PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 5 / c5.1
Quick Wins Threat DetectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.1 Enable malware detection with Amazon GuardDuty

Turn on managed threat and malware detection in the environment, including Malware Protection for EC2 and ECS workloads, as a cost-efficient baseline against malicious software.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: High Applies to CDE: Yes

Requirement 5

Protect All Systems and Networks from Malicious Software

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

5.2 Malicious software is prevented, or detected and addressed
  • 5.2.1 Anti-malware deployed on all system components at risk Covered
  • 5.2.2 Anti-malware detects/removes/blocks all known malware types Covered
  • 5.2.3 System components not at risk are evaluated periodically Your responsibility
  • 5.2.3.1 Frequency of periodic evaluations defined by targeted risk analysis Your responsibility
5.3 Anti-malware mechanisms and processes are active, maintained, and monitored
  • 5.3.1 Anti-malware kept current via automatic updates Covered
  • 5.3.2 Anti-malware performs periodic scans and active/real-time scanning Covered
  • 5.3.2.1 Scan frequency defined by targeted risk analysis (if applicable) Your responsibility
  • 5.3.3 Anti-malware for removable media scans/behavioral analysis Covered
  • 5.3.4 Audit logs for anti-malware enabled and retained Covered
  • 5.3.5 Anti-malware cannot be disabled/altered by users unless authorized Covered

How to implement on AWS

Enable Amazon GuardDuty across all accounts and Regions via the organization's delegated administrator account. Turn on GuardDuty Malware Protection. Send findings to Security Hub and alert with EventBridge. GuardDuty runs continuously and agentlessly for threat analysis.

Practical implementation

How this control is implemented in each reference architecture:

Turn on managed, agentless malware and threat detection as the cost-efficient baseline, and route findings where the team will see them.

  1. Enable Amazon GuardDuty in the account and turn on the Malware Protection feature for EC2/ECS workloads.
    Account-wide detection GuardDuty
  2. Send GuardDuty findings to Security Hub for a consolidated view.
    Account-wide detection Security Hub
  3. Route and alert on malware findings with an EventBridge rule to the team's notification channel.
    Account automation EventBridge

How to validate: GuardDuty and Malware Protection are enabled, and a test finding (e.g. GuardDuty sample findings) appears in Security Hub and triggers the alert.

Avoid: Treating GuardDuty as the only malware control. It is the detection baseline; still deploy endpoint anti-malware/EDR (c5.2) on at-risk instances.

Single-account, 3-tier →

Enable detection once from the delegated administrator so every current and future CDE account is auto-enrolled and findings aggregate centrally.

  1. Enable GuardDuty organization-wide from the delegated administrator in the security tooling account, with auto-enable for new accounts.
    Security tooling account → PCI OU GuardDuty AWS Organizations
  2. Turn on Malware Protection org-wide so it covers every CDE account uniformly.
    PCI OU (all CDE accounts) GuardDuty
  3. Aggregate all findings in the delegated-admin Security Hub for one detection view.
    Security tooling account Security Hub

How to validate: GuardDuty organization status shows all accounts enrolled with auto-enable on, and Malware Protection is active across the PCI OU.

Avoid: Enabling GuardDuty account-by-account. New accounts get missed; use org auto-enable from the delegated admin.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine system components to verify that an anti-malware solution is deployed on all components except those a periodic evaluation determined not at risk (5.2.1.a).
  • Examine vendor documentation and configurations to verify the solution detects and removes/blocks/contains all known types of malware (5.2.2).
  • Examine the periodic-evaluation process for components deemed not at risk (5.2.3.a, 5.2.3.c).

Evidence in AWS

  • GuardDuty enabled across all accounts/Regions (organization status).
  • GuardDuty Malware Protection active and findings in Security Hub.
  • EventBridge rules that route and alert on malware findings.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 5.2 — Automated mechanisms are implemented to prevent systems from becoming an attack vector for malware.
  • 5.3 — Anti-malware mechanisms can detect and address the latest malware threats.

AWS services

Amazon GuardDuty AWS Security Hub Amazon EventBridge

Learning resources

References

  • AWS Security Maturity Model: Detect common threats