The antivirus signature file age must not exceed 7 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-19910	DTAG008	SV-56366r2_rule		High

Description
Antivirus signature files are updated almost daily by antivirus software vendors. These files are made available to antivirus clients as they are published. Keeping virus signature files as current as possible is vital to the security of any system.

STIG	Date
McAfee VirusScan 8.8 Local Client STIG	2017-01-04

Details

Check Text ( C-49293r5_chk )
Access the local VirusScan console by clicking Start >> All Programs >> McAfee >> VirusScan Console. Click Help >> About VirusScan Enterprise. The “About” dialog box will be displayed, showing, among other information, the current DAT version installed and the date of that DAT version. Guidance in DTAM016 requires updates be run daily, automatically or manually. If compliant, the DAT date will be within 24-48 hours old. Since automated update tasks’ success is not guaranteed, the expectation is for update task success to be frequently monitored and corrected when unsuccessful. To allow for that correction, the minimum acceptable threshold for DAT date is not to exceed 7 days. If the DAT date displayed is more than “7” days old, this is a finding. If the vendor or trusted site's files match the date of the signature files on the machine, this is not a finding.

Check Text ( C-49293r5_chk )

Access the local VirusScan console by clicking Start >> All Programs >> McAfee >> VirusScan Console.

Click Help >> About VirusScan Enterprise.

The “About” dialog box will be displayed, showing, among other information, the current DAT version installed and the date of that DAT version.
Guidance in DTAM016 requires updates be run daily, automatically or manually. If compliant, the DAT date will be within 24-48 hours old. Since automated update tasks’ success is not guaranteed, the expectation is for update task success to be frequently monitored and corrected when unsuccessful. To allow for that correction, the minimum acceptable threshold for DAT date is not to exceed 7 days.

If the DAT date displayed is more than “7” days old, this is a finding.

If the vendor or trusted site's files match the date of the signature files on the machine, this is not a finding.

Fix Text (F-49199r1_fix)
Access the local VirusScan console by clicking Start->All Programs->McAfee->VirusScan Console. Under the Task column, select the AutoUpdate option, right-click, and select "Start".