Device security guidance

Getting infected with malware - often ransomware - is one of the most common ways that IT systems can be compromised.

Malware infection can result in theft of intellectual property, ransoming of data, and/or disruption to services provided by your organisation. As such, it's important for organisations try and prevent malware from infecting your devices.

Using AV is one way of helping prevent infection, but there are many things to think about. Which product(s) should you use? How should you configure your AV? And how might AV interact with other defences your organisation deploys?

AV products traditionally worked by scanning every file on a device and looking for malware by spotting known signatures. However, advances in malware and changes in underlying platforms have limited the effectiveness of this approach.

Whilst malware is more capable now than in the past, many risks that traditional AV products protected against are now mitigated by default when the correct settings are implemented at the operating system level.

Given the improvements in the security measures built into operating systems, what do you actually need from AV products?

In particular, you should understand and think about:

1. If you are confident that your devices cannot execute known malware, AV offers very limited value.

This will be true when:

• Devices can only run software that is delivered through a public App Store which monitors for malicious code - e.g. the default configuration on most smartphones
• Devices can only run software that is delivered through an enterprise app catalogue, and you have a process for ensuring known malware is not added to that catalogue.
• You have software execution policies on your devices that prevent code from non-trusted signers from executing.
• You enforce policies that prevent users from executing code from writable locations (including non-application code such as macros), and trust all code that is present in read-only locations.

This means you should not need to use AV products on platforms like Chrome OS, Android and iOS in their default configuration.

You can find advice on how to do achieve the same effect on other platforms in our third-party applications guidance, and in the detailed platform guides for the specific platforms.

Android

Use an allow lists to manage permitted third-party applications on Android. Disable installation of applications from unknown sources using your MDM.

However, there’s also Play Protect, which acts much like a traditional AV product and regularly scans apps, reducing the risk of malware being loaded onto the platform from an untrusted source.

Ensure your Android devices are kept up to date and are supported by the manufacturer so that you have the latest defences against malware. Security updates in Android 10 will be distributed via Google Play. However, OEM-specific updates will still require independent patches from the manufacturer.

iOS

The risk of becoming infected by malware on iOS is minimal, though we still recommend the use of an allow list to manage permitted third-party applications on iOS.

Apple app review and your own third-party assessment process should combine to prevent malware from infecting your devices.

In addition, as each application runs in a sandbox, AV products are unable to perform meaningful scans, so their use is of very limited value.

The only other ways to load applications are using Enterprise Developer accounts which should be blocked using MDM policies. The other route is by jailbreaking the device, which we've blogged about previously.

Windows

Windows includes Windows Defender Antivirus and Windows Defender SmartScreen. These attempt to detect malicious code on Windows devices.

Alternatively, third party anti-malware products are available. If using a third-party product, those that implement the Anti-Malware Scan Interface (AMSI) should be preferred, to improve compatibility with future Feature Updates. Older versions of Windows will benefit from third-party AV products.

macOS

XProtect, macOS’s inbuilt security software is reasonably effective at preventing malware on the platform, but some users may still wish to install a third-party product.

XProtect has a limited signature set, which is maintained by Apple to detect widespread malware. XProtect will also restrict vulnerable plugin versions (such as Java) to limit exposure.

Chrome OS

There is little evidence to suggest that AV is effective or necessary on Chrome OS.

Enterprise administrators can (and should) enforce application control policies based on code signatures, as described in our detailed platform guidance, reducing the risk of malware infection.

Furthermore, Chrome OS only allows you to install software that has been authorised in their store (including Android store), so applications have been through the various checks that are implemented there.

Users who configure their Chrome OS into Developer Mode may still be able to run malicious code, so Developer Mode should be prevented using Mobile Device Management, unless needed.

Linux

Linux is a highly configurable platform and can be deployed in many ways. As such, there is no best practice for which AV products or configurations to use.

Linux is often used for servers and services, so the need for AV and security software is of limited value here since servers should only run the software they have been configured to run. On general-purpose devices, Linux can be hardened to prevent arbitrary applications from running (see the detailed platform guidance), meaning the risk from malware is very low. AV can be used to augment this protection, or as a mitigation by itself if required.

Further Guidance:

• Small Business Guide: Protecting your organisation from malware
• Mobile Device Management
• Phishing Emails
• Windows Defender Antivirus
• XProtect