DSPT Evidence Required: Anti-virus/anti-malware solution name, update frequency, and coverage confirmation
As of 26 May 2026, the VPS host has no anti-malware software installed. No Docker containers run anti-malware either.
| Component | Anti-Malware Installed | Notes |
|---|---|---|
| VPS host (Ubuntu) | ❌ None | ClamAV not installed; freshclam not configured |
| gp_booking_app | ❌ None | Covered by host-level scan |
| gp_booking_nginx | ❌ None | Covered by host-level scan |
| wikijs | ❌ None | Covered by host-level scan |
| keycloak | ❌ None | Covered by host-level scan |
| forgejo | ❌ None | Covered by host-level scan |
| defectdojo | ❌ None | Covered by host-level scan |
These tools are active but do not satisfy the DSPT anti-malware evidence requirement:
| Tool | Purpose | Does it satisfy DSPT? |
|---|---|---|
| UFW firewall | Blocks all ports except 443, 80, 51820 | ❌ Reduces attack surface only |
| Fail2ban | Blocks brute-force and suspicious IPs | ❌ Intrusion prevention, not malware scanning |
| Trivy | Scans container images for CVEs | ❌ Vulnerability scanning, not malware |
| Watchtower | Auto-updates Docker containers | ❌ Patching, not malware scanning |
| unattended-upgrades | Auto-applies OS security patches | ❌ Patching, not malware scanning |
| User | Device | Built-in AV | Status |
|---|---|---|---|
| Matthew | Laptop | Windows Defender or XProtect | ⬜ Unconfirmed |
| Peter | Laptop | Windows Defender or XProtect | ⬜ Unconfirmed |
The DSPT requires three things to be evidenced:
Install ClamAV (open-source, GPL licensed):
| Requirement | Implementation |
|---|---|
| Solution name | ClamAV (clamav + clamav-daemon) |
| Update frequency | Daily via freshclam systemd service |
| Coverage | Weekly scan of /opt/, /root/, /var/lib/docker/, /etc/, /home/ |
| Scan schedule | Sunday 03:00 (alongside Trivy scans) |
| OS | Built-in Solution | Update Frequency | Verification |
|---|---|---|---|
| Windows | Windows Defender / Microsoft Defender Antivirus | Automatic via Windows Update | Settings → Windows Security → Virus & threat protection or Get-MpComputerStatus |
| macOS | XProtect + Gatekeeper | Automatic via macOS Software Update | System Settings → General → Software Update (automatic updates on) |
Each user should confirm their device's built-in anti-malware is active and record the confirmation.
apt update && apt install -y clamav clamav-daemon
systemctl enable --now clamav-freshclam
cat > /etc/cron.weekly/clamav-scan << 'EOF'
#!/bin/bash
LOG=/var/log/clamav/weekly-scan.log
mkdir -p /var/log/clamav
clamscan --recursive --quiet \
/opt/ /root/ /var/lib/docker/ /etc/ /home/ \
--exclude-dir=/var/lib/docker/overlay2/ \
--log="$LOG" --infected
EOF
chmod +x /etc/cron.weekly/clamav-scan
clamscan --version
systemctl status clamav-freshclam
# Check update recency
ls -la /var/log/clamav/freshclam.log
| Evidence | Location / Command |
|---|---|
| Anti-malware solution name | This page (/policies/standard_9d_anti_malware) |
| Virus definition update recency | grep "Downloaded daily.cvd" /var/log/clamav/freshclam.log \| tail -1 |
| Weekly scan log | /var/log/clamav/weekly-scan.log (created after first scan) |
| ClamAV active | systemctl is-active clamav-freshclam |
| Workstation confirmation | Recorded in /operations/remediation/ |