mediumservicesunverified

Ensure antimalware scans files from external sources as they are opened

antimalware-on-access-scan · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl

Description

The malicious code protection mechanism must scan files in real time as they are opened, downloaded, or copied from external sources. The check accepts an active on-access scanner named in the antimalware_onaccess_services variable.

Rationale

A periodic scan finds malware hours or days after it lands. On-access scanning is what stops it at the moment a file arrives from removable media, a download, or a network share, which is the path NIST SP 800-171 requirement 3.14.5 names specifically.

Check → Remediate

Checkcommand

found=""
for unit in {{ antimalware_onaccess_services }}; do
  if systemctl is-active "$unit" >/dev/null 2>&1; then
    found="$unit"
    break
  fi
done
if [ -n "$found" ]; then
  echo "OK: on-access antimalware scanning is active: $found"
  exit 0
fi
echo "FAIL: no on-access antimalware scanner is active. Checked: {{ antimalware_onaccess_services }}"
echo "Many endpoint agents scan on access from within a single daemon; if so, set it with --var antimalware_onaccess_services=<unit>"
exit 1

expected_exit:: 0

Remediatemanual

note:: Enable the on-access or real-time scanning component of the antimalware product in use. Kensa does not enable it, because on-access scanning adds I/O latency to every file operation and the decision to accept that on a given workload is the operator's.

Framework references

NIST 800-53

SI-3

NIST 800-171

3.14.5[c]

CMMC Level 2

SI.L2-3.14.5

#antimalware#malicious-code#800-171#manual