McAfee UTILITIES 4.0 Uživatelská příručka stáhnout pdf (Strana 69)

Configuring Application Blocking Policies

The Application Blocking feature of Host Intrusion Prevention manages a set of applications

that you allow to run (known as application creation) or bind (known as application hooking)

with other applications.

Contents

Overview of Application Blocking policies

Working with Application Blocking policies

Working with Application Blocking Rules policies

Overview of Application Blocking policies

The Application Blocking feature monitors applications being used and allows or blocks them.

Host Intrusion Prevention offers two types of application blocking:

• Application creation

• Application hooking

When Host Intrusion Prevention monitors application

creation

, it looks for programs that are

trying to run. In most cases, there is no problem; but some viruses, for example, try to run

programs that harm a system. You can prevent this by creating application rules, similar to

firewall rules, which only allow programs to run that are permitted.

When Host Intrusion Prevention monitors application

hooking

, it looks for programs that are

trying to bind or “hook” themselves to other applications. Sometimes this behavior is harmless,

but sometimes this is suspicious behavior that can indicate a virus or other attack on your

system.

You can configure Host Intrusion Prevention to monitor only application creation, only application

hooking, or both.

With Application Blocking, create a list of application rules, one rule for each application you

want to allow or block. Each time Host Intrusion Prevention detects an application trying to

start or hook to another application, it checks its application rule list to determine whether to

allow or block the application.

Application Blocking client rules

Clients in adaptive or learn mode can create client rules to allow blocked application creation

or hooking. You can view these rules in a filtered or aggregated view to analyze them to create

create new policies or add them to existing policies.

69McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 64 65 66 67 68 69 70 71 72 73 74 ... 111 112

Žádné komentáře

McAfee UTILITIES 4.0 Uživatelská příručka Strana 69