DTAVSEL-019 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must be enabled to scan mounted volumes when mounted volumes point to a network server without an anti-virus solution installed.

Information

Mounting network volumes to other network systems introduces a path for malware to be introduced. It is imperative to protect Linux systems from malware introduced from those other network systems by either ensuring the remote systems are protected or by scanning files from those systems when they are accessed.

Solution

From the ePO server console System Tree, select 'My Organization'. Select the 'Systems' tab. To show all systems in the System Tree, select 'This Group and All Subgroups' from the 'Preset:' drop-down list.

From the list of systems, locate the asset representing the Linux system being reviewed. Click on the system to open the System Information page.

Click on Actions >> Agent >> Modify Policies on a Single System.
From the 'Product:' drop-down list, select 'VirusScan Enterprise for Linux 1.9.x/2.0.x'.
From the 'Policy' column, click on the policy for the 'On-Access Scanning Policy'.
In the 'Detections' tab, next to 'Scan files:', select the check box for 'On network mounted volume'.

Click 'Apply'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_McAfee_VSEL_1-9_2-0_Y20M04_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3c.1., CAT|II, CCI|CCI-001242, Rule-ID|SV-77521r1_rule, STIG-ID|DTAVSEL-019, Vuln-ID|V-63031

Plugin: Unix

Control ID: 489d5f8801a99444cbd94c0cf1fc0e9ec4383e51d6a59b7910484179843d3582