Control Strategy AntiMalwareAtHost

URI: CSG-AntiMalwareAtHost

Description: Anti-malware software is installed on device Host and kept up to date by regular software patches, and so can detect and prevent the execution of malicious code.

(empty)

H.W.HuHWES.3

Malware infection at Host due to execution of viral email attachment at WebBrowser on Host: the user Human runs a malicious file sent as an email attachment via webmail service MUA, infecting their client device Host.

H.W.HL1H.3

Malware infection of device Host from paired device RemoteHost in Space: if RemoteHost is infected by malware, and RemoteHost connects via USB or Bluetooth with device Host then the malware may be automatically transferred to or ingested by Host.

H.W.HuHE.3

Malware infection at Host due to execution of viral attachment in email client MUA on Host: the user Human runs a malicious file sent as an email attachment via their email client MUA, infecting their client device Host.

P.L.HuHE2AC.3

Execution of malicious email attachment by MUA on Host in Space: the user Human runs a malicious file sent as an email attachment while the host device is located in Space, allowing the attacker to exploit the privileges using connections accessible to their email client MUA via Host from Space.

P.L.HuHW2ACE.3

Execution of malicious email attachment at WebBrowser on Host in Space: user Human runs a malicious file sent as an email attachment via MUA, allowing the attacker to exploit the privileges of their browser WebBrowser on device Host using network connections it has from location Space.

H.W.HIoH.3

Remote malware exploit on device Host from LogicalSubnet: an attacker with access to subnet LogicalSubnet sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

H.W.HLoH.3

Adjacent malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

H.W.HRoH.3

Remote malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

P.W.HPDFDI.2

Infection of Process via malware in flow of Data from FlowsFrom: if the copy of Data received from FlowsFrom is infected with malware, process Process may become infected when it consumes the data as an input.

P.W.HPsACDSrDI.2

Malware infection of Process via stored input Data: if the stored copy of Data on Host is infected with malware, then process Process may be affected when it uses the data as an input.

(empty)

AntiMalware at Role_Host

SoftwarePatching at Role_Host