Configure Automatic Anti>Malware Scanning of Removable Media
Description
Configure anti-malware software to automatically scan removable media.
Implementation Checklist
Tool Recommendations
Cloud-native endpoint protection platform with next-gen AV, EDR, threat intelligence, and managed hunting
CrowdStrike · Per-endpoint subscription
Enterprise endpoint security with threat prevention, EDR, automated investigation, and attack surface reduction
Microsoft · Per-device subscription (P1/P2)
AI-powered endpoint protection with autonomous response, EDR, and XDR capabilities across endpoint, cloud, and identity
SentinelOne · Per-endpoint subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Malware Introduction via Unscanned Removable Media
IntegrityInfected USB drives, external hard drives, or SD cards are connected to enterprise assets, and without automatic scanning the malware transfers to the system undetected, potentially spreading across the network.
Targeted Attack via Vendor-Provided Infected Media
ConfidentialityRemovable media received from vendors, contractors, or partners contains malware that was introduced during the supply chain, and without automatic scanning on insertion the malware executes when files are accessed from the device.
Vulnerabilities (When Safeguard Absent)
No Automatic Removable Media Scanning Configured
Anti-malware software is not configured to automatically scan removable media upon connection, relying on users to manually initiate scans or waiting for scheduled scans that may not run before infected files are accessed.
Removable Media Scanning Excluded from AV Policy
Anti-malware policies specifically exclude removable media from real-time scanning due to performance concerns, allowing malicious files on USB devices to be copied to local storage without triggering detection.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | Vulnerability scan reports showing scope and findings | Per scan cycle |
| Record | Vulnerability remediation tracking with SLA compliance metrics | Monthly |
| Technical | Anti-malware deployment status and detection statistics | Monthly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |