Storage Malware Scanning
Storage malware scanning checks every new file added to a Flywheel site for malware, however the file is added. The malware scanner checks each file in the background after Flywheel stores it, and Flywheel reports any finding to the site's Security Champions, the users who review findings on the Malware Triage page.
Added in version 23.0.0
Storage malware scanning is available starting in Flywheel Core version 23.0.0.
Limited Availability
In 23.0.0, storage malware scanning is available only for sites hosted on Amazon Web Services (AWS). It relies on cloud-native malware scanning capabilities, which increase hosting costs, and Flywheel enables it only on request. Interested customers should contact their Sales representative or Flywheel Support.
Disclaimer
Although Flywheel performs a best-effort malware scan, Flywheel cannot guarantee perfect detection of all malware in all files.
How It Works
- A user, device, or gear adds a file to the site, by any upload method.
- Flywheel stores the file, and the file is available right away.
- The malware scanner checks the file in the background.
- If the malware scanner finds malware, Flywheel records a finding, lists it on the Malware Triage page, and emails the site's Security Champions.
- A Security Champion reviews the finding and records a decision: the file is a false positive, or the file is marked for deletion.
- A user with permission to delete the file removes it from the site.
Scanning never blocks, delays, or deletes a file, and recording a decision does not delete files either. A file with a finding stays available until someone removes it.
Comparison with Malware Scanning during Bulk Import
Storage malware scanning is separate from malware scanning during Bulk Import, and Flywheel intends it to eventually replace Bulk Import scanning. Until then, Bulk Import continues to scan files during import as before.
| Malware scanning during Bulk Import | Storage malware scanning | |
|---|---|---|
| Coverage | Files imported with Bulk Import | Every new file, however it is added, including ad hoc uploads and gear outputs |
| Response | Rejects files that fail the scan before they reach Flywheel | Scans each file after Flywheel stores it, and reports findings without blocking or deleting files |
| Review | Results appear in the import audit report | Security Champions review findings on the Malware Triage page |
Security Champions
A Security Champion is a user who receives email about new malware findings and records decisions on the Malware Triage page. Security Champion is a site role that a user holds in addition to their main site role, such as User or Site Admin. Site Admins assign it on the Users page, and are not Security Champions themselves unless they also have the role.
If no active user is a Security Champion, the Users page shows a warning, because no one is notified of findings or can record decisions.
Access to Malware Triage
The Malware Triage page is in the Admin section of the left navigation, and appears only on sites with storage malware scanning enabled.
| User | Access |
|---|---|
| Security Champion | Views all findings and records decisions |
| Site Admin | Views all findings, read-only |
| Project Admin | Views findings for files in projects they administer, read-only |
| Collection Admin | Views findings for files in collections they administer, read-only |
Notifications
Flywheel emails the site's Security Champions about new findings. Each email identifies the finding by its ID and links to it, without file names.