Siemens informed its customers on Tuesday that it is working with Microsoft to address an issue related to Microsoft Defender Antivirus (MDAV) and Simatic PCS products .
See also: Microsoft Family Safety blocks all versions of Chrome browser
According to the announcement published by the industrial giant, the problem is that Defender Antivirus currently does not offer the “alert only” feature.
Siemens documentation for the Simatic PCS 7 and PCS Neo includes Microsoft Defender Antivirus settings, which allow threat alert levels to be defined without automatic action when malware.
However, if the option is set to "ignore", then no action is taken and no notification is sent to the system operator or administrator in case of malware detection.
See also: Microsoft Defender vulnerability allows elevation of privilege
Conversely, if any other setting is used, Defender Antivirus may delete or quarantine files that have been flagged as potential malware (whether real or false positive detections), which may cause system interruptions if the system relies on that particular file.
Until the company finds a solution in collaboration with Microsoft, it is recommended that facility managers using Simatic PCS conduct a risk assessment to decide whether they prefer to receive notifications about malware infections or accept the risk of operational disruptions if the antivirus deletes potentially critical files .
Customers can group affected devices into clusters and apply different settings to each group, depending on their needs and requirements.
See also: Windows Defender protection bypassed with XOR techniques
A related point worth emphasizing is that in industrial environments , such as those using Simatic PCS 7 or PCS Neo automation systems , the availability and uninterrupted operation of the systems are of critical importance. For this reason, Siemens recommends careful parameterization and separation of devices into groups , so that antivirus settings can be adapted on a case-by-case basis—e.g., in critical subsystems, the emphasis should be on stability, while in less critical ones, the emphasis should be on security .
Source: securityweek
