Authorize Blocked Applications When Needed

Although you've created the various Trusted Change policies and you've monitored the logs prior to going into Easy Lockdown, there may still be situations where applications are blocked and you need to authorize them. Examples of these situations include:

• Infrequently updated applications

  Some applications update very infrequently and may have been missed because the monitoring period was not long enough for you to see an update occurrence. The updated application is now blocked and you'll need to authorize it using a Supplemental Easy Lockdown/Auditor policy. You'll also need to apply a Trusted Updater policy (or other Trust policy) to handle future updates of this application.

• Applications that are required to view a file

  A user may receive a file from a customer, such as a video clip, that requires a specific application or plugin in order to view it. Since you are controlling which applications your users can execute, this needed application may be blocked. You should implement a process for users to request approval for new applications.

  • For simple applications, you can authorize the blocked files directly from the logs. See Authorizing, Denying, and Trusting Files from Logs in the Application Control Help for detailed steps.

  • For complex applications that use an application installer, add the installer as a Trusted Updater from the logs so that any associated files are whitelisted once they're installed.

• Unusual/unsupported application update patterns

  Application Control is designed to minimize your administrative workload by providing mechanisms such as Trusted Updater to add applications to the endpoint whitelist automatically, without any action from you.

  However, as detailed earlier, there is no standard method by which applications are updated, and vendors may issue different update mechanisms for major and minor releases. Applications that update in an unusual manner may be blocked and you'll need to authorize them separately. You may want to consider disabling automatic updates in these applications, where possible, to avoid such occurrences. You can then deploy approved updates to your endpoints using your normal software update tools.