Device and Application Control

Size: px

Start display at page:

Download "Device and Application Control"

Joan Hensley
5 years ago
Views:

1 Device and Application Control powered by HEAT Software Commercial Product Assurance (CPA) Compliance Version 5.1 Update 1

2 Commercial Product Assurance (CPA) Compliance Contents Contents Welcome! Getting CPA Compliance Up and Running Installing a New System for CPA Compliance New Installation Configuration Checklist Configuring an Existing System for CPA Compliance Understanding CPA Compliance Mode CPA Compliance Mode Configuration Window Application Control Requirements for CPA Compliance CPA Compliance Statuses Using CPA Compliance Mode Enabling Full CPA Compliance Mode Switching to Partial Compliance Mode Disabling CPA Compliance Mode Copyright 2017, Ivanti. All Rights Reserved. Terms of Use. Page 2 of 32

3 Welcome! Welcome! We're going to guide you through the process of configuring Ivanti Device and Application Control to enforce Commercial Product Assurance (CPA) compliance with Application Control in your environment. CPA Compliance Mode meets the Software Execution Control characteristic published by the Communications-Electronic Security Group (CESG) of the United Kingdom. Any government, public sector, or commercial industries that access UK government accredited networks are required to run CPA-accredited software in a compliant configuration. This includes all systems that process OFFICIAL Tier data. A simple click ensures you achieve a secure configuration as recommended for CESG compliant endpoints. The version of Ivanti Device and Application Control evaluated by the CESG was 4.6 SR2 Build 439 ( ), but they recommend that the latest available version of the product be deployed. CPA Compliance Mode will change settings throughout your environment, which can result in changes to endpoint behavior. Read this guide thoroughly and retain it for future reference. Getting CPA Compliance Up and Running Learn how to install or upgrade Ivanti Device and Application Control 4.6 SR2 (build 439) to get CPA Compliance in your environment. 3

5 Installing a New System for CPA Compliance Installing a New System for CPA Compliance Installation of Application Control with CPA Compliance Mode on a new system requires some preparation and planning, but is a fairly straightforward process. Following your initial setup of the database server and your compliance policy, each endpoint you add to the system will automatically meet the CPA requirements. Consult the Ivanti Device and Application Control SR2 Setup Guide for detailed installation instructions. 1. If you haven t already, get your CPA license file. Contact your Ivanti Sales Rep. 2. Copy the license file to the \\Windows\System32 or \\Windows \SysWOW64 folder. 3. Download Ivanti Device and Application Control 4.6 from the Self Service Portal. The version evaluated by the CESG was 4.6 SR2 Build 439 ( ), but they recommend that the latest available version of the product be deployed. 4. Install the Database: a. Log in to the computer as an administrative user with access to a Microsoft SQL Server b. From the location where you saved the Ivanti Device and Application Control application software, run the \server\db\setup.exe file. The Installation Wizard Welcome Page opens. c. Complete the wizard. 5. Install the Application Server: a. Log in with administrative user access to the computer where you are installing the Application Server. b. From the location where you saved the Ivanti Device and Application Control application software, run \server\sxs\setup.exe.the Installation Wizard Welcome page opens. c. Complete the wizard. 5

6 Chapter 2: Installing a New System for CPA Compliance 6. Deploy the Ivanti Device and Application Control client to endpoints with the CPA license using the Client Deployment tool. Ensure the license is in the same folder as the client installer and set the license file via the CDT > Packages > Set License option. 6

7 New Installation Configuration Checklist New Installation Configuration Checklist If you have never used Application Control before, follow this configuration path. Consult the Application Control User Guide for detailed instructions. Identify all the Computers/Users Groups that need to be CPA compliant These are all the endpoints that access UK government accredited networks and have access to OFFICIAL Tier data. Determine what software is authorized to run in the CPA environment Review your company s list of authorized software and version that is required in the enterprise for each type of system, including servers, workstations, and laptops. Discover what software is currently running in your environment Use the Authorization Wizard tool to scan endpoints in your environment to identify executable filenames and their associated hashes, which Ivanti Device and Application Control will collect and store in logs. Compare your scan results with the authorized software list (created in the list item above). The amount of unauthorized software you detect can be large. Work with endpoint users to identify what software they need and update the authorized software list accordingly. See Using the Authorization Wizard in the Application Control 4.6 User Guide. Create custom file groups and required parent-child relationships File groups simplify the process of administering large numbers of executable, script, and macro files for users. Instead of individually authorizing files, you can group files together logically by creating file groups. See Adding a File Group in the Application Control 4.6 User Guide. Assign scanned files to the files groups After you create the necessary file groups and required parent-child relationships, assign executable files, scripts, and macros to the file groups. See Assigning Files to File Groups in the Application Control 4.6 User Guide. 7

8 Chapter 3: Configuring a New System for CPA Compliance Set the Full CPA Compliance Mode Date Decide when you want to start enforcing full CPA compliance mode in your environment. Keep in mind it can take up to 1 month to correctly configure and test the options. Configure Policy Settings to Meet CPA Compliance Create policies with settings that meet CPA compliance requirements. This involves enabling all the settings as shown in the CPA compliance dialog box (see the Application Control Option Settings Required for CPA Compliance). Send an Introductory to Affected Users Notify endpoint users prior to the Full CPA Compliance Mode date to introduce them to Application Control and the software they are authorized to run in your environment. Test the Full CPA Compliance Mode Settings on a Small Number of Endpoints Select a small number of endpoints (no more than 10) that give you the widest cross-section of variability within the organization and test how they are affected by the full CPA compliance mode settings. Apply Policies with CPA Compliance Settings to All Endpoints Monitor activity in your environment and help users adjust to the new restrictions. 8

9 Configuring an Existing System for CPA Compliance Configuring an Existing System for CPA Compliance Follow this configuration path if you are familiar with Application Control and already using it in your environment. CPA Compliance Mode will change settings throughout your environment, which can result in changes to endpoint behavior. Prepare carefully. Set the Full CPA Compliance Mode Date Decide when you want to start enforcing full CPA compliance mode in your environment. Keep in mind it can take up to 1 month to correctly configure and test the options. Configure Policy Settings to Meet CPA Compliance Create policies with settings that meet CPA compliance requirements. This involves enabling all the settings as shown in the CPA compliance mode window (see Application Control Option Settings Required for CPA Compliance) Send an Introductory to Affected Users Notify endpoint users prior to the Full CPA Compliance Mode date to introduce them to Application Control and the software they are authorized to run in your environment. Test the Full CPA Compliance Mode Settings on a Small Number of Endpoints Select a small number of endpoints (no more than 10) that give you the widest cross-section of variability within the organization and test how they are affected by the full CPA compliance mode settings. Apply Policies with CPA Compliance Settings to All Endpoints Monitor activity in your environment post and help users adjust to the new restrictions. 9

10 Chapter 4: Configuring a New System for CPA Compliance Install the CPA license and enable FULL CPA compliance Mode Copy the license file to the \\Windows\System32 or \\Windows \SysWOW64 folder and restart the SXS service. Full CPA Compliance mode will be enabled. Understanding CPA Compliance Mode Let's learn about the concepts and UI elements you need to understand to use CPA Compliance Mode effectively. 10

11 CPA Compliance Mode Configuration Window CPA Compliance Mode Configuration Window Use this window to configure CPA compliance in your environment and check its status. You will see this window the first time you log into the Server Management Console after installing the CPA license. It can be displayed at any time by selecting Tools > Configure CPA Compliance Mode. 11

12 Chapter 5: CPA Compliance Mode Configuration Window 12

13 Application Control Requirements for CPA Compliance Application Control Requirements for CPA Compliance You must set specific Application Control options in your environment to be fully complaint with the CESG's Software Execution Control requirements. The CPA Compliance Mode Configuration dialog enables you to set the required options in one click. Execution Blocking set to Blocking mode Local Authorization set to Disabled Client Hardening set to Basic (Computer and User/Group options) The execution of unauthorized executable files is blocked. (Computer options) Users are prevented from locally authorizing files to execute. (Computer options) Users with administrative privileges are prevented from uninstalling the Ivanti Device and Application Control agent, as well as deleting local shadow files and log entries. You can remain CPA compliant by setting the more restrictive Extended option (valid salt value required to deactivate the agent). 13

14 Chapter 6: Requirements for CPA Compliance Execution Log set to Log Everything (Computer and User/Group options) Every denied access or every executable file access event is logged. Macro and Script protection set to Deny All Marco and Script log set to Log Everything Relaxed Logon set to No relax logon The volume of logged events produced by this CPA Software Execution Control characteristic can overwhelm your database in very large deployments. You can, with the approval of your company s certification authority, change this logging option to the less detailed Log Access Denied. You will remain CPA compliant and reduce the logged events to only those applications which are blocked. Be aware you are no longer capturing the allowed application executions. (User/Group options) All VBScripts, JScript, or macros not centrally authorized are prevented from running. (User/Group options) A log entry is created for every macro and script execution access event. (User/Group options) Blocks without delay the running of unauthorized logon scripts. 14

15 CPA Compliance Statuses CPA Compliance Statuses Your CPA compliance status will always be visible at the top of the CPA Compliance Mode Configuration window, as well as in the Management Console s Connection panel. CPA Compliance mode enabled All options required to achieve CPA compliance are set for Computers and Users/Groups in your environment. Partial CPA Compliance mode enabled At least one option required to achieve CPA compliance is not set for Computers or Users/Groups in your environment. You will be in this mode when preparing to enable full compliance (for example, ensuring that settings do not disrupt the functioning of endpoints). CPA Compliance mode is disabled You are not enforcing CPA compliance requirements in your environment. In this option you are licensed for CPA Compliance Mode, but have chosen to not enforce the required settings. Using CPA Compliance Mode Learn about the tasks that can be performed and how they can enforce the CESG's Commercial Product Assurance (CPA) compliance for Application Control in your environment. 15

17 Enabling Full CPA Compliance Mode Enabling Full CPA Compliance Mode You can enforce full CPA Application Control setting requirements in your environment by just selecting the Enable CPA Compliance mode settings check box and clicking OK. CPA Compliance Mode will change settings throughout your environment, which can result in changes to endpoint behavior. 1. Select Tools > Configure CPA Compliance Mode. The CPA Compliance Mode window displays. 2. Select the Enable CPA Compliance mode settings check box. Ensure all the check boxes in the Computer and Users/Groups sections are selected. 3. Click Apply. A dialog displays asking if you are sure you want to enable CPA Compliance mode. 17

Chapter 8: Switching from Enabled to Disabled Mode 4. Click Yes. A dialog displays asking if you want to send the new options to clients immediately. 5.

18 Chapter 8: Switching from Enabled to Disabled Mode 4. Click Yes. A dialog displays asking if you want to send the new options to clients immediately. 5. Click Yesto send the options immediately (this can take several minutes to complete) or No to wait until the next client boot. 6. Click OK. Result CPA Compliance mode is enabled and your environment is compliant with CESG's requirements for Software Execution Control. What in the console indicates I'm in Compliance mode? The status in the CPA Compliance Mode Configuration window and Connection panel display that you are in compliance mode. 18

Enabling Full CPA Compliance Mode What options can I change in Tools > Default Options? You can change no options. If you attempt to, a message displays.

19 Enabling Full CPA Compliance Mode What options can I change in Tools > Default Options? You can change no options. If you attempt to, a message displays. With the approval of your company's certification authority you can change these options and remain CPA compliant: Client Hardening to Basic or Extended. Execution Log to Log Everything, Log Access Denied, or Log Denied and Unmanaged Execution. Macro and Script Log to Log Everything, Log access denied, or Log non whitelisted Execution. 19

20 Chapter 8: Switching from Enabled to Disabled Mode A warning message will display when you change these settings. Am I CPA compliant when in Compliance Mode? Yes, your environment fully meets CPA compliance requirements because all the required option settings are enforced. 20

21 Switching to Partial Compliance Mode Switching to Partial Compliance Mode Use this mode when preparing to enable full compliance or investigating if specific settings are disrupting the functioning of endpoints. 1. Select Tools > Configure CPA Compliance Mode. The CPA Compliance Mode window displays. 2. Clear one or more of the option settings. 3. Click Apply. A dialog displays asking if you are sure you want to enable Partial Compliance mode. 4. Click Yes. A dialog displays asking if you want to send the new options to clients immediately. 5. Click Yesto send the options immediately (this can take several minutes to complete ) or No to wait until the next client boot. Result Partial CPA Compliance mode is enabled and your environment is no longer compliant. 21

22 Chapter 9: Switching to Partial Compliance Mode What in the console indicates I'm in Partial compliance mode? The status in the CPA Compliance Mode Configuration window and Connection panel display that you are in partial compliance mode. What options can I change in Tools > Default Options? You can only change without restrictions those options you cleared in the window. If you attempt to change an enforced option, a message displays. With the approval of your company's certification authority you can also change these options: Client Hardening to Basic or Extended. Execution Log to Log Everything, Log Access Denied, or Log Denied and Unmanaged Execution. Macro and Script Log to Log Everything, Log access denied, or Log non whitelisted Execution. 22

23 Switching to Partial Compliance Mode A warning message will display when you change these settings. Am I CPA compliant when in Partial Compliance Mode? No, you do not meet the CPA compliance requirements because one or more required option settings are not enforced. 23

Disabling CPA Compliance Mode Disabling CPA Compliance Mode You can stop enforcing all CPA Application Control setting requirements in your environment by just

Clear the Enable CPA Compliance mode settings check box. All the checkboxes in the Computer and User/Group options sections will clear as well. 3. Click Apply.

25 Disabling CPA Compliance Mode Disabling CPA Compliance Mode You can stop enforcing all CPA Application Control setting requirements in your environment by just clearing the Enable CPA Compliance mode settings check box. 1. Select Tools > Configure CPA Compliance Mode. The CPA Compliance Mode window displays. 2. Clear the Enable CPA Compliance mode settings check box. All the checkboxes in the Computer and User/Group options sections will clear as well. 3. Click Apply. A dialog displays asking if you are sure you want to disable CPA Compliance mode. 4. Click Yes. A dialog displays asking if you want to send the new options to clients immediately. 25

Chapter 10: Switching from Enabled to Disabled Mode 5. Click Yesto send the options immediately (this can take several minutes to complete ) or No to wait until the next client boot.

26 Chapter 10: Switching from Enabled to Disabled Mode 5. Click Yesto send the options immediately (this can take several minutes to complete ) or No to wait until the next client boot. Result CPA Compliance mode is disabled and your environment is no longer compliant. What in the console indicates I'm in Disabled mode? The status in the CPA Compliance Mode Configuration window and Connection panel display that you are in disabled mode. What options can I change in Tools > Default Options? You can change any options without restrictions as no enforcement is taking place. 26

27 Disabling CPA Compliance Mode Am I CPA compliant when Compliance Mode is disabled? No, you do not meet the CPA compliance requirements because no required option settings are enforced. 27

ForeScout CounterACT. Ensure Instant Messaging and Peer to Peer Compliance. How-to Guide. Version 8.0

ForeScout CounterACT. Ensure Instant Messaging and Peer to Peer Compliance. How-to Guide. Version 8.0 ForeScout CounterACT Ensure Instant Messaging and Peer to Peer Compliance How-to Guide Version 8.0 Table of Contents About Ensuring Instant Messaging and Peer to Peer Compliance... 3 Prerequisites... 3