4 ms·
Actually, most assessors won't require A/V on Linux. 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly person
by greedo 6y ago
Actually, most assessors won't require A/V on Linux.
5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).
It's typically an ignorant CISO/CSO who wants to mark a checkbox...
- dingaling 6y agoIt's not necessarily ignorance, but also risk management. Who is the CIO to say that Linux is exempted from that condition? He'd need a stack of evidence that it's not commonly affected, which would need to be kept up to date . Easier just to say "AV on everything".
- greedo 6y agoA CSO/CISO should be aware of what the threats to their environment are. Otherwise how can they effectively mitigate the risk? They should rely upon SMEs who can keep them abreast of changes in threat models.
- tgtweak 6y agoPretending Linux can't host or be affected by malware is a pretty ignorant thing for any ciso/cto to do.