Куда я попал?
Framework № PCI DSS 4.0 от 01.03.2022
Payment Card Industry Data Security Standard (RU)
Requirement 5.3.3
Для проведения оценки соответствия по документу войдите в систему.
Список требований
Похожие требования
Стандарт Банка России № СТО БР ИББС-1.0-2014 от 01.06.2014 "Обеспечение информационной безопасности организаций банковской системы Российской Федерации - Общие положения":
Р. 7 п. 5 п.п. 3
7.5.3. Перед подключением съемных носителей информации к средствам вычислительной техники, задействованным в рамках осуществления банковских технологических процессов, рекомендуется проводить их антивирусную проверку на специально выделенном автономном средстве вычислительной техники.
CIS Critical Security Controls v8 (The 18 CIS CSC):
10.4
10.4 Configure Automatic Anti-Malware Scanning of Removable Media
Configure anti-malware software to automatically scan removable media
Configure anti-malware software to automatically scan removable media
ГОСТ Р № 57580.1-2017 от 01.01.2018 "Безопасность финансовых (банковских) операций. Защита информации финансовых организаций. Базовый состав организационных и технических мер. Раздел 7. Требования к системе защиты информации":
ЗВК.6
ЗВК.6 Реализация защиты от вредоносного кода на уровне входного контроля устройств и переносных (отчуждаемых) носителей информации
3-Т 2-Т 1-Т
3-Т 2-Т 1-Т
ЗВК.18
ЗВК.18 Входной контроль всех устройств и переносных (отчуждаемых) носителей информации (включая мобильные компьютеры и флеш-накопители) перед их использованием в вычислительных сетях финансовой организации
3-Т 2-Т 1-Т
3-Т 2-Т 1-Т
Russian Unified Cyber Security Framework (на основе The 18 CIS CSC):
10.4
10.4 Автоматически проводится проверка на наличие вредоносного программного кода для съемных носителей информации
Настроить автоматическое сканирование на вредоносное программное обеспечение для съемных носителей
Настроить автоматическое сканирование на вредоносное программное обеспечение для съемных носителей
Framework № PCI DSS 4.0 от 01.03.2022 "Payment Card Industry Data Security Standard":
Requirement 5.3.3
5.3.3
Defined Approach Requirements:
For removable electronic media, the antimalware solution(s):
Defined Approach Requirements:
For removable electronic media, the antimalware solution(s):
- Performs automatic scans of when the media is inserted, connected, or logically mounted, OR
- Performs continuous behavioral analysis of systems or processes when the media is inserted, connected, or logically mounted.
Customized Approach Objective:
Malware cannot be introduced to system components via external removable media.
Applicability Notes:
This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.
Defined Approach Testing Procedures:
Malware cannot be introduced to system components via external removable media.
Applicability Notes:
This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.
Defined Approach Testing Procedures:
- 5.3.3.a Examine anti-malware solution(s) configurations to verify that, for removable electronic media, the solution is configured to perform at least one of the elements specified in this requirement.
- 5.3.3.b Examine system components with removable electronic media connected to verify that the solution(s) is enabled in accordance with at least one of the elements as specified in this requirement.
- 5.3.3.c Examine logs and scan results to verify that the solution(s) is enabled in accordance with at least one of the elements specified in this requirement.
Purpose:
Portable media devices are often overlooked as an entry method for malware. Attackers will often pre-load malware onto portable devices such as USB and flash drives; connecting an infected device to a computer then triggers the malware, introducing new threats within the environment.
Portable media devices are often overlooked as an entry method for malware. Attackers will often pre-load malware onto portable devices such as USB and flash drives; connecting an infected device to a computer then triggers the malware, introducing new threats within the environment.
Guideline for a healthy information system v.2.0 (EN):
15 STANDARD
/STANDARD
Removable media can be used to spread viruses, steal sensitive and strategic information or even compromise the organization’s network. Such attacks can have disastrous consequences for the activity of the organisation targeted.
Although it is not a matter of completely prohibiting the use of removable media within the organization, it is nevertheless necessary to deal with these risks by identifying adequate measures and by raising users’ awareness to the risks that these media can carry.
It is advisable to prohibit the connection of unknown USB sticks (collected in a public area for example) and to reduce, as much as possible, the use of uncontrolled sticks (the origin of which is known but not the integrity) on the information system, or at least have their content examined by the workstation’s anti-virus.
Removable media can be used to spread viruses, steal sensitive and strategic information or even compromise the organization’s network. Such attacks can have disastrous consequences for the activity of the organisation targeted.
Although it is not a matter of completely prohibiting the use of removable media within the organization, it is nevertheless necessary to deal with these risks by identifying adequate measures and by raising users’ awareness to the risks that these media can carry.
It is advisable to prohibit the connection of unknown USB sticks (collected in a public area for example) and to reduce, as much as possible, the use of uncontrolled sticks (the origin of which is known but not the integrity) on the information system, or at least have their content examined by the workstation’s anti-virus.
CIS Critical Security Controls v7.1 (SANS Top 20):
CSC 8.4
CSC 8.4 Configure Anti-Malware Scanning of Removable Devices
Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected.
Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected.
Связанные защитные меры
Ничего не найдено
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.