The fifth PCI DSS requirement demands that systems are
protected against malicious software or malware.
However,
the requirement uses the term anti-virus rather than the
more normal term nowadays of anti-malware.
It's a function of the age of the standard that
anti-virus was what you bought back in 2008.
I'm going to keep saying anti-virus or AV to follow
the words that the standard uses,
but please use something more modern that protects against all types of malware.
And I should point out that if you're using anti-malware software,
just because it doesn't say anti-virus on the box,
the QSA will understand that anti-malware software and
anti-virus software are the same thing.
Now like requirement 4,
this one is also quite short with just four sub requirements.
So first of all, you need to have anti-virus software.
Next, you need to turn it on and make sure it's configured correctly.
Thirdly, the standard requires that users can't turn it off,
and finally, that you've got those relevant policies and procedures.
So looking at our sample network,
any system that will run malware is in scope of this requirement,
which is going to be the point-of-sale systems or servers,
and any computer used to manage the network.
I'm going to mention those point-of-sale systems again,
because I've often worked in companies where people didn't want
to install AV software on the point-of-sale systems because of
performance or availability concerns.
But look; there have been countless attacks where malware was
installed on PoS to read cardholder data out of RAM,
and so any merchant that doesn't use AV on their point-of-sale
systems is really asking for trouble now.
Requirement 5.1 is to deploy anti-virus software on all
systems commonly affected by malicious software.
There are two parts to this requirement then.
The first part is to work out which systems are of a type that are
commonly affected by malicious software in your organization,
and the second part then is to deploy anti-virus software on those systems.
I used to joke that the phrase,
systems commonly affected by malicious software was a euphemism for Windows,
and to some extent people may still try to argue that it is actually
only Windows systems that require AV software,
not Macs or Linux systems and certainly not mainframes and mid-range systems.
My advice is that if you can get an anti-malware
software system then you should.
I once had a client who was running Linux,
and this was in the days when people used to claim that Linux
wasn't a system that was commonly affected by malicious software
and you didn't need anti-malware software.
But anyway,
my client was running anti-malware software and it was
only that anti-malware software that alerted them to the
fact they'd been compromised,
because the anti-malware software detected that someone had uploaded and
tried to run a malicious web shell on their main web server.
But look; it's your responsibility,
it's the organization's responsibility to determine what systems fall into the
definition of not commonly affected and and then documented.
Because although it's not part of the formal testing procedure,
the QSA will want to look at your justification if you have decided some
systems are not the type to be commonly affected by malicious software and that
you're not going to put anti-malware software on it,
and they want to do that to verify you've made this decision knowingly.
The QSA is also going to check a sample of some systems
that are or have anti-virus software on.
They're going to probably actually look at the
anti-virus console to check actually,
because most anti-virus or anti-malware systems have got a console so
they're going to look at the management console.
There are a couple of sub requirements to 5.1.
The first,
requirement 5.1 .1 simply asks you to use anti-virus software that works,
which means that it will detect, remove,
and protect against all known types of malicious software.
Now you can tell from that sentence that this requirement really was
written in a data signature-based anti-virus software,
because it says all known types of software,
whereas hopefully now your anti-malware software will also
protect you based on behavior so it will protect you
against unknown types of malware.
The QSA is going to observe the configuration of the anti-virus software
and also check with the vendor documentation what the standard says to
make sure that the AV software will detect,
protect, and remove malicious applications.
Personally, when I was a QSA,
I always used to test the functionality of AV software by loading
one of the standard EICAR test files to at least make sure it
detected it and quarantined it and deleted it.
Now requirement 5.1 .2 only applies to you if you have decided
that some of the systems in your organization are of the type
that's not commonly affected by malware.
Because PCI DSS wants you to formally review that decision on a periodic basis.
There's an obvious question of how long periodic is,
and if you asked five QSAs, I'm sure they'd give you five different answers,
but look, I'd expect this to be part of your standard vulnerability management,
which we're going to look at in requirement 6.
So that if during your standard vulnerability management,
which is basically a monthly process,
if you discover that a particular operating system is being attacked by malware,
you'd review that decision.
And personally,
I'd also expect you to formally revisit that decision as
part of your annual risk assessment,
which is required by PCI DSS in requirement 12.2.
Perhaps surprisingly,
the testing procedure for this requirement is for the QSA to interview
people involved in the decision and the ongoing evaluation.
Personally,
I'd always look for documented evidence that it actually
happened and if there was a formal risk management process
in place within an organization.
I'm going to look at that risk management process to make sure this
anti-virus decision making is included in it.
And this is actually something that I'm going to discuss
with Jacob at the end of the module.