Protection against malicious code
The ratio of unblocked attacks to all detected attacks is a trend measure, not a league table.
What the published 2016 guidance says
The ratio of unblocked attacks to all detected attacks is a trend measure, not a league table. The construct divides incidents caused by malicious software by detected and blocked attacks, and looks for a line under a stated reference with a flat or falling trend. Evidence is the incident count and the blocked-attack logs. It is collected daily, analysed and reported monthly, reviewed annually and applied for one year. The example warns that a very large blocked count makes the ratio tiny, and that one virus can raise both attacks and incidents while leaving the ratio unchanged.
What it means in practice
The ratio of incidents to blocked attacks is a trend measure, not a league table. A very large denominator can make the ratio look excellent while incidents rise. Read the ratio with the absolute counts, and note when a single campaign distorts both.
Status of this record. For B.23, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the incident reports and the blocked-attack logs. Calculate the ratio and record the absolute counts. Note any campaign that distorts the period. Report the trend with a short explanation.
Evidence an assessor asks for
- Malware protectionMalware incident counts from incident reports
- Incident managementAnti-malware console logs of blocked attacks
- Malware protectionMonthly trend line against the reference
The question an assessor will ask
An assessor will ask for malware incident counts from incident reports. The test for B.23 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Ratio reported alone, hiding a rise in absolute incidents
- Blocked-attack counts inflated by signature noise
Before the next review
Before the next review, test this against one live record: ratio reported alone, hiding a rise in absolute incidents.
What to check when the revision publishes
When DIS 27004 is published, compare the B.23 Protection against malicious code record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.