mediumservicesunverified

Ensure antimalware definitions are updated automatically

antimalware-signature-updates · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl

Description

The malicious code protection mechanism must receive new signature or engine releases automatically. The check accepts an active updater service or an enabled updater timer named in the antimalware_updater_services variable.

Rationale

Signature-based protection decays quickly. A scanner running against definitions that are weeks old provides far less protection than its presence suggests, which is worse than none because it reads as covered. NIST SP 800-171 requirement 3.14.4 expects the mechanism to be updated when new releases are available.

Check → Remediate

Checkcommand

found=""
for unit in {{ antimalware_updater_services }}; do
  if systemctl is-active "$unit" >/dev/null 2>&1; then
    found="service $unit"
    break
  fi
  if systemctl is-enabled "$unit.timer" >/dev/null 2>&1; then
    found="timer $unit.timer"
    break
  fi
done
if [ -n "$found" ]; then
  echo "OK: antimalware definition updates are automated via $found"
  exit 0
fi
echo "FAIL: no automatic antimalware definition update was found. Checked: {{ antimalware_updater_services }}"
echo "If this host updates definitions by another mechanism, set it with --var antimalware_updater_services=<unit>"
exit 1

expected_exit:: 0

Remediatemanual

note:: Enable the definition update service or timer supplied by the antimalware product in use. Kensa does not configure it, because the update channel is product-specific and frequently routed through a site-managed relay rather than the vendor's public servers.

Framework references

NIST 800-53

SI-3

NIST 800-171

3.14.4

CMMC Level 2

SI.L2-3.14.4

#antimalware#malicious-code#800-171#manual