help
7.3 Application control policy
Enterprise Console enables you to detect and block "controlled applications", that is, legitimate applications that are not a security threat, but that you decide are unsuitable for use in your office environment. Such applications may include instant messaging (IM) clients, Voice over Internet
Protocol (VoIP) clients, digital imaging software, media players, or browser plug-ins.
Note: This option applies only to Sophos Endpoint Security and Control for Windows.
Applications can be blocked or authorized for different groups of computers with complete flexibility.
For example, VoIP can be switched off for office-based desktop computers, yet authorized for remote computers.
The list of controlled applications is supplied by Sophos and updated regularly. You cannot add new applications to the list, but you can submit a request to Sophos to include a new legitimate application you would like to control on your network.
For details, see knowledgebase article 63656 .
This section describes how to select the applications you want to control on your network and set up scanning for controlled applications.
Note: If you use role-based administration:
■
■
You must have the Policy setting - application control right to configure an application control policy.
You cannot edit a policy if it is applied outside your active sub-estate.
For more information about role-based administration, see Managing roles and sub-estates (page
19).
Application control events
When an application control event occurs, for example, a controlled application has been detected on the network, the event is written in the application control event log that can be viewed from
Enterprise Console. For details, see View application control events (page 185).
The number of computers with events over a specified threshold within the last seven days is displayed on the Dashboard.
You can also set up alerts to be sent to your chosen recipients when an application control event has occurred. For details, see
Set up application control alerts and messages
(page 179).
7.3.1 Select the applications you want to control
If you use role-based administration:
■
You must have the Policy setting - application control right to configure an application control policy.
■
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
141
Sophos Enterprise Console
By default, all applications are allowed. You can select the applications you want to control as follows:
1. Check which application control policy is used by the group(s) of computers you want to configure.
See
Check which policies a group uses
(page 32).
2. In the Policies pane, double-click Application control. Then double-click the policy you want to change.
3. In the Application control policy dialog box, click the Authorization tab.
4. Select an Application type, for example, File sharing.
A full list of the applications included in that group is displayed in the Authorized list below.
■
To block an application, select it and move it to the Blocked list by clicking the “Add” button.
■
To block any new applications that Sophos adds to that type in the future, move All added
by Sophos in the future to the Blocked list.
■
To block all applications of that type, move all applications from the Authorized list to the
Blocked list by clicking the “Add all” button.
5. On the Scanning tab of the Application control policy dialog box, make sure that scanning for controlled applications is enabled. (See
Scan for applications you want to control
(page
142) for details.) Click OK.
7.3.2 Scan for applications you want to control
If you use role-based administration:
■
You must have the Policy setting - application control right to configure an application control policy.
■
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
You can configure Sophos Endpoint Security and Control to scan for applications you want to control on your network on access.
1. Check which application control policy is used by the group(s) of computers you want to configure.
See
Check which policies a group uses
(page 32).
2. In the Policies pane, double-click Application control. Then double-click the policy you want to change.
The Application control policy dialog box is displayed.
142
