Check: DTAM013
McAfee VirusScan Managed Client:
DTAM013
(in version v4 r10)
Title
The McAfee VirusScan log encrypted files parameter is not configured as required. (Cat II impact)
Discussion
This parameter controls if failure to scan encrypted files is logged.
Check Content
From the ePO server console, select Systems tab, select the asset to be checked, select the Policies tab, select from the product pull down list VirusScan Enterprise 8.7.0. Locate in the Category column the On-Access General Policies. Select from the Policy column the policy associated with the On-Access General Policies. Under the Reports tab, locate the "What to log in addition to scanning activity" label. Ensure the "Failure to scan encrypted files" option is selected. Criteria: If the "Failure to scan encrypted files" option is selected, this is not a finding.
Fix Text
From the ePO server console, select Systems tab, select the asset to be checked, select the Policies tab, select from the product pull down list VirusScan Enterprise 8.7.0. Locate in the Category column the On-Access General Policies. Select from the Policy column the policy associated with the On-Access General Policies. Under the Reports tab, locate the "What to log in addition to scanning activity:" label. Select the "Failure to scan encrypted files" option. Select Save.
Additional Identifiers
Rule ID:
Vulnerability ID: V-6583
Group Title:
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001242 |
The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy. |
Controls
| Number | Title |
|---|---|
| SI-3 |
Malicious Code Protection |