 5 years of engineering drawings, production schedules, and financial records. The attacker demanded a ransom in Bitcoin. The company had no incident response plan. They tried to pay but the ransom payment process failed (they didn't know how to buy Bitcoin). The remaining 40% were lost permanently. The company was offline for 3 weeks. They lost a major automotive client due to missed delivery deadlines. Before State:

• Free antivirus on 30% of endpoints; 70% had no anti-malware
• No anti-malware on servers ("it slows them down")
• No email security gateway; phishing emails reached users directly
• No web filtering; users could access any website
• No removable media controls; USB drives used freely
• No EDR or behavioral detection
• No user training on malware or phishing
• No immutable backups; backups were on a network share that was also encrypted
• No incident response plan; no ransomware-specific procedures
• No cyber insurance

Implementation (Post-Incident): Month 1: Emergency security overhaul. Deployed CrowdStrike Falcon EDR on all endpoints and servers. Implemented email security gateway (Microsoft Defender for Office 365). Deployed web filtering (Cisco Umbrella). Month 2: Implemented immutable backups (Veeam with air-gapped backup and cloud storage with versioning). Implemented application control (allowlisting) on all servers and critical endpoints. Month 3: Conducted company-wide malware awareness training. Implemented quarterly phishing simulations. Established clear malware reporting channels. Month 4: Implemented USB device control and removable media scanning. Disabled autorun on all systems. Month 5: Implemented network segmentation (separated production, office, and guest networks). Deployed IDS/IPS for east-west traffic monitoring. Month 6: Developed and tested ransomware incident response plan. Conducted tabletop exercise with leadership, legal, and IT. Purchased cyber insurance. Month 7: Implemented Mobile Threat Defense for all company mobile devices. Enrolled devices in MDM. Month 8: Conducted internal audit. All systems compliant. Zero malware incidents in 6 months.

Results (After 12 Months):

• 100% endpoint and server coverage with EDR
• 100% email security gateway coverage
• 100% web filtering coverage
• 100% immutable backup implementation with quarterly recovery testing
• 100% user training completion; phishing simulation pass rate: 85%
• Zero malware incidents in 12 months (vs. 3 in the previous year)
• Network segmentation reduced potential spread by 80%
• Cyber insurance purchased with ransomware coverage
• Incident response plan tested and validated quarterly
• Investment covered EDR, email security, web filtering, backups, training, network segmentation, MDM and cyber insurance Outcome: The ransomware incident nearly bankrupted the company; the investment in proper malware protection was a small fraction of what the incident cost. The company regained customer trust and won back the automotive client after demonstrating the security overhaul. For growing manufacturers, malware protection is not just IT security, it is business survival.

Key Lesson: A single malware incident can destroy a growing company. The cost of proper protection is trivial compared to the cost of an incident. Ransomware is not an IT problem, it is a business continuity, legal, financial, and reputational problem.

Illustrative Scenario 2: Large Indian Bank, Advanced Malware Defense Transformation

Organization: A large private sector bank with 1,500 branches, 25 million customers, and 10,000 employees Challenge: The bank had traditional antivirus on endpoints and servers but no EDR, no email sandboxing, and no behavioral detection. The bank experienced 3 malware incidents in 6 months: (1) A banking trojan (Dridex) stole credentials from 50 customer service representatives, (2) A worm spread through the branch network, causing 200 branches to lose connectivity for a day, (3) A ransomware attack on the development environment encrypted test data and source code. The RBI issued a show-cause notice and required a complete malware defense overhaul within 90 days. The bank's CISO was given a mandate to implement bank-grade malware protection. Before State:

• Traditional signature-based antivirus on 80% of endpoints; 20% had no protection
• No EDR on any endpoint or server
• No email security gateway (relied on basic Office 365 filtering)
• No web filtering or DNS security
• No removable media controls
• No network segmentation between branches and data center
• No malware-specific incident response plan
• No threat intelligence integration
• Quarterly user training (ineffective, outdated content)
• No mobile threat defense for banking apps
• 3 malware incidents in 6 months; average MTTR: 48 hours

Implementation: Phase 1 (Months 1–2): Emergency EDR deployment. Deployed Palo Alto Cortex XDR across all 10,000 endpoints and 500 servers. Integrated with existing SIEM. Implemented threat intelligence feeds. Deployed email security gateway (Proofpoint TAP) with sandboxing and URL rewriting. Phase 2 (Months 3–4): Network and perimeter security. Deployed web security gateway (Zscaler) with SSL inspection. Implemented DNS filtering (Cisco Umbrella). Deployed network segmentation between branches, data center, and cloud. Implemented IDS/IPS for east-west traffic. Phase 3 (Months 5–6): Advanced detection and response. Implemented threat hunting team (3 FTEs). Deployed deception technology (honeypots) in the data center. Implemented file integrity monitoring (FIM) on critical files. Integrated EDR with SOAR for automated response. Phase 4 (Months 7–8): User awareness and training. Implemented complete malware awareness program. Quarterly phishing simulations with gamification. Executive briefing on malware risks. Branch staff training on removable media and phishing. Phase 5 (Months 9–10): Mobile and application security. Deployed Mobile Threat Defense (Lookout) for all corporate mobile devices. Implemented app security for mobile banking apps. Containerized corporate data on BYOD devices. Phase 6 (Months 11–12): Ransomware-specific preparedness. Implemented immutable backups (Veeam with air-gapped tape and cloud). Application control (allowlisting) on all servers and critical workstations. Tested ransomware response plan with full-scale drill. Purchased cyber insurance with ransomware coverage.

Results (After 18 Months):

• 100% EDR coverage on all endpoints and servers
• 100% email security gateway coverage with sandboxing
• 100% web filtering and DNS security coverage
• 100% network segmentation between branches, DC, and cloud
• 100% removable media control and scanning
• 100% immutable backup implementation with quarterly recovery testing
• 100% user training completion; phishing simulation pass rate: 92%
• Threat hunting team identified 15 potential threats before they became incidents
• Deception technology detected 3 intrusion attempts in the first 6 months
• SOAR automated response reduced MTTR from 48 hours to 2 hours
• Zero successful malware incidents in 18 months (vs. 3 in 6 months before)
• RBI show-cause notice resolved; no penalty imposed
• Bank received "Best Security Practices" award from industry association

Key Lesson: For large, regulated organizations like banks, malware protection is not just about tools, it is about a complete program with people, processes, and technology. The RBI's pressure accelerated transformation, but the bank's proactive approach turned a compliance mandate into a security advantage. Advanced malware defense (EDR, XDR, threat hunting, deception) is the new standard for enterprise security.

Multi-Framework Mapping

ISO 27001:2022 A.8.7 to Other Frameworks

Regulatory and Industry Context

India-Specific Regulatory Requirements

CERT-In Directions (28 April 2022): ransomware, malicious code attacks and attacks through malicious mobile apps are among the listed incident types to report within 6 hours of noticing, whether or not a ransom is paid. ICT logs must be kept for 180 days in India.

DPDP Act 2023: malware that exposes, alters or destroys personal data, or locks access to it, is a personal data breach (s.2(u)); once the Rules apply, intimate the Board and each affected person without delay, with a detailed report within 72 hours (s.8(6)).

RBI: the Cyber Security Framework (2016) and later directions expect anti-malware, email and web protection and incident reporting to RBI within 2 to 6 hours; follow your entity's current direction.

SEBI CSCRF (2024): anti-malware, monitoring and incident reporting for regulated entities, scaled by category.

IRDAI (2023): anti-malware and incident reporting for insurers.

IT Act 2000: s.43 and s.66 make introducing malware or damaging systems an offence; s.43A applies to negligence with sensitive personal data until DPDP s.44(2) commences.

Ransom payments: India has no specific ban, but payments can engage anti-money-laundering law and international sanctions (screen the wallet against OFAC and UN lists); report to CERT-In regardless of payment.

Industry-Specific Context

BFSI:

• Banking trojans (Dridex, TrickBot, QakBot) are the top malware threat
• Ransomware attacks on banks are increasing (LockBit, Cl0p, BlackCat)
• ATM malware (Ploutus, Cutlet Maker) targets cash dispensing
• SWIFT fraud malware (Dridex, Odinaff) targets international transfers
• RBI mandates anti-malware on all systems; penalties for non-compliance
• Mobile banking apps must be protected against mobile malware
• Trading systems must have behavioral detection for fileless malware

Healthcare:

• Healthcare is the #1 target for ransomware (WannaCry, NotPetya, Ryuk)
• Medical devices are vulnerable to malware (pacemakers, MRI machines, infusion pumps)
• Patient data is valuable on the dark web, driving spyware and data theft
• NABH accreditation requires anti-malware and incident response
• DPDP Act penalties are severe (up to ₹250 crore for failing to take reasonable security safeguards)

Manufacturing:

• Industrial malware (Stuxnet, TRITON, Industroyer) targets SCADA/ICS systems
• Ransomware attacks on manufacturing cause production shutdowns
• IP theft via malware is a major concern for manufacturing R&D
• Supply chain compromises (SolarWinds-style) affect manufacturing software
• IoT devices on the factory floor are vulnerable to botnets and cryptominers
• IS/IEC 62443 (industrial cybersecurity) requires malware protection for ICS

Government/Defense:

• Nation-state APT malware (APT29, APT28, Lazarus) targets government systems
• Critical infrastructure malware (power grid, water supply, telecom) is a national security threat
• Ransomware attacks on government portals (municipal corporations, state departments) are common
• Ministry of Home Affairs and NCIIPC provide malware threat intelligence for critical infrastructure
• Government systems must report malware to CERT-In and NCIIPC
• Defense systems require air-gapping and specialized malware protection

SaaS/Cloud:

• Cloud-native malware (cryptominers in containers, serverless abuse) is a growing threat
• Supply chain attacks (malicious npm packages, PyPI packages, Docker images) affect SaaS development
• API abuse and credential theft via malware are common SaaS threats
• Multi-tenant SaaS must protect against cross-tenant malware spread
• Cloud workload protection platforms (CWPP) are essential for cloud malware defense
• Customer trust requires demonstrated malware protection in SaaS operations

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Continuous Improvement

Figure · Tiers

Maturity levels for protection against malware

Maturity Model for A.8.7

Continuous Improvement Activities

Monthly:

• Anti-malware coverage and currency review
• Malware detection and incident analysis
• Signature update status verification
• Phishing simulation results analysis
• User-reported suspicious email analysis
• EDR alert review and tuning

Quarterly:

• Anti-malware policy review
• Threat landscape update and defense adjustment
• Phishing simulation exercise
• Malware incident response tabletop exercise
• Backup and recovery test (ransomware scenario)
• EDR/AV effectiveness review and tuning
• Internal audit of anti-malware controls
• User training refresh

Annually:

• Full anti-malware policy review
• Complete malware risk assessment
• Technology evaluation (new EDR, new threat intel, new detection methods)
• Benchmark against industry best practices
• External audit preparation
• Maturity assessment against target level
• Cyber insurance review and renewal
• Vendor security assessment (anti-malware vendor)

Trigger-Based:

• After any malware incident (especially ransomware)
• Upon new threat intelligence (new malware family, new IoCs)
• Upon new regulatory requirement
• After significant audit findings
• Upon new technology or vendor capability
• After industry peer incident ("could this happen to us?")

FAQ

Q1: Is traditional antivirus still necessary, or is EDR enough? A: Traditional antivirus (signature-based) is still a useful baseline, but it is not sufficient on its own. EDR provides behavioral detection, machine learning, threat hunting, and response capabilities that AV lacks. Best practice: Use both. Use AV for known malware and baseline protection. Use EDR for advanced threats, zero-day malware, and incident response. Many modern EDR platforms include AV functionality (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon). If budget is limited, prioritize EDR over standalone AV.

Q2: How often should anti-malware signatures be updated? A: At minimum, daily. Modern threats require more frequent updates. Best practice: Configure automatic updates every 1–4 hours. Use real-time cloud lookups for instant threat intelligence. Ensure that "out-of-date" definitions are flagged as a compliance issue. Some organizations update every 15 minutes for critical systems. The faster the update cycle, the better the protection against emerging threats.

Q3: What is the difference between EDR and XDR? A: EDR (Endpoint Detection and Response) focuses on endpoints only. It detects and responds to threats on desktops, laptops, and servers. XDR (Extended Detection and Response) extends detection across multiple security layers: endpoints, network, email, cloud, identity. XDR correlates data from these sources to detect complex, multi-stage attacks. EDR is essential for all organizations. XDR is valuable for larger organizations with mature security programs. Start with EDR; add XDR when you have the resources and need for cross-correlation.

Q4: How do we protect against fileless malware? A: Fileless malware operates in memory without writing files to disk, evading signature-based detection. Protection: (1) EDR with memory scanning and behavioral detection, (2) PowerShell constraints and logging (PowerShell is a common fileless vector), (3) Application control (allowlisting) to block unauthorized scripts, (4) WMI and registry monitoring for persistence mechanisms, (5) Network monitoring for C2 communication, (6) Threat hunting for anomalous memory activity. Fileless malware requires behavioral and memory-based detection, not just file scanning.

Q5: Should we pay the ransom if hit by ransomware? A: Generally, no. Paying the ransom does not guarantee decryption, does not prevent data publication, funds criminal activity, and may violate laws (OFAC sanctions, anti-money laundering). Alternatives: (1) Restore from immutable backups, (2) Use free decryption tools if available (NoMoreRansom.org), (3) Engage law enforcement and incident response firms, (4) Rebuild systems from scratch. Only consider paying as an absolute last resort after legal consultation, and never without involving law enforcement. The best ransomware defense is preparation (backups, IR plan, EDR) so that paying is unnecessary.

Q6: How do we handle malware on Linux systems? A: Linux malware is growing (cryptominers, ransomware, rootkits). Protection: (1) Deploy Linux-compatible EDR (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint), (2) Use application control (SELinux, AppArmor) to restrict executable permissions, (3) Monitor for unauthorized cron jobs and systemd services (common persistence mechanisms), (4) Monitor network connections for C2 communication, (5) Use file integrity monitoring (FIM) for critical system files, (6) Keep Linux kernels and packages updated, (7) Use container scanning for Linux container images. Do not assume Linux is immune to malware.

Q7: What is the most common audit finding for A.8.7? A: The most common findings are: (1) Anti-malware not on all endpoints (especially Linux, macOS, and non-Windows servers), (2) Outdated signatures (>24 hours old), (3) No EDR or behavioral detection, (4) No email security gateway, (5) No web filtering, (6) No removable media controls, (7) No user training, (8) No malware-specific incident response plan, (9) No ransomware preparedness (no immutable backups, no application control). Auditors will check coverage, currency, detection capabilities, and incident response readiness.

Q8: How do we balance security with user productivity (anti-malware performance impact)? A: Modern EDR solutions are designed to have minimal performance impact. Strategies: (1) Use lightweight agents for high-performance servers, (2) Schedule full scans during maintenance windows, (3) Exclude database files, log files, and temp directories from real-time scanning, (4) Use cloud-based scanning to reduce local resource usage, (5) Optimize scan settings for business-critical systems, (6) Choose EDR solutions with proven low system impact, (7) Monitor system performance after deployment and tune accordingly. The performance impact of modern EDR is typically <5% CPU. The security benefit far outweighs the minimal performance cost.

Q9: How do we protect against supply chain malware (e.g., SolarWinds, Kaseya)? A: Supply chain malware is delivered through trusted software vendors. Protection: (1) Vendor security assessment before procurement, (2) Software integrity verification (code signing, hash verification) before installation, (3) Network segmentation for vendor management systems, (4) Monitor vendor software for anomalous behavior (EDR, network monitoring), (5) Least privilege for vendor software accounts, (6) Regular vendor security reviews, (7) Threat intelligence on vendor compromises, (8) Have a response plan for vendor security incidents. Supply chain attacks are difficult to prevent but detectable with good monitoring and segmentation.

Q10: What is the cost of implementing A.8.7 for a growing company? A: For a mid-sized company, the main costs are EDR, email and web filtering, immutable or offline backups, and training. Many are bundled in plans you may already have (for example Microsoft 365 E5 includes Defender for Endpoint and Defender for Office 365). The cost is usually small compared with a ransomware incident.

Q11: How do we handle malware in cloud-native environments (containers, serverless)? A: Cloud-native malware protection requires specialized approaches: (1) Scan container images for malware before deployment (Snyk, Aqua, Twistlock), (2) Use runtime protection for containers (Falco, Aqua, Sysdig), (3) Monitor serverless functions for anomalous behavior, (4) Use cloud-native EDR (Microsoft Defender for Cloud, CrowdStrike Falcon for cloud), (5) Implement container network segmentation, (6) Monitor cloud API calls for unauthorized access, (7) Use infrastructure-as-code security scanning. Cloud-native malware is a growing threat, cryptominers in containers, malicious serverless functions, and compromised cloud credentials are common.

Q12: What is the role of threat intelligence in malware protection? A: Threat intelligence provides context about current malware threats, IoCs, and attacker tactics. It enhances malware protection by: (1) Feeding IoCs into EDR/SIEM for detection, (2) Informing email/web filtering rules, (3) Guiding threat hunting activities, (4) Providing early warning of new malware families, (5) Supporting incident response with attribution and context, (6) Informing security awareness training content. Threat intelligence transforms reactive anti-malware into proactive defense. Sources: commercial feeds (Recorded Future, Mandiant), government feeds (CERT-In, NCIIPC), open-source feeds (MISP, AlienVault OTX), and industry sharing (ISACs).

Q13: How do we handle malware on air-gapped or isolated systems? A: Air-gapped systems cannot receive online updates but still need protection: (1) Install anti-malware with local signatures and manual update procedures, (2) Update signatures via approved removable media that is scanned before use, (3) Implement strict removable media controls (no personal media, only approved media), (4) Use application control (allowlisting) to block unauthorized executables, (5) Monitor system behavior for anomalies, (6) Implement physical security controls (A.7) to prevent unauthorized access, (7) Use deception technology (honeypots) to detect intrusion attempts. Air-gapped systems are protected by isolation, but they are not immune, Stuxnet proved that. Physical security and media controls are critical.

Q14: What is the difference between blacklisting and allowlisting (application control)? A: Blacklisting (default allow) blocks known bad applications and allows everything else. It is easier to implement but less secure (unknown malware is allowed). Allowlisting (default deny) allows only approved applications and blocks everything else. It is more secure but harder to implement (requires inventorying and approving all legitimate applications). For malware protection, allowlisting is far superior: it blocks ransomware, unknown malware, and unauthorized software by default. Blacklisting catches known malware but misses unknown variants. Best practice: Use allowlisting for critical systems (servers, finance, trading) and blacklisting for general user endpoints. Implement allowlisting gradually to avoid business disruption.

Q15: How do we measure the effectiveness of our malware protection program? A: Measure effectiveness through metrics: (1) Coverage (100% of endpoints/servers with anti-malware), (2) Currency (98%+ with up-to-date definitions), (3) Detection rate (malware detected before harm), (4) False positive rate (<1%), (5) Time to detect (MTTD), (6) Time to respond (MTTR), (7) Incident count (trending down), (8) User reporting rate (users actively reporting suspicious activity), (9) Phishing simulation pass rate (≥80%), (10) Backup recovery success rate (100% for ransomware tests). Also conduct red team/purple team exercises to test detection and response. The ultimate measure is: "How many malware incidents caused business impact?" The target is zero.

References and Further Reading

Standards and Frameworks

• ISO/IEC 27001:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Management Systems, Requirements
• ISO/IEC 27002:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Controls
• NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-83, Guide to Malware Incident Prevention and Handling
• PCI DSS v4.0.1, Payment Card Industry Data Security Standard
• CIS Controls v8, CIS Controls Version 8
• COBIT 2019, Control Objectives for Information and Related Technologies

Indian Regulations

• RBI Cyber Security Framework for Banks
• SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, circular of 20 August 2024
• CERT-In Guidelines for Information Security Practices
• Information Technology Act, 2000 (as amended)
• Digital Personal Data Protection Act, 2023 (India)

Books and Publications

• ISO 27001/27002: A Pocket Guide by Alan Calder
• The Art of Deception by Kevin Mitnick (social engineering and malware delivery)
• Malware Analyst's Cookbook by Michael Ligh, Steven Adair, Blake Hartstein, and Matthew Richard
• Practical Malware Analysis by Michael Sikorski and Andrew Honig
• NIST 800-83: Guide to Malware Incident Prevention and Handling (NIST)

Threat Intelligence Resources

• CERT-In: https://www.cert-in.org.in
• NCIIPC: https://www.nciipc.gov.in
• MISP (Malware Information Sharing Platform): https://www.misp-project.org
• NoMoreRansom: https://www.nomoreransom.org
• VirusTotal: https://www.virustotal.com
• ID Ransomware: https://id-ransomware.malwarehunterteam.com