SafenSoft: proactive protection against malware and insider threats

2. Switch to Common rules tab in the Application control policy window. Select the File system protection scope from the drop-down list.

3. Select a file system object in the tree and

•        Check the Read checkbox in order to protect the file from reading by applications. This will automatically block changing and deletion of the file.

•        Check the Write checkbox to protect the file object from creation and altering by applications.

•        Check the Delete checkbox to protect the file object from being deleted.

4. Right click in the Use for column to change the group of applications which will be affected by the activity control rule:

•        All – the rule will be applied to all applications

•        Trusted – the rule will be applied to known/trusted applications, which are present in the system profile

•        Restricted - the rule will be applied to potentially dangerous – restricted or unknown applications, which are not present in the system profile

5. Right click in the Use for column and choose Additional item.

6. Change following settings in the Additional window:

7. Click on OK button in the Additional window to save changes

8. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the System registry protection scope from the drop-down list.

3. Select a file system object in the tree and
 

4. Right click in the Use for column to change the group of applications which will be affected by the activity control rule:

5. Right click in the Use for column and choose Additional item.

6. Change following settings in the Additional window:

7. Click on OK button in the Additional window to save changes

8. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Network protection scope from the drop-down list.

3. Click the Add button.
 

4. Enter a name of the network rule into the Name field.
 

5. Specify the direction of data transfer from the Direction drop-down list. The default value is Inbound/Outbound.

6. Specify the network protocol from the Protocol drop-down list. The default value is TCP/UDP.

7. Define the Local IP address or an address range in the appropriate fields. The default value is Any address.

8. Define the Remote IP address or an address range in the appropriate fields. The default value is Any address.

9. Click on the OK button to save the rule.

10. Change following settings in the Additional window:

11. Click on OK button in the Additional windows to save changes

12. In the list of network rules uncheck the Allow checkbox next to the rule created to block connection to the specified network resource.

13. In the list of network rules check the Confirm checkbox to be prompted each time SafenSoft SysWatch is going to restrict application’s network activity.

14. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Network protection scope from the drop-down list.

3. Select an appropriate network rule from the list.

4. Click the Edit button.

5. Change the rule and click on the OK button to save changes.

6. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Network protection scope from the drop-down list.

3. Select an appropriate network rule from the list.

4. Click the Delete button.

5. Click on the OK button to confirm deletion.
 

6. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Network protection scope from the drop-down list.

3. Select the Any network activity network rule from the list and uncheck the Allow checkbox next to it.

4. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Devices protection scope from the drop-down list.

3. Select the USB Devices from the list and uncheck the
 

4. Click on Additional link.

5. Change following settings in the Additional window:

6. Click on OK button in the Additional window to save changes

7. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

2. Switch to Common rules tab in the Application control policy window. Select the Devices protection scope from the drop-down list.

3. Check Disable autorun for all devices.

4. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

2. Switch to Common rules tab in the Application control policy window. Select the Devices protection scope from the drop-down list.

3. Select the CD/DVD Devices from the list and uncheck the Read, Write, Delete checkboxes.

4. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Devices protection scope from the drop-down list.

3. Select the LPT Ports from the list and uncheck the Read, Write, Delete checkboxes.

4. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Devices protection scope from the drop-down list.

3. Select the COM Ports from the list and uncheck the Read, Write, Delete checkboxes.

4. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the File System or System Registry protection scope from the drop-down list.

3. Uncheck the Show objects without access restrictions checkbox.

4. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

1. Choose Activity policy item in the context menu.
 

2. Switch to Common rules tab in the Application control policy window. Select the Interprocess Interaction protection scope from the drop-down list.

3. Check Clipboard access checkbox

4. Click on the Additional link.

5. Change following settings in the Additional window:

6. Click on OK button in the Additional window to save changes

7. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.

2. Switch to Common rules tab in the Application control policy window. Select the Interprocess Interaction protection scope from the drop-down list.

3. Select a privilege in the list and uncheck the checkbox at the State column.

4. Click on  Additional link.

5. Change following settings in the Additional window:

6. Click on OK button in the Additional window to save changes

7. Click on OK or Apply button in the Common rules tab to save new rule and to update Application control policy.