Antivirus software is installed, active and up to date on all workstations and servers
Locally installed antivirus software will force users to analyse all files (executables or others) that are opened locally in a way that is transparent for them. A local database of malicious code signatures and rules about suspicious behaviour (such as attempts to contact other network stations) feed the algorithms for evaluating the risk of infection.
The backbone of security definitely rests upon prevention, discovery and remediation of the effects of malware.
Antivirus software can block most threats aimed at end users, without user intervention, notably when peripherals such as USB sticks, memory cards, optical disks are used, or when e-mail attachments are opened. Antivirus should be installed, active and up-to-date (each day, usually done automatically) on all the devices, workstations and servers involved in the workplace.