|
  Application whitelisting review: Lumension Application Control
Reported by Industry Standard on Wednesday, 4 November 2009 (on November 4, 2009)
|
Lumension Application Control is a strong whitelisting solution with broad file coverage, excellent reporting, and a complete set of Windows file definitions that can be used to spot potentially troublesome changes to system files. Its one noteworthy shortcoming is the inability to create whitelisting rules based on the digital signatures of application publishers.
Lumension, which is the product of the marriage of PatchLink and SecureWave, is the parent of several security components and modules, including Application Control (covered in this review), device control, data protection, vulnerability assessment, patching, and anti-virus.
[ Read the Test Center review of application whitelisting solutions from Bit9, CoreTrace, Lumension, McAfee, SignaCert, and Microsoft. Compare these application whitelisting solutions by the features. ]
Application Control is essentially the latest incarnation of SecureWave's Sanctuary, an application whitelisting product that has been on the market for more than six years. Application Control can be purchased separately, but it is intended to be a primary part of the Lumension Endpoint Protection solution, which includes Lumension AntiVirus, or the Lumension Endpoint Security Solution Pack, which includes Lumension Device Control. Application Control and Device Control share the same management console.
The server-side management console, called Lumension Endpoint Security Management screen image, serves multiple components, so it's inherently a bit busier than its counterparts in whitelisting-only products. However, Lumension allows customers to use as many management servers as they need, without paying any server licenses -- a key advantage when trying to scale out an enterprise deployment or address performance or management issues.
Lumension, like SignaCert, comes with a complete set of standard file definitions (SFDs) for Windows 2000 to Windows 7 operating systems, prescanned and prehashed. These "gold" definitions are useful for noting deviations from the Microsoft defaults. Like all of the competitors in this roundup, Lumension can scan one or more existing computers to automatically generate whitelist execution rules, using the Scan Explorer feature.
Unlike most of the other competitors, Lumension can create whitelisting rules for all file types, although it defaults to executables only. The Exe Explorer feature will reveal individual files and their attributes found during the scan or already stored in the database. Files are identified by the normal file attributes (such as name or size) and SHA-1 hashes. Additionally, Lumension allows you to define path rules (allow only) and trusted users who can run anything (called Local Authorization). Unfortunately, Lumension does not support whitelisting using publisher digital signatures, which is a significant omission in an otherwise very good product.
Identified files are then collected into one or more file groups, custom or predefined -- for example, 16-bit, Accessories, Boot files, Logon files, Windows Common, or a trust-but-watch lists. File groups can be further subdivided. You could have, say, a collective group called Adobe that covers all Adobe files and subgroups for each of Adobe's various products, such as Adobe Reader and Adobe AIR. Lumension's Database Explorer lets the administrator view the various file groups and add identified files screen image.
Users, computers, and groups can be imported from the local Windows SAM (Security Accounts Manager) database, Active Directory, or Novell's eDirectory (Lumension and SignaCert are the only products in this review to integrate with eDirectory), and then linked to one or more file groups, along with whether that particular file group can be authorized (allowed to run) or unauthorized (prevent execution). Any file or file group not explicitly marked as Authorized is considered unauthorized. Like Bit9's Parity, Lumension can send an alert if a particular unauthorized executable becomes popular with too many users too fast. Called "Spread Check" in Lumension, this feature is designed to contain malware outbreaks.
Dialog messages are customizable. Users and administrators can quickly deny all unauthorized applications, modules (Visual Basic), and scripts (JavaScript and VBScript only) in an emergency. Each managed computer checks in for a new policy at every boot-up, and if the user is offline and unable to connect to the network, an admin can provide a new set of permissions (execute or not execute) that can be manually imported.
Lumension has some of the strongest reporting in this review. Each log transaction is detailed and stored locally on the client until transmitted to the central database, which runs Microsoft SQL Server 2005 or 2008, 32-bit or 64-bit, or Express. Administrators can use regular SQL query tools and reports to extract events or export them to syslog.
While the Report menu option shows system status information, such as when the client's policy was last updated or which server the client got its policy from, queries are both numerous and extremely flexible in Lumension's Log Explorer. Log Explorer shows whitelisting events and provides a good number of "query templates" that are useful in pulling needed information out of the log file. Each built-in query can easily be edited by clicking and choosing various fields of data, as well as dates, conditions, schedules, and formats (XML, CSV, HTLM). Plus, you can right-click any event and turn it into a blacklisted or whitelisted file belonging to one or more file groups screen image.
This story, "Application whitelisting review: Lumension Application Control," and reviews of competing products from Bit9, CoreTrace, McAfee, SignaCert, and Microsoft, were originally published at InfoWorld.com. Follow the latest developments in information security and endpoint security at InfoWorld.com.
Links: Full news story
|
|
| |
| | Recent related news |
| |
guardian.co.uk
35 minutes ago - Business | In the latest in a series of pieces giving legal advice to the voluntary sector, Philip Trott, a... |
guardian.co.uk
2 hours ago - Money | With twice as many applications forecast this year, auditors fear more unanswered calls and unpaid... |
Industry Standard
12 hours ago - Computer Industry | Sometime in the next few weeks, Microsoft will reveal features, services and shortcomings for Windows... |
Proactive Investors
15 hours ago - Business | *Metminco (ASX: MNC)* has announced its intention to list on London’s AIM market, after it... |
engadget
15 hours ago - Technology | No need to spot clean your spectacles, and no need to brush the cobwebs out of your dome -- you... |
| |
Industry Standard
16 hours ago - Computer Industry | Fine-grained network controls that are coming with next-generation mobile technology could make some... |
Consumer Reports
17 hours ago - Consumer | *Black Box 101: The basics of Event Data Recorders*
GM Event Data Recorder.
Most new passenger... |
Huffington Post
1 day ago - World | New analysis published this week in PLoS Medicine provides a powerful reminder of the unique and... |
Industry Standard
3 days ago - Computer Industry | The journey began in 2005, when the Ontario Municipal Employees Retirement System (OMERS) engaged us... |
Industry Standard
1 week ago - Computer Industry | So you told your boss that you bought your Android smartphone so that you could track your business... |
| |
|
|
|
| |
Facebook
E-mail
Twitter
Mixx
StumbleUpon
FriendFeed
Tweet the News!
Select Region >
Top News RSS Feed | News for my Website | Archive | Advertise | Help | Enquiries | Bookmark this site | 
U.S. version
