Use these guidelines to configure Application Control in your enterprise for optimal protection.
Feature | Description |
|---|---|
Memory protection | Memory protection features (CASP, VASR, NX) of Application Control protect against exploits that cause buffer overflow. Enable all memory protection features and consult with Trellix support team to evaluate the risk for any exception or bypass. For information about disabling memory protection for Trellix ENS, see KB81465 and KB89678. |
Script authorization | A default script interpreter list comes with the product to allow list script execution. Update the list based on the scripts and interpreters used or allowed in your organization. Script interpreters, such as PowerShell, Perl, PHP, and Java, and their supported extensions must be evaluated. Adding scripting languages can change the security posture of a system. Several factors must be considered before making decisions, such as:
Periodically review the list of allowed script interpreters to keep up with the changing security needs and circumstances. If any of the script interpreters are present but not in use, remove them from the allow list and prevent them from executing. The needed commands can be issued from the ePO - On-prem console using the SC: Run Commands Client Task. |
Trusted update mechanisms | Application Control includes several methods to make sure proper functioning and updating of applications. We also provide a default list of trusted executables. We recommend you carefully update or change this list. |
Alerts and notifications | Constant monitoring is a part of protecting your systems. Application Control sends events to the ePO - On-prem console when it prevents an unwanted operation. We recommend configuring the needed alerts and email notifications to inform the user about these activities. |