V-288285

Discussion

Nonsignature-based detection mechanisms provide safeguards against malicious code for which signatures do not yet exist or for which existing signatures may not be effective. These mechanisms include, for example, the use of heuristics to detect, analyze, and describe the characteristics or behavior of malicious code, or file reputation services that are updated more frequently than traditional signature-based detection mechanisms. Malicious code for which signature-based detection mechanisms may not be effective include polymorphic malicious code (i.e., code that changes signatures when it replicates). This requirement does not preclude the use of signature-based detection mechanisms. This requirement applies to applications providing malicious code protection.

Check Content

Review the anti-malware application documentation and deployed configuration to determine whether nonsignature-based malicious code detection mechanisms are implemented.

If the anti-malware application does not implement nonsignature-based malicious code detection mechanisms, this is a finding.