1. A method comprising: obtaining a directory of files in a scan area of a storage device from a security system, wherein the storage device is subdivided into a scan area and a protected area, the scan area comprising a read/write area and the protected area being securely configurable between a normal read-only state and a writeable state, wherein the configuration is under the control of the security system, the security system having a secure memory which is inaccessible to code executed under an operating system; scanning files located in the scan area for all known identifiers of malicious code; after successfully scanning the files located in the scan area, activating security measures of the security system to convert the scan area to a portion of the protected area via: authenticating a first security measure, wherein the authentication executes out of the secure memory; writing a successful-scan completion timestamp into the secure memory; authenticating a second security measure; and converting the scan area to the portion of the protected area; wherein after conversion of the scan area to the portion of the protected area, the portion of the protected area is configured to the normal read-only state and is thereafter only scanned against identifiers of malicious code newly introduced since a last scan of the portion of the protected area.