What changed in McAfee VirusScan 8.8 Managed Client STIG V6R1V6R1 changes

McAfee VirusScan 8.8 Managed Client STIG V6R1 (2022-01-27) replaced V5R21 (2019-10-25): 88 checks added, 87 removed. It has 88 checks, against 87 in V5R21.

V6R1 checklistV5R21 checklist Compare V5R21 and V6R1 in STIG Compare

  • 88 added
  • 87 removed
  • 0 updated

Added in V6R1 (88)

  • V-216891CAT IThe antivirus signature file age must not exceed 7 days.
  • V-216892CAT IMcAfee VirusScan On-Access General Policies must be configured to enable on-access scanning at system startup.
  • V-216893CAT IIMcAfee VirusScan On-Access General Policies must be configured to scan boot sectors.
  • V-216894CAT IIMcAfee VirusScan On-Access General Policies must be configured to scan floppy during shutdown.
  • V-216895CAT IIMcAfee VirusScan On-Access General Policies must be configured to notify local users when detections occur.
  • V-216896CAT IIMcAfee VirusScan On-Access General Policies must be configured to prevent users from removing messages from the list.
  • V-216897CAT IIMcAfee VirusScan On-Access General Policies must be configured to log the scan sessions.
  • V-216898CAT IIMcAfee VirusScan On-Access General Policies log file size must be restricted and be configured to at least 10MB.
  • V-216899CAT IIMcAfee VirusScan On-Access General Policies must be configured to log the session summary.
  • V-216900CAT IIMcAfee VirusScan On-Access General Policies must be configured to log any failure to scan encrypted files.
  • V-216901CAT IIMcAfee VirusScan must be configured to receive DAT and Engine updates.
  • V-216902CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to enable on-delivery email scanning.
  • V-216903CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to find unknown program threats and Trojans.
  • V-216904CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to find unknown macro threats.
  • V-216905CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to decode MIME encoded files.
  • V-216906CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to scan email message body.
  • V-216907CAT IIMcAfee VirusScan On Delivery Email Scan Policies, when a threat is found, must be configured to clean attachments as the first action.
  • V-216908CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to record scanning activity in a log file.
  • V-216909CAT IIMcAfee VirusScan On-Delivery Email Scan Policies log file size must be restricted and be configured to be at least 10MB.
  • V-216910CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to clean attachments as the first action for when an unwanted program is found.
  • V-216911CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all fixed, or local, disks and running processes.
  • V-216912CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all subfolders.
  • V-216913CAT IIMcAfee VirusScan On-Demand scan must be configured to scan boot sectors.
  • V-216914CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all files.
  • V-216915CAT IIMcAfee VirusScan On-Demand scan must be configured so there are no exclusions from the scan unless exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-216916CAT IIMcAfee VirusScan On-Demand scan must be configured to scan inside archives.
  • V-216917CAT IIMcAfee VirusScan On-Demand scan must be configured to decode MIME encoded files.
  • V-216918CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown program threats.
  • V-216919CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown macro threats.
  • V-216920CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to clean files automatically as first action.
  • V-216921CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to delete files automatically if first action fails.
  • V-216922CAT IIMcAfee VirusScan On-Demand scan must be configured to detect for unwanted programs.
  • V-216923CAT IIMcAfee VirusScan On-Demand scan must be configured to record scanning activity in a log file.
  • V-216924CAT IIMcAfee VirusScan On-Demand scan log file size must be restricted and be configured to at least 10MB.
  • V-216925CAT IIMcAfee VirusScan On-Demand scan must be configured to log any failure to scan encrypted files.
  • V-216926CAT IIMcAfee VirusScan On-Demand scan must be scheduled to be executed at least on a weekly basis.
  • V-216927CAT IIMcAfee VirusScan On-Access General Policies must be configured to enable scanning of scripts.
  • V-216928CAT IIMcAfee VirusScan On-Access General Policies must be configured to block the connection when a threatened file is detected in a shared folder.
  • V-216929CAT IIMcAfee VirusScan On-Access General Policies must be configured to unblock connections after a minimum of 30 minutes.
  • V-216930CAT IIMcAfee VirusScan On-Access General Policies must be configured to block the connection when a file with a potentially unwanted program is detected in a shared folder.
  • V-216931CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to use only one scanning policy for all processes, unless the use of Low-Risk Processes/High-Risk Processes has been documented with, and approved by, the IAO/IAM.
  • V-216932CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan when writing to disk.
  • V-216933CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan when reading from disk.
  • V-216934CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan all files.
  • V-216935CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to find unknown unwanted programs and trojans.
  • V-216936CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to find unknown macro viruses.
  • V-216937CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan inside archives.
  • V-216938CAT IIMcAfee VirusScan On-Access Default Processes Policies Actions for When a threat is found must be configured to clean files automatically as first action.
  • V-216939CAT IIMcAfee VirusScan On-Access Default Processes Policies actions for When a threat is found must be configured delete files automatically if first action fails.
  • V-216940CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured to enable Buffer Overflow Protection.
  • V-216941CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured for Protection mode.
  • V-216942CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured to display a dialog box when a buffer overflow is detected.
  • V-216943CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured to record scanning activity in a log file.
  • V-216944CAT IIMcAfee VirusScan Buffer Overflow Protection Policies log file size must be restricted and be configured to at least 10MB.
  • V-216945CAT IIMcAfee VirusScan Unwanted Programs Policies must be configured to detect spyware.
  • V-216946CAT IIMcAfee VirusScan Unwanted Programs Policies must be configured to detect adware.
  • V-216947CAT IIMcAfee VirusScan On-Access General Policies Artemis sensitivity level must be configured to medium or higher.
  • V-216948CAT IMcAfee VirusScan Access Protection Policies must be configured to prevent McAfee services from being stopped.
  • V-216949CAT IIMcAfee VirusScan Access Protection Policies must be configured to record scanning activity in a log file.
  • V-216950CAT IIMcAfee VirusScan Access Protection log file size must be restricted and be configured to at least 10MB.
  • V-216951CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent modification of McAfee files and settings.
  • V-216952CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent modification of McAfee Common Management Agent files and settings.
  • V-216953CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent modification of McAfee Scan Engine files and settings.
  • V-216954CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent termination of McAfee processes.
  • V-216955CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to block and report when common programs are run from the Temp folder.
  • V-216956CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent hooking of McAfee processes.
  • V-216957CAT IIMcAfee VirusScan Access Protection: Common Maximum Protection must be set to detect and log launching of files from the Downloaded Programs Files folder.
  • V-216958CAT IIMcAfee VirusScan Access Protection: Anti-Spyware Maximum Protection must be set to block and log execution of scripts from the Temp folder.
  • V-216959CAT IIMcAfee VirusScan Access Protection: Anti-Virus Standard Protection must be set to prevent remote creation of autorun files.
  • V-216960CAT IIMcAfee VirusScan Access Protection: Anti-Virus Standard Protection must be set to prevent mass mailing worms from sending mail.
  • V-216961CAT IIMcAfee VirusScan Access Protection: Anti-Virus Standard Protection must be set to prevent IRC communication.
  • V-216962CAT IIMcAfee VirusScan On-Access General Policies must be configured to not exclude any script processes from being scanned unless the process exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-216963CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to not exclude any files from being scanned unless exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-216964CAT IIMcAfee VirusScan On-Demand scan must be configured to scan memory for rootkits.
  • V-216965CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-216966CAT IIMcAfee VirusScan On-Delivery Email Scan Policies Artemis sensitivity level must be configured to medium or higher.
  • V-216967CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to send a notification email to the IAO, IAM, and/or ePO administrator when a threatened email message is detected.
  • V-216968CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to log session summary and failure to scan encrypted files.
  • V-216969CAT IIMcAfee VirusScan On-Access General Policies must be configured to not exclude any URL scripts from being scanned unless the URL exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-216970CAT IIMcAfee VirusScan Access Protection Policies must be configured to enable access protection.
  • V-216971CAT IIMcAfee VirusScan On Delivery Email Scan Policies, When a threat is found, must be configured to clean attachments as the first action and delete attachments if the first action fails.
  • V-216972CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to delete attachments if the first action fails for when an unwanted program is found.
  • V-216973CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-216974CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to detect unwanted programs.
  • V-216975CAT IIMcAfee VirusScan On-Access Default Processes Policies actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-216976CAT IIMcAfee VirusScan On-Access Default Processes Policies actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-216977CAT IIMcAfee VirusScan Access Protection Rules Anti-Spyware Maximum Protection must be set to block and report when common all programs are run from the Temp folder.
  • V-251880CAT I(U) McAfee VirusScan must have the current security patches installed.

Removed since V5R21 (87)

  • V-6453CAT IMcAfee VirusScan On-Access General Policies must be configured to enable on-access scanning at system startup.
  • V-6467CAT IIMcAfee VirusScan On-Access General Policies must be configured to scan boot sectors.
  • V-6468CAT IIMcAfee VirusScan On-Access General Policies must be configured to scan floppy during shutdown.
  • V-6469CAT IIMcAfee VirusScan On-Access General Policies must be configured to notify local users when detections occur.
  • V-6470CAT IIMcAfee VirusScan On-Access General Policies must be configured to prevent users from removing messages from the list.
  • V-6474CAT IIMcAfee VirusScan On-Access General Policies must be configured to log the scan sessions.
  • V-6475CAT IIMcAfee VirusScan On-Access General Policies log file size must be restricted and be configured to at least 10MB.
  • V-6478CAT IIMcAfee VirusScan On-Access General Policies must be configured to log the session summary.
  • V-6583CAT IIMcAfee VirusScan On-Access General Policies must be configured to log any failure to scan encrypted files.
  • V-6585CAT IIMcAfee VirusScan must be configured to receive DAT and Engine updates.
  • V-6586CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to enable on-delivery email scanning.
  • V-6587CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to find unknown program threats and Trojans.
  • V-6588CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to find unknown macro threats.
  • V-6590CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to decode MIME encoded files.
  • V-6591CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to scan email message body.
  • V-6592CAT IIMcAfee VirusScan On Delivery Email Scan Policies, when a threat is found, must be configured to clean attachments as the first action.
  • V-6596CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to record scanning activity in a log file.
  • V-6597CAT IIMcAfee VirusScan On-Delivery Email Scan Policies log file size must be restricted and be configured to be at least 10MB.
  • V-6599CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all fixed, or local, disks and running processes.
  • V-6600CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all subfolders.
  • V-6601CAT IIMcAfee VirusScan On-Demand scan must be configured to scan boot sectors.
  • V-6602CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all files.
  • V-6604CAT IIMcAfee VirusScan On-Demand scan must be configured so there are no exclusions from the scan unless exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-6611CAT IIMcAfee VirusScan On-Demand scan must be configured to scan inside archives.
  • V-6612CAT IIMcAfee VirusScan On-Demand scan must be configured to decode MIME encoded files.
  • V-6614CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown program threats.
  • V-6615CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown macro threats.
  • V-6616CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to clean files automatically as first action.
  • V-6617CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to delete files automatically if first action fails.
  • V-6618CAT IIMcAfee VirusScan On-Demand scan must be configured to record scanning activity in a log file.
  • V-6620CAT IIMcAfee VirusScan On-Demand scan log file size must be restricted and be configured to at least 10MB.
  • V-6625CAT IIMcAfee VirusScan On-Demand scan must be configured to log any failure to scan encrypted files.
  • V-6627CAT IIMcAfee VirusScan On-Demand scan must be scheduled to be executed at least on a weekly basis.
  • V-14618CAT IIMcAfee VirusScan On-Access General Policies must be configured to enable scanning of scripts.
  • V-14619CAT IIMcAfee VirusScan On-Access General Policies must be configured to block the connection when a threatened file is detected in a shared folder.
  • V-14620CAT IIMcAfee VirusScan On-Access General Policies must be configured to unblock connections after a minimum of 30 minutes.
  • V-14621CAT IIMcAfee VirusScan On-Access General Policies must be configured to block the connection when a file with a potentially unwanted program is detected in a shared folder.
  • V-14622CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to use only one scanning policy for all processes, unless the use of Low-Risk Processes/High-Risk Processes has been documented with, and approved by, the IAO/IAM.
  • V-14623CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan when writing to disk.
  • V-14624CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan when reading from disk.
  • V-14625CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan all files.
  • V-14626CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to find unknown unwanted programs and trojans.
  • V-14627CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to find unknown macro viruses.
  • V-14628CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to scan inside archives.
  • V-14630CAT IIMcAfee VirusScan On-Access Default Processes Policies Actions for When a threat is found must be configured to clean files automatically as first action.
  • V-14631CAT IIMcAfee VirusScan On-Access Default Processes Policies actions for When a threat is found must be configured delete files automatically if first action fails.
  • V-14652CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to clean attachments as the first action for when an unwanted program is found.
  • V-14654CAT IIMcAfee VirusScan On-Demand scan must be configured to detect for unwanted programs.
  • V-14657CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured to enable Buffer Overflow Protection.
  • V-14658CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured for Protection mode.
  • V-14659CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured to display a dialog box when a buffer overflow is detected.
  • V-14660CAT IIMcAfee VirusScan Buffer Overflow Protection Policies must be configured to record scanning activity in a log file.
  • V-14661CAT IIMcAfee VirusScan Buffer Overflow Protection Policies log file size must be restricted and be configured to at least 10MB.
  • V-14662CAT IIMcAfee VirusScan Unwanted Programs Policies must be configured to detect spyware.
  • V-14663CAT IIMcAfee VirusScan Unwanted Programs Policies must be configured to detect adware.
  • V-19910CAT IThe antivirus signature file age must not exceed 7 days.
  • V-35027CAT IIMcAfee VirusScan On-Access General Policies Artemis sensitivity level must be configured to medium or higher.
  • V-42493CAT IIMcAfee VirusScan On Delivery Email Scan Policies, When a threat is found, must be configured to clean attachments as the first action and delete attachments if the first action fails.
  • V-42500CAT IIMcAfee VirusScan On Delivery Email Scan Policies must be configured to delete attachments if the first action fails for when an unwanted program is found.
  • V-42516CAT IMcAfee VirusScan Access Protection Policies must be configured to prevent McAfee services from being stopped.
  • V-42517CAT IIMcAfee VirusScan Access Protection Policies must be configured to record scanning activity in a log file.
  • V-42518CAT IIMcAfee VirusScan Access Protection log file size must be restricted and be configured to at least 10MB.
  • V-42519CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent modification of McAfee files and settings.
  • V-42520CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent modification of McAfee Common Management Agent files and settings.
  • V-42521CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent modification of McAfee Scan Engine files and settings.
  • V-42522CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent termination of McAfee processes.
  • V-42523CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to block and report when common programs are run from the Temp folder.
  • V-42524CAT IIMcAfee VirusScan Access Protection: Common Standard Protection must be set to prevent hooking of McAfee processes.
  • V-42525CAT IIMcAfee VirusScan Access Protection: Common Maximum Protection must be set to detect and log launching of files from the Downloaded Programs Files folder.
  • V-42526CAT IIMcAfee VirusScan Access Protection: Anti-Spyware Maximum Protection must be set to block and log execution of scripts from the Temp folder.
  • V-42527CAT IIMcAfee VirusScan Access Protection: Anti-Virus Standard Protection must be set to prevent remote creation of autorun files.
  • V-42528CAT IIMcAfee VirusScan Access Protection: Anti-Virus Standard Protection must be set to prevent mass mailing worms from sending mail.
  • V-42529CAT IIMcAfee VirusScan Access Protection: Anti-Virus Standard Protection must be set to prevent IRC communication.
  • V-42530CAT IIMcAfee VirusScan On-Access General Policies must be configured to not exclude any script processes from being scanned unless the process exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-42531CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to not exclude any files from being scanned unless exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-42532CAT IIMcAfee VirusScan On-Demand scan must be configured to scan memory for rootkits.
  • V-42533CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-42534CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-42536CAT IIMcAfee VirusScan On-Delivery Email Scan Policies Artemis sensitivity level must be configured to medium or higher.
  • V-42537CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to send a notification email to the IAO, IAM, and/or ePO administrator when a threatened email message is detected.
  • V-42538CAT IIMcAfee VirusScan On-Delivery Email Scan Policies must be configured to log session summary and failure to scan encrypted files.
  • V-42539CAT IIMcAfee VirusScan On-Access General Policies must be configured to not exclude any URL scripts from being scanned unless the URL exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-42540CAT IIMcAfee VirusScan Access Protection Policies must be configured to enable access protection.
  • V-42541CAT IIMcAfee VirusScan On-Access Default Processes Policies must be configured to detect unwanted programs.
  • V-42542CAT IIMcAfee VirusScan On-Access Default Processes Policies actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-42543CAT IIMcAfee VirusScan On-Access Default Processes Policies actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-59363CAT IIMcAfee VirusScan Access Protection Rules Anti-Spyware Maximum Protection must be set to block and report when common all programs are run from the Temp folder.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V6R1 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.