How to Block Flash embedded Excel files

SysTech wrote:

By using SEC i have blocked all games from being played on our workers computers, yet now they have started sharing out excel files with games embedded in them

Excuse me for being blunt - I deduce, perhaps incorrectly - from your posts that your company doesn't have a security problem in the first place. And as romantic I hope that this artificial person called Sophos doesn't strive for fitting the bill in this case.

Seriously:

Playing cat and mouse with your "workers" is getting you nowhere. IT (and technology in general) is not for putting spurs to them. And if my company would ask something like this from me, I'd not only consider quitting..: "Motivation problems" have to be solved by other means.

Again - excuse the rant. Just my two (Euro-)cents.

Christian

We have had (in the past) various people plugging in usb sticks, downloading programs which are obvious (to system admins) viruses and have put a number of computers out of commision. 

Hence why we want to use Sophos, now not only does Sophos do that they also have device and application control, which is a bonus. This is good as people here are on the phones to customers and paid to work not to play games. I agreee IT is not for putting spurs on people but it is here to try new software and find out ways to increase productivity if possible.

You could also just disable ActiveX controls in Microsoft Office this will prevent the games running.

I belive this can be done via a group policy.

They require ActiveX to use parts of websites for online forms etc, we did consider that but would majory effect the stuff they need access to

Agreed - application control was very tempting when I first saw it. But I think it can help only so far: once people find out that they are restrained they'll search for ways to bypass these restraints - unless there are other more "terrible" consequences looming. Else it's just a meta-game. If people want to fritter away company time they'll always find themselves some means.

Using application control since it's available we are still running it in detect-only mode. The major reason is that it is still all-or-nothing. You can detect applications and allow some but block the others. It's on my wish-list for quite some time (I've already commented on it during on of the betas): it should be possible to apply the detect_only/block decision on a per-application (or application group) basis. Thus an application should have three possible states: authorized/detected/blocked.

If this were available we'd certainly block a number of applications. Reports show that misuse (or abuse) is a lot less than expected. The majority of  "violations" are "alternate software" (with user-mode and portable versions blooming the number has vastly increased). Sometimes we decide to include this software, sometimes we try to educate the user and for the rest we keep an eye on it. Forthright abuse results in a warning and has in case of recurrence dire consequences.

Oh, and - sure, I'd recommend Sophos :smileywink:

Christian

The ability to block some applications and monitor others is currently the number 3 priority for application control enhancements (after custom application control and user based policies) so it is something we're looking to deliver in a future release.

Regarding the detection of Flash games embedded in Excel spreadsheet there is some positive news. The labs plan to roll out a new application identity in the 4.51 data set (subject to change) which will detect all flash embedded games from "gamesexcel.com". If there are other sources of these games then we can extend the identity to include them so let me know via the appcontrol@sophos.com email address. Not the perfect soluton but a start.

Best regards,

John

Why do you want to block?

I made some nice applications this way. For example :

The Drums Instrument

For View Template

Three Instruments (the piano,the drums, the guitar)

Download Link