Purpose
This policy establishes requirements for protecting Carriyo's endpoints, servers, and cloud workloads against viruses, malware, ransomware, and other malicious software. It ensures that anti-malware controls are consistently deployed, maintained, and monitored across all Carriyo-managed systems.
Implementation status: Carriyo does not yet operate a centrally managed endpoint detection and response (EDR) product; one is to be assessed and purchased together with a device management (MDM) platform. The requirements in this policy state the target control; until deployment is evidenced in CAR-ISMS-LST-001, endpoint compliance is verified manually and Annex A control A.8.7 is recorded as Partial in the Statement of Applicability (CAR-ISMS-REC-002).
Scope
This policy applies to all Carriyo-owned and managed devices, including employee workstations, laptops, mobile devices, and cloud-based compute instances (EC2, ECS, Lambda). It also applies to personal devices used to access Carriyo systems under BYOD arrangements.
Policy Statements
Endpoint Protection
- All Carriyo-managed endpoints (macOS, Windows, Linux) must have an approved endpoint detection and response (EDR) solution installed and active at all times.
- EDR agents must be centrally managed and report to Carriyo's security monitoring platform.
- Endpoints with disabled, outdated, or non-reporting EDR agents are flagged as non-compliant and may be blocked from accessing corporate resources until remediation is complete.
- Real-time scanning must be enabled on all endpoints. Users are prohibited from disabling or tampering with endpoint protection software.
Malware Definition Updates
- Anti-malware signature databases and threat intelligence feeds must be updated automatically at least once every 24 hours.
- EDR solutions must support behavioural analysis and heuristic detection in addition to signature-based detection.
- The security team monitors update compliance and investigates endpoints that fall behind on updates for more than 48 hours.
Cloud Workload Protection
- All production AWS workloads must be covered by Amazon GuardDuty for threat detection.
- Container images deployed to production must be scanned for known vulnerabilities and malware before deployment using automated CI/CD pipeline scanning.
- AWS Lambda functions and serverless workloads are monitored through CloudWatch and GuardDuty for anomalous behaviour.
- Amazon Inspector is used for continuous vulnerability assessment of EC2 instances and container images.
Email and Web Protection
- Inbound email is scanned for malicious attachments and links before delivery to user mailboxes.
- Web traffic filtering is applied to block access to known malicious domains and phishing sites.
- Users are prohibited from downloading and executing software from untrusted or unapproved sources.
Removable Media
- The use of removable media (USB drives, external hard drives) is restricted on Carriyo endpoints.
- Where removable media use is authorised, automatic scanning must occur upon connection.
- Data transfer via removable media requires prior approval from the security team.
Incident Response
- Malware detections trigger automated alerts to the security team via the EDR platform once it is deployed; until then, personnel report suspected malware immediately per CAR-ISMS-PRC-007.
- Confirmed malware infections are treated as security incidents and handled per the Incident Management Policy (CAR-ISMS-POL-011).
- Infected endpoints are immediately isolated from the network pending investigation and remediation.
- Post-incident analysis is conducted to determine the infection vector and prevent recurrence.
Roles and Responsibilities
| Role | Responsibility |
|---|---|
| Security Team | Deploy and manage EDR solutions; monitor alerts; respond to malware incidents; maintain policy |
| Engineering / DevOps | Ensure cloud workload protection tools are active; integrate container scanning into CI/CD |
| All Employees | Refrain from disabling endpoint protection; report suspicious activity; avoid untrusted downloads |
| CISO | Approve policy; allocate resources for anti-malware tooling; oversee incident escalation |
Compliance and Enforcement
Compliance with this policy is monitored through regular endpoint compliance checks (manual until the EDR management console is deployed — see Implementation status). Non-compliant devices may have network access revoked until remediation is verified. Employees who deliberately disable or circumvent anti-malware controls are subject to disciplinary action up to and including termination.