Internet Security Application Control

Transcription

1 Internet Security 2012 Application Control

2 Table of Contents Application Control... 2 What is Application Control... 2 Operational algorithm of Application Control... 2 Enabling/disabling Application Control... 2 Loading rules from Kaspersky Security Network (KSN)... 3 Placing applications into groups... 4 Viewing applications activity... 7 Modifying a trust group for an application... 8 Application control rules Identity protection

3 Application Control What is Application Control KIS 2012 prevents applications from performing actions that may be dangerous for the system, and ensures control of access to operating system resources and your identity data with the help of the following tools: Application Control. The component tracks actions in the system performed by applications installed on the computer, and regulates them based on the rules of Application Control. These rules regulate potentially dangerous activity, including applications' access to protected resources. Protection of identity data and operating system resources. Application control monitors the rights of applications to perform actions with user s identity data. Identity data include files, folders and registry keys, containing operational settings and important data of the most frequently used applications, as well as the user files (the My Documents folder, cookies files, data about the user activity). Operational algorithm of Application Control At the first startup of an application on the computer, the Application Control component verifies its safety and includes it into one of the trust groups. The trust group defines the rules that Kaspersky Internet Security should apply to control the activity of this application. Rules of Application Control is a set of rights of access to the computer resources and restrictions posed on various actions being performed by applications on the computer. When calculating the threat rating Application Control can also use the Kaspersky Security Network (KSN) database. The data received witht the help of KSN allow more accurately to define an application to this or that trusted group and apply optimal application control rules. Application Control has been revamped in KIS 2012: the application now checks the reputation of not only executable files but also application components (for example, dynamic libraries DLL files). When the application is restarted, Application Control checks its integrity. If the application has not been changed, the component applies the current rule to it. If the application has been modified, Application Control re-scans it as at the first startup. Enabling/disabling Application Control By default, Application Control is enabled, functioning in the mode developed by Kaspersky Lab specialists. However, you can disable it, if required. To enable or disable Application Control, perform the following actions: 1. Open the main application window. 2. In the top right corner of the window click the Settings link. 3. In the left part of the window under Protection Center select the Application Control component. 4. In the right part of the window perform the following actions: If you need to disable the component, uncheck the Enable Application Control box. If you need to enable the component, check the Enable Application Control box. 2 24

4 5. In the Settings window click the Apply button. Loading rules from Kaspersky Security Network (KSN) By default, for the applications found in the Kaspersky Security Network database the component applies rules loaded from the KSN database. To make sure that loading of rules from Kaspersky Security Network is enabled, perform the following actions: 1. Open the Settings window. 2. In the left part of the window under Protection Center select the Application Control component. 3. In the right part of the Applications restriction section make sure the Load rules for applications from Kaspersky Security Network (KSN) box is checked. If at the first application launch the application s entry was not added to the Kaspersky Security Network database but the entry was added later, Kaspersky Internet Security 2012 will automatically update the application control rules. You can see if update of Kaspersky Security Network rules for previously unknown applications is also enabled in the right part of the window in the Applications restriction section the Update rules for previously unknown applications from KSN box should be checked. 3 24

5 Placing applications into groups At the first startup of an application on the computer, the Application Control component verifies its safety and searches the internal database of known applications for a matching entry, and then sends a request to the Kaspersky Security Network database or having a digital signature 1. After search Application Control places the application into one of the following trusted groups: Trusted. Applications with digital signatures of trusted vendors and applications signatures of those are included to the trusted applications database. Applications of that group are allowed to perform any network activity. Activities of such applications are monitored by Proactive Defense and File Anti-Virus. Low Restricted. Applications are without digital signatures of trusted vendors and are not included to the trusted applications database. Nevertheless, the low risk rating 2 is assigned to such applications. Applications of that group are allowed to perform some operations, to manage the system, hidden access to the network. Most operations require user authorization. High Restricted. Applications without digital signatures and which are not included to the trusted applications database. The high risk rating is assigned to such applications. Applications of this group require user authorization for most activities in the system; some actions, however, are restricted for these applications. Untrusted. Applications without digital signatures and which are not included to the trusted applications database. Very high risk rating is assigned to such applications. Application Control blocks any activity of such applications. Applications with the digital signature of trusted vendors and applications whose records are added to the database of trusted applications are automatically included into the Trusted group. 1 Digital signature is an electronic security mark which carries the information about the software vendor and shows if the software was changed after the signing (i.e. after release). If software is signed by its vendor and the signature authenticity is verified by the certificate center, then you can be sure that the software is authentic and was not modified. 2 Risk rating is an indicator of the application danger for the system. The risk rating is calculated based on definite criteria. 4 24

6 To disable the automatic inclusion of applications into the Trusted group, perform the following actions: 1. In the right part of the settings window of the Application Control component in the Applications restriction section, uncheck the Trust applications with digital signature box. 2. In the Settings window click the Apply button. If an application record is not included into Kaspersky Security Network database and the application does not have a digital signature, then KIS 2012 uses the heuristic analysis 3. The analysis helps defining the threat rating of the application based on which it is included into a group. To use the heuristic analysis for distributing unknown applications by groups, perform the following actions: 1. In the Applications restriction section select the Use the heuristic analysis to define group 4 option. 2. In the Settings window click the Apply button. 3 Heuristic analysis is analysis of objects activity in the system. If the activity is typical of malicious objects in this case the object under analysis will be defined as suspicious or malicious. Analysis of the object activity allows to detect a virus even if it has not been defined by virus analysts. 4 By default, the heuristic analysis is enabled. 5 24

7 Instead of using the heuristic analysis, you can specify a group into which KIS 2012 should automatically include all unknown applications. For this, perform the following actions: 1. In the Applications restriction section select the Move to the following group automatically option and in the drop-down menu select the necessary group: Low Restricted High Restricted Untrusted 2. In the Settings window click the Apply button. 6 24

8 By default, Application Control analyzes an application for 30 seconds. If this time interval turns out to be insufficient for defining the threat rating, the application is included into the Low restricted group, while defining the threat rating continues in background mode. After that, the application is finally included into another group. If you are sure that all applications started on your computer do not pose any threat to its security, you can decrease the time spent on analysis. If, on the contrary, you are installing the software and are not sure that this is safe, you are advised to increase the time for analysis. To change the time allowed for calculation of the application group, perform the following actions: 1. In the right part of the settings window of the Application Control component in the Applications restriction section edit the value of the Maximum time to define the application group setting. 2. In the Settings window click the Apply button. Viewing applications activity You can view information about all applications being used on your computer and all processes being currently run. To view the applications activity, perform the following actions: 1. Open the main application window. 2. Select Applications Activity. 7 24

9 3. In the opened window in the top left corner in the drop-down menu select the necessary category of applications. Modifying a trust group for an application In the Application Control window, the Group column shows the group to which an application belongs. If necessary, you can move the application to another group manually. Kaspersky Lab specialists recommend that you avoid moving applications from default groups. To move an application to another group, perform the following actions: 1. In the Applications Activity window select the necessary category of applications (All or Running). 2. If necessary, set the filter: click the Filter or View button and choose the required selecting criterion. 8 24

10 3. Left-click the status of the required application and from the context menu select the group where you want to move the application: Trusted, Low Restricted, High Restricted or Untrusted. Wait till the status icon changes. 4. In the Applications Activity window click the Close button. To move the application to the default group, perform the following actions: 1. In the Applications Activity window select the necessary category of applications (All or Running) from the Category list. 2. Left-click the status of the required application and in the context menu select Restore default group. 3. In the Applications Activity window click the Close button. 9 24

11 Application control rules Rules of Application Control is a set of rights of access to the computer resources and restrictions posed on various actions being performed by applications on the computer. By default, an application is controlled according to the rules of the trust group into which KIS 2012 included the application when it was run for the first time. A rule is a set of Application Control reactions over application s activity upon access to controlled resources. The following component reactions are possible: Inherit. Application or group inherits the reaction from the parent group. This is a default reaction. Allow. Application is allowed to perform an action with the resource. Deny. Application is not allowed to perform an action with the resource. Prompt for action. Application Control prompts the user for granting access to the resource for an application. Log events. In addition to the specified reaction, Application Control records in the report information about the application's attempts to access the resource. Adding information to a report can be used in combination with any other action of the component. Editing the group rule By default, optimal access rights to computer resources are set for different trust groups in KIS However you can edit preset rules for each group of application. To change the preset group rule, do the following: 1. Open the Settings window. 2. In the left part of the window under Protection Center select the Application Control component. 3. In the right part of the window click the Applications button

12 4. In the Applications window select the necessary group from the list and click the Edit button in the top part of the window. 5. In the Group rules window go to the tab which corresponds the necessary category of resources (Files and System registry, Rights)

13 6. Select the required resource and right-click the corresponding action, in the context menu of an action set the necessary value (Allow, Block or Prompt for action). 7. Click the OK button, to save the changes

14 Editing rules for an individual application Application Control logs actions performed by each application in the system, and manages its activity based on the group it belongs to. When an application accesses a resource, the component checks if an application has the required access rights, and performs the action determined by the rule. To edit rules for an individual application, perform the following actions: 1. Open the Settings window. 2. In the left part of the window under Protection Center select the Application Control component. 3. In the right part of the window click the Applications button. 4. In the Applications window select the necessary group from the list and click the Edit button in the top part of the window

15 5. In the Group rules window go to the tab which corresponds the necessary category of resources (Files and System registry, Rights). 6. Select the required resource and right-click the corresponding action, in the context menu of an action set the necessary value (Allow, Block or Prompt for action). 7. Click the OK button, to save the changes

16 You can disable application of group rules to control access to selected categories of protected resources. Application access to such resources will be regulated by the application rules. To disable inheritance of group rules to access resources, perform the following actions: 1. Open the application settings window. 2. In the left part of the window under Protection Center select the Application Control component. 3. In the right part of the window click the Applications button. 4. In the Applications window select the necessary group from the list and click the Edit button in the top part of the window. 5. In the Group rules window go to the tab which corresponds the necessary category of resources (Files and System registry, Rights). 6. Select the required resource and right-click the corresponding action, in the context menu of an action select the Inherit item. 7. Click the OK button, to save the changes. Application rules have a higher priority than group rules. For example, if an application rule allows the Internet access, and in the rules of the group, into which the application is included, the Internet access is denied, in this case the application will get access to the system resources. Setting exclusions You can also exclude some actions form the application rules. KIS 2012 will not control actions added to the application exclusions. To add exclusion to the application rule, perform the following actions: 15 24

17 1. Open the Settings window. 2. In the left part of the window under Protection Center select the Application Control component. 3. In the right part of the window click the Applications button. 4. In the Applications window select the application from the list and click the Edit button in the top part of the window. 5. In the Application rules window go to the Exclusions tab. 6. Check the actions which should not be controlled. 7. Click the OK button, to save the changes. When excluding network traffic of the application you can configure additional exclusion settings, such as remote IP addresses or network ports. Inheriting restrictions of the parent process Application startup may be initiated either by the user or by another application running. If the startup is initiated by another application, it creates a startup procedure including parent and child applications. A parent application is an application which initiated startup of another application. A child application is an application whose startup was initiated by another application. When an application attempts to obtain access to a protected resource, Application Control analyzes the rights of all parent processes of this application, and compares them to the rights required to access this resource

18 Access right priority: Allow. An application or group is allowed to perform an action with the resource. Access right data has the highest priority. Prompt for action. Block. An application or group is blocked from performing any actions with the resource. Access right data has the lowest priority. You should modify the rights of a parent process only if you are absolutely certain that the process' activities do not threaten the security of the system. To disable inheritance of restrictions from the parent process, perform the following steps: 1. Open the application settings window. 2. In the left part of the window, in the Protection Center section, select the Application Control component. 3. In the right part of the window, click the Applications button. 4. In the Applications window, select the required application from the list. 5. Click the Edit button

19 6. In the Application rules window go to the Exclusions tab. 7. Check the Do not inherit restrictions from the parent process (application) box. Modifying the storage time for rules By default, the rules for applications which have not been started for the 60 days are deleted automatically

20 You can modify the storage time for rules for unused applications, or disable rules' automatic removal. To set the storage tie for rules, perform the following actions: 1. Open the Settings window. 2. In the left part of the window under Protection Center select the Application Control component. 3. In the right part of the window in the Additional section check the Delete rules for applications remaining inactive for more than box and enter the number of days. 4. In the Settings window click the Apply button. To disable automatic deletion of rules for unused applications, in the right part of the Settings window in the Additional section, uncheck the Delete rules for applications remaining inactive for more than box. Identity protection Application Control manages the applications' rights to take actions on various resource categories. Two categories of resources were distinguished in KIs 2012: the operating system and identity data. The Operating system category includes the following system resources: registry keys with autorun parameters; registry keys with parameters of work on the Internet; registry keys which influence system security; system files and folders; autorun folders. Registry is a hierarchical settings database in most Microsoft Windows operating systems

21 The Identity data category includes the following resources: user s files (the folder My Documents, files cookies, data about user s activity); files, folders and registry keys which contain working parameters and important data of the most frequently used applications: Internet-browser, file managers, mail clients, Internetpagers and electronic purses. Cookies files are files saved on the user s computer. These files store personal data of the user (for example, password and login) used during the visit of various sites or when returning to the site after some time. Each site has its own cookie file. You cannot delete this list. However, you can disable their protection by unchecking a box next to a category. You can also expand this list by adding user categories and / or individual resources. To expand the list of system resources for the Operating system category, perform the following actions: 1. Open the Settings window. 2. In the left part of the window in the Protection Center section select the Application Control component. 3. In the right part of the window click the Identity protection button. 4. In the Digital identity protection window on the Operating system tab from the dropdown list in the Category section, select a category

22 5. In the top left part of the window click the Add link to add an additional resource to the selected category. Select the resource type (File or folder or Registry key). 6. In the User resource window click the Browse button. 7. In the Select file or folder window select a resource and click the OK button. 8. In the User resource window click the OK button. 9. The added resource will be displayed in the Digital identity protection window. After you add a resource, you can edit or remove it using the respective buttons in the top part of the tab. To disable the control of a resource or category, uncheck the box next to it

23 10. In the Digital identity protection window click the OK button. 11. In the Settings window click the Apply button. To expand the list of system resources for the Identity Data category, perform the following actions: 1. Open the Settings window. 2. In the left part of the window in the Protection Center section select the Application Control component. 3. In the right part of the window click the Identity protection button

24 4. In the Digital identity protection window on the Identity data tab select a category from the drop-down menu in the Category section. 5. In the top left part of the window click the Add category button to add a new category of resources. 6. In the Identity data category window enter the name of a new group and click the OK button. 7. In the Digital identity protection window click the Add button to add an additional resource to the selected or added category

25 8. In the User resource window click the Browse button. 9. In the Select file or folder window select a resource and click the OK button. 10. In the User resource window click the OK button. 11. A newly added resource will be displayed in the Digital Identity Protection window. After you add a resource, you can edit or remove it using the respective buttons in the top part of the tab. To disable the control of a resource or category, uncheck the box next to it. 12. In the Digital identity protection window click the OK button. 13. In the Settings window click the OK button