Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 15 replies
  • Subscribers 1 subscriber
  • Views 5165 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Application control - poor decisions

MawfTech

Well I've not been back here for a while but it's time for another post and this time I'd like feedback from you guys about a decision Sophos has made regarding app control.

We use app control extensively and I block most things not related to our business by default (games, peer to peer etc). One noteable change recently was for Sophos to now add a Firefox V7 and higher policy option. Now while I fully understand the reason for this because of the mindless version updates vomiting out of the Mozilla labs at the moment, I don't understand why they don't pick off the major version numbers and especially, the ability to block beta versions. I've about 20% of users at  my organization that use Firefox and of those, about a third watch the firefox website like hawks always wanting the latest, greatest version even if it's not tested and released. Previously, by allowing specific versions and blocking everything else, I had the ability to lock down to only released versions and I also had the ability to lockout old defunct versions that were either to vulnerable or really not fit for purpose (v7 immediately springs to mind!). Now, my users are freely downloading v9 beta, installing it, using it and I have absolutely no control over that with Sophos because they've adopted a v7+ identity only. How bad is that!

I'd like to get some feedback on whether you feel this is the right approach or not. As administrators, we know that the FF version change every 30 days is a big problem and I know there will be a few people out there that don't really care that users can get to higher versions even untested betas and alphas but I and many others do. How does the community feel about this approach?

 Should we at the very least still continue to get individual version control? Should we have the v7+ AND the individual version control?

Matt

:19333


This thread was automatically locked due to age.
Parents
  • 0

    Hello Matt,

    Firstly, can I confirm that you have applied the FF V7+ identity and set it to block, yet your users can still run the V9 beta? If that is the case, then Sophos Labs can rapidly update the identity to cover this. The quickest thing to do is to send a sample.

    With regard to your question - "Should we have the v7+ AND the individual version control?" I agree that there would be value in this and that you could either select all versions above version 7 or select individual versions. Unfortunately, this is not technically possible with the current implementation of Application Control.

    The way that Application Control works is that an identity will be triggered whether an action is assigned to it or not. So, for example, FireFox 8 runs, it is scanned against the V7+ identity and it returns that the identity is triggered. At this point, no more identities will be scanned. This means that if there was a Firefox 8 only identity, it would not be triggered. If you have V7+ set to allow and V8 set to block, you would not see the correct behaviour. For this reason, we can only have one identity which encompasses all options. Hopefully that makes sense. It's something that could be improved upon in a later release.

    Thanks,

    Dan Kirtley

    Product Manager, Application Control

    :19421
Reply
  • 0

    Hello Matt,

    Firstly, can I confirm that you have applied the FF V7+ identity and set it to block, yet your users can still run the V9 beta? If that is the case, then Sophos Labs can rapidly update the identity to cover this. The quickest thing to do is to send a sample.

    With regard to your question - "Should we have the v7+ AND the individual version control?" I agree that there would be value in this and that you could either select all versions above version 7 or select individual versions. Unfortunately, this is not technically possible with the current implementation of Application Control.

    The way that Application Control works is that an identity will be triggered whether an action is assigned to it or not. So, for example, FireFox 8 runs, it is scanned against the V7+ identity and it returns that the identity is triggered. At this point, no more identities will be scanned. This means that if there was a Firefox 8 only identity, it would not be triggered. If you have V7+ set to allow and V8 set to block, you would not see the correct behaviour. For this reason, we can only have one identity which encompasses all options. Hopefully that makes sense. It's something that could be improved upon in a later release.

    Thanks,

    Dan Kirtley

    Product Manager, Application Control

    :19421
Children
No Data