Endpoint Protection

I would continue from the point where we left with knowing what FILE FINGERPRINT in SEP is and how to generate a FILE FINGERPRINT using the checksum.exe, how to edit, append or merge a FILE FINGERPRINT.

Now lets look at how to configure a SYSTEM LOCKDOWN which is a protection setting that you can use to control the applications that can run on the client computer

Previous Articles:

What is "FILE FINGERPRINT LIST" in Symantec Endpoint Protection (SEP)?
https://www-secure.symantec.com/connect/articles/what-file-fingerprint-list-symantec-endpoint-protection-sep

Is it possible to EDIT, APPEND or MERGE a FILE FINGERPRINT in Symantec Endpoint PRotection Manager (SEPM) ?
https://www-secure.symantec.com/connect/articles/it-possible-edit-append-or-merge-file-fingerprint-symantec-endpoint-protection-manager-sepm


 

What is SYSTEM LOCKDOWN ? What Stages do I Implement SYSTEM LOCKDOWN in in Symantec Endpoint Protection (SEP) ?

System lockdown is a protection setting that you can use to control the applications that can run on the client computer. You can create a file fingerprint list that contains the checksums and the locations of all the applications that are authorized for use at your company. The client software includes a Checksum.exe tool that you can use to create a file fingerprint list. The advantage of system lockdown is that it can be enforced whether or not the user is connected to the network. You can use system lockdown to block almost any Trojan horse, spyware, or malware that tries to run or load itself into an existing application. For example, you can prevent these files from loading into Internet Explorer. System lockdown ensures that your system stays in a known and trusted state.

Applications that run on the client computer can include the following executable
files:

1. .exe
2. .com
3. .dll
4. .ocx

Stages for Implementing SYSTEM LOCKDOWN in Symantec Endpoint Protection (SEP):

1. Create a software image that includes all of the applications you want users to be able to use on their computers. Use this image to create a file fingerprint list.
2. Get an approved software image
3. Enable system lockdown by logging the applications that are not included in the file fingerprint list. You can then adjust your file fingerprint to include the required applications of users. You can give them appropriate warning before blocking unapproved applications.
4. Log unapproved applications Add the executables that you want to be allowed even if they are not in the file fingerprint list.
5. Add allowed applications
6. Enforce system lockdown and block unapproved applications.
7. Enable system lockdown
8. You have the option to define a custom message to display to users who have blocked applications.
9. The following prerequisites must be met before you can enable system lockdown:
10. You need to have created a file fingerprint list that includes the applications that are allowed. This list can be created from a corporate image that is installed regularly on users’ computers. You create this list on a computer that runs the client.
11. Create file fingerprint list
12. After you create the fingerprint lists, you need to add them to the manager.
13. Add one or more file fingerprint lists Multiple file fingerprint lists can be merged.  For Example: You may use different images for different groups at your company.
14. Merge file fingerprint lists
15. You implement system lockdown in the following stages:
16. Before you block unapproved executables, you can add one or more file fingerprint lists. Add the applications that should always be allowed, and log the results in the Control log.
17. Set up and test system lockdown
18. After a few days of testing system lockdown, you can view the list of unapproved applications. This list shows the unapproved applications that users in the group run. You can decide whether to add more applications to the file fingerprint or to the allowed list.
19. Check the unapproved applications list Next, you can enable system lockdown blocking the applications that are not included in the file fingerprint lists.

Thanks :-)