Application Control query

Hello pdc,

you can either Authorize or Block an application. If it set to blocked and on-access scanning is set to Detect but allow to run it executes otherwise not, an event is logged in both cases. Some would like the Detect but allow to run to be application specific but for now it's a global setting. In case you wonder why this might be needed - each application type contains an All added by Sophos in the future "generic" application and you might want to be alerted of added applications but not block them by default.

You should find computers with suspicious files in the Computers with alerts section in SEC (they have now their own link). Also see Placebo's Nice Sophos DB query's (the apostrophe is his :smileywink:).

I'm not aware of significant changes in AppCtrl but the new Tamper protection might be of interest if your users are admins.

Christian

Thanks QC, much appreciated

I guess I'm really keen to ensure that if I was to implement a block on applications, that the AV client will prevent staff from running those blocked apps.

In terms of the desktop alert that you can present to the user, is it possible to put a variable into the alert message which will list the application name as part of the alert?

For example, is it possible to set the alert text to be something like " %APPNAME% is not permitted as outlined in the IT Policy..."  ???

Obviously if someone is *really* determined, they will always find a means to get around it. With the application control and the tamper protection in place it is sufficient to make it clearly known to those determined people; that they are knowingly circumventing controls. At that stage IT have the means to take further action on, if necessary.

Thanks again for your time and assistance

You're welcome.

If an application is blocked the Sophos icon displays for several seconds a balloon which says (using SAV9.0):

Controlled application detected by Sophos.

File ... of controlled application ... (of type ...) has been detected.

your message (up to 100 characters) to the user here

Application and type are as in the policy, for example application 'MS Windows Games' (of type Game).

Christian

It's worth noting that the application control identity will attempt to block both the initial installation process and application execution.

If anybody has any additional feedback on application control and how you'd like to see it improved I'd welcome your input via this thread.

Best regards,

John Stringer

Product Manager

Thanks John for the additional info.

As a matter of interest, is there a means to further configure the alert message that appears, when a blocked application install is attempted?

For example, in my test I put a block on all IM clients, I then attempted an installation of google talk.Sophos does the job I expect, but the message displayed is a bit confusing..

   Controlled application blocked by Sophos

   File "C:\Documents and settings\username\desktop\googletalk-setup.exe" of controlled application 'Google Talk' (of type Voice over IP) has....

   [Custom message text set at application control policy]

I had to read the message a few times to make sense of it, I've no idea what is meant to follow the "has..."

I'm sure it's the same message if we were to activate application controls it against systems that aready have controlled apps installed.

couldn't find an option to edit the last post, so this an addendum to it..

I've tried the similar process with other 'controlled apps' and I get the full message to appear. It seems that in my first test with google talk the "has been detected" part was chopped off the end of the message.

I'm guessing that the 'controlled application path' is too long. There must be a limit to how long the message can be?? Perhaps a similar restriction, like the one for the custom text which is limited to 100 characters

Yes, looks like that is the problem. I wonder if its necessary to show the full path in the end user alert - perhaps just the filename would be enough. What do you think?

John

From your perspective it could be a tough one to call. As the saying goes; you can't please everyone all the time...

From my experience most users will have no interest in what the pop-up is, they are going to be none to happy that their app is no longer  working. They will either accept that the policy doesn't allow it, or they will log a complaint with the IT team.

In my personal opinion, I would prefer to see the message kept as simple as possible, something along the lines of;

Controlled application blocked by Sophos

The application '<Application Name>' has been detected

[Then your custom text]  <- I typically set the text to advise the user to contact the IT team if necessary.

In my opinion I would leave the application path out of the pop-up. The sophos client application on the computer does show the application paths in the quarantine list, so the IT techs can locate the files this way if needs be.

The complete path will still be in SAV.txt, if you need it you can look it up.

Thinking about it - it'd be nice if the notification could contain a clickable link to the IT-policy ...

Christian

I agree - but that doesn't necessarily mean it will be changed :) I will raise a defect though.

Thanks,

John