STIGQter: STIG Summary: Symantec Endpoint Protection 12.1 Local Client Antivirus STIG Version: 1 Release: 4 Benchmark Date: 24 Jul 2015: The Symantec Endpoint Protection client Global Settings Bloodhound heuristic technology must be enabled.

DISA Rule

SV-55416r1_rule

Vulnerability Number

V-42688

Group Title

DTASEP024

Rule Version

DTASEP024

Severity

CAT II

CCI(s)

• CCI-001242 - The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.

Weight

10

Fix Recommendation

Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Virus and Spyware Protection -> Select Configure Settings -> Under the Global Settings tab -> Under Scan Options -> Select "Enable Bloodhound heuristic virus detection".

Check Contents

GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Virus and Spyware Protection -> Select Configure Settings -> Under the Global Settings tab -> Under Scan Options -> Ensure "Enable Bloodhound heuristic virus detection" is selected.

Criteria: If "Enable Bloodhound heuristic virus detection" is not selected, this is a finding.

Vulnerability Number

V-42688

Documentable

False

Rule Version

DTASEP024

Severity Override Guidance

GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Virus and Spyware Protection -> Select Configure Settings -> Under the Global Settings tab -> Under Scan Options -> Ensure "Enable Bloodhound heuristic virus detection" is selected.

Criteria: If "Enable Bloodhound heuristic virus detection" is not selected, this is a finding.

Check Content Reference

M

Target Key

625

Comments