Check: DTAM100
McAfee VirusScan Managed Client:
DTAM100
(in version v4 r10)
Title
The McAfee VirusScan scan default values for processes are not configured as required. (Cat II impact)
Discussion
With this setting set to "Configure one scanning policy for all processes" one policy baseline for all on-access scanning is set using one set of policy options.
Check Content
From the ePO server console, select Systems tab, select the asset to be checked, select the Policies tab, select from the product pull down list VirusScan Enterprise 8.7.0. Locate in the Category column the On-Access Default Processes Policies. Select from the Policy column the policy associated with the On-Access Default Processes Policies. Under the Processes tab, locate the "Process Settings:" label. Ensure the “Configure one scanning policy for all processes” is selected. Criteria: If the “Configure one scanning policy for all processes” option is selected, this is not a finding.
Fix Text
From the ePO server console, select Systems tab, select the asset to be checked, select the Policies tab, select from the product pull down list VirusScan Enterprise 8.7.0. Locate in the Category column the On-Access Default Processes Policies. Select from the Policy column the policy associated with the On-Access Default Processes Policies. Under the Processes tab, locate the "Process Settings:" label. Select the “Configure one scanning policy for all processes” option. Select Save.
Additional Identifiers
Rule ID:
Vulnerability ID: V-14622
Group Title:
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001242 |
The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy. |
Controls
| Number | Title |
|---|---|
| SI-3 |
Malicious Code Protection |