S 2.154 Creation of a computer virus protection concept

Initiation responsibility: Head of IT Section, IT Security Management

Implementation responsibility: IT Security Management

In order to obtain effective protection against computer viruses for an entire organisation, it is essential to select and implement co-ordinated and appropriate protective measures. This calls for a conceptual approach to ensure that suitable measures are applied to all IT systems concerned and that the necessary protection is maintained by a programme of updating.

The table of contents of a computer virus protection concept is shown below.

Table of contents of a computer virus protection concept

Part A: Awareness raising

1. Dependence of the institution on the use of IT

2. Description of the hazard potential

1. Computer viruses

1. Macro viruses

1. Trojan horses

1. Hoaxes

3. Damage scenarios

4. IT systems potentially affected

Part B: Necessary protective measures

5. Computer virus protection strategy

1. Non-networked IT systems

1. Networked terminals

1. Servers

6. Updating computer virus scanning programs

1. Non-networked IT systems

1. Networked terminals

1. Servers

Part C: Regulations

7. Regulations on protection against computer viruses

1. Ban on using non-approved software

1. Training of IT users

1. Rearranging the boot sequence

1. Creating an emergency floppy disk

1. Procedures in the event of computer virus infection

1. Measures for IT systems with non-resident virus-checking

1. 1 Periodic running of a computer virus detection program

1. 2 Virus checking on exchange of data media and during data transmission

1. 3 Checking of incoming files for macro viruses

8. Regulation of responsibilities

1. Who to contact in relation to computer viruses

1. Responsibility of administrators

1. Responsibility of individual IT users

1. Responsibility of IT security management

Part D: Resources

10. Procedures in the event of computer virus infection

11. Reporting channels in the event of computer virus infection

12. User's Guide for the computer virus detection program

The measures described in the following explain how some important parts of this concept can be put into practice.

Additional controls:

• Has the computer virus protection concept been put into effect by management?

• Is the computer virus protection concept known to all those affected by it?