Anti-malware
Obsolete malware signatures are a leading indicator of exposure.
What the published 2016 guidance says
Obsolete malware signatures are a leading indicator of exposure. The measure is the share of affected systems with signatures older than a stated age, for example one week, against all workstations. The target is zero or a small number the organization sets. Evidence is the monitoring record for each system. It is collected daily. IT operations owns and collects it, and the security lead is the client. The data comes from the monitoring tools and the anti-malware console. Results are reported by system class, such as workstations, servers and operating systems.
What it means in practice
Obsolete signatures are a leading indicator of exposure. Count affected systems with signatures older than the defined age, by system class. The target is zero or a small number the organisation can defend. The data comes from the console, not from a survey.
Status of this record. For B.24, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the anti-malware console data. Count the systems with signatures older than the defined age, by class. Report the number and the oldest signature. Set the target with IT operations.
Evidence an assessor asks for
- Malware protectionAnti-malware console signature-age report
- Malware protectionDaily counts per system class
The question an assessor will ask
An assessor will ask for anti-malware console signature-age report. The test for B.24 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Systems missing from the console entirely and so never counted as obsolete
- Obsolescence threshold undefined
Before the next review
Before the next review, test this against one live record: systems missing from the console entirely and so never counted as obsolete.
What to check when the revision publishes
When DIS 27004 is published, compare the B.24 Anti-malware record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.