McAfee VirusScan Access Protection Properties must be configured to enable access protection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-42573	DTAM161	SV-55301r2_rule		Medium

Description
Access Protection prevents unwanted changes to a computer by restricting access to specified ports, files and folders, shares, and registry keys and values. It prevents users from stopping McAfee processes and services, which are critical before and during outbreaks. Access Protection for VSE uses predefined and user-defined rules to strengthen systems against virus attacks. For instance, rules are used to specify which items can and cannot be accessed. Each rule can be configured to block and/or report access violations when they occur, and rules can also be disabled.

Description

Access Protection prevents unwanted changes to a computer by restricting access to specified ports, files and folders, shares, and registry keys and values. It prevents users from stopping McAfee processes and services, which are critical before and during outbreaks. Access Protection for VSE uses predefined and user-defined rules to strengthen systems against virus attacks. For instance, rules are used to specify which items can and cannot be accessed. Each rule can be configured to block and/or report access violations when they occur, and rules can also be disabled.

STIG	Date
McAfee VirusScan 8.8 Local Client STIG	2015-03-30

Details

Check Text ( C-49372r3_chk )
NOTE: If Access Protection is being provided by the McAfee HIPS signatures, for the same protection as the requirements included in this STIG, this check can be marked Not Applicable. Access the local VirusScan console by clicking Start->All Programs->McAfee->VirusScan Console. Under the Task column, select Access Protection, right-click, and select Properties. Under the Access Protection tab, ensure the "Enable Access Protection" option is selected. Criteria: If the "Enable Access Protection" option is not selected, this is a finding. On the client machine use the Windows Registry Editor to navigate to the following key: HKLM\Software\McAfee\ (32-bit) HKLM\Software\Wow6432Node\McAfee\ (64-bit) SystemCore\VSCore\On Access Scanner\BehaviourBlocking Criteria: If the value APEnabled is not set to "1", this is a finding.

Check Text ( C-49372r3_chk )

NOTE: If Access Protection is being provided by the McAfee HIPS signatures, for the same protection as the requirements included in this STIG, this check can be marked Not Applicable.

Access the local VirusScan console by clicking Start->All Programs->McAfee->VirusScan Console.
Under the Task column, select Access Protection, right-click, and select Properties.

Under the Access Protection tab, ensure the "Enable Access Protection" option is selected.

Criteria: If the "Enable Access Protection" option is not selected, this is a finding.

On the client machine use the Windows Registry Editor to navigate to the following key:
HKLM\Software\McAfee\ (32-bit)
HKLM\Software\Wow6432Node\McAfee\ (64-bit)
SystemCore\VSCore\On Access Scanner\BehaviourBlocking

Criteria: If the value APEnabled is not set to "1", this is a finding.

Fix Text (F-48155r2_fix)
Access the local VirusScan console by clicking Start->All Programs->McAfee->VirusScan Console. Under the Task column, select Access Protection, right-click, and select Properties. Under the Access Protection tab, select the "Enable Access Protection" option. Click OK to save.