r5.2 Deploy maintained and monitored anti-malware/EDR on instances
Install and maintain anti-malware/EDR solutions on at-risk system components, with automatic updates, active execution, and audit-log generation, without allowing users to disable them.
AWS services
AWS Systems Manager 
Amazon EC2 
Amazon CloudWatch Requirement 5
Protect All Systems and Networks from Malicious Software
PCI sub-requirements covered
- 5.2 Malicious software is prevented, or detected and addressed
- 5.3 Anti-malware mechanisms and processes are active, maintained, and monitored
How to implement on AWS
Deploy the EDR/anti-malware agent through SSM Distributor and State Manager to ensure presence and an up-to-date version on all instances. Prevent deactivation by end users. Centralize agent logs and health status. Keep signatures/mechanisms updated automatically.
Practical implementation
How this control is implemented in each reference architecture:
Deploy the EDR/anti-malware agent to the app/data instances via SSM Distributor + State Manager, prevent users from disabling it, and centralize its logs in CloudWatch.
Single-account, 3-tier →Manage the EDR deployment and version baseline centrally (SSM shared documents/State Manager) so every CDE account runs the same maintained agent; health status rolls up to the security tooling account.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine anti-malware configurations, including the master installation, to verify automatic updates are enabled and definitions are current (5.3.1.a, 5.3.1.b).
- Examine configurations and scan results to verify the solution performs periodic scans or continuous behavioral analysis (5.3.2.a, 5.3.2.c).
- Examine configurations and interview personnel to verify anti-malware mechanisms cannot be disabled/altered by users unless documented and authorized by management for a limited time (5.3.5.a, 5.3.5.b).
Evidence in AWS
- SSM State Manager compliance report showing the agent installed and updated on all instances.
- Configuration that prevents end users from deactivating the agent.
- Anti-malware agent logs centralized in CloudWatch.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 5.2 — Automated mechanisms are implemented to prevent systems from becoming an attack vector for malware.
- 5.3 — Anti-malware mechanisms can detect and address the latest malware threats.
Learning resources
References
- AWS Security Maturity Model: EDR / anti-malware