IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
security. This also results in greater acceptance by users, who do not need to
attend actively to the responsibility of virus protection. The users do not even
notice that the virus scanning program is operating in the background, as long
as no virus is detected. On detection of a virus, access to the infected file is
denied, i.e. this file cannot be used any more as long as the virus protection
remains active. At present, the use of memory-resident virus scanning
programs under Windows operating systems constitutes the best possibility of
protection against viruses, because every file can be checked before usage
(opening for the purpose of editing, copying, printing, unpacking etc.) and
blocked if a virus is detected.
The use of checksum programs constitutes another preventive measure. In this
case, checksums of the scanned files or system areas (e.g. the boot and
partition sector) are computed at regular intervals to afford protection against
changes. This not only allows the detection of unknown computer viruses, but
also other unauthorised modifications to files.
Procedures required in case of virus contamination are described under S 6.23
Procedure in case of computer virus infection.
Additional controls:
- When was the last check made? Have the results been documented?
- Have computer viruses been detected? If so, this might point to illicit use
of unauthorised software.
- When was the virus detection program in use last updated?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000