China MSS Warns Antivirus Signature Databases Have a Shelf Life
China's Ministry of State Security warned that delayed antivirus and signature-database updates leave terminals exposed, citing cases at a research institute, a government office, and an enterprise. The Cybersecurity Law requires network operators to take technical measures against computer viruses, network attacks, and intrusion.
Outdated Signatures Leave Endpoints Exposed
Endpoint malware scanning is a core control against network attacks, and its effectiveness depends on current antivirus engines and signature databases. Industry surveys show that the number of new malware samples appearing each year is growing exponentially, which makes timely updates more important. In practice, many organizations and individuals fail to update antivirus software and virus databases on time, which can reduce protection.
China's Ministry of State Security (MSS), working with other departments, has reported several typical cases in which antivirus software was discontinued or signature databases expired, contributing to leaks of classified or important data. The cases point to weak terminal security management.
Cases Cited by MSS
In one research institute, the office-automation system went long periods without patching, and the virus database was not updated. Overseas attackers used that gap to compromise a server, implant a Trojan, and steal a large volume of important data that was later sold.
In a government office, endpoints did not follow regular virus-scanning measures. A work email account was then targeted in a network attack attributed to overseas hostile groups.
In an enterprise, a business system did not meet cybersecurity protection requirements. A public-facing server ran without adequate controls, antivirus software went unupdated for a long period, and attackers implanted malware and took remote control of the host.
Why Update Gaps Persist
Delayed antivirus and virus-database updates are tied to three factors.
Risk awareness is weak. Some staff treat installed antivirus software as sufficient and do not treat timely engine and signature updates as mandatory.
Operations attention is uneven. Some units emphasize hardware purchase and system deployment and give less attention to daily antivirus and signature maintenance.
Management mechanisms are incomplete. Terminal security duties are unclear, there is no unified update standard or periodic inspection, and updates depend on individual initiative.
Legal Duty and MSS Advice
The Cybersecurity Law of the People's Republic of China requires network operators to take technical measures to prevent computer viruses, network attacks, network intrusion, and other acts that harm cybersecurity. Units should accept primary responsibility and hold the cybersecurity baseline.
MSS advises units to fold terminal operations into overall cybersecurity planning, establish operations management rules, assign endpoint security duties, keep an antivirus and virus-database update ledger, set a fixed inspection cycle, and regularly check core business systems and key terminals so engines and signatures stay current.
Units should run periodic cybersecurity training so staff understand update risk and follow standard terminal practice. Each staff member should also check the update status of local antivirus software and signature databases.
MSS also advises units to add automated risk warning and intelligent behavior analysis as complementary controls, using advances in artificial intelligence and big data, while keeping basic endpoint protection in place.