Does SEP 12.1 have special abilities with respect to managing Java threats?
Created: 30 Jan 2013 | Updated: 30 Jan 2013 | 7 comments
Yesterday John Strand and Paul of Pauldotcom put on a great webinar with respect to the current concerns (and hyseteria) over Java vulnerabilities:
https://www.sans.org/webcasts/uninstall-java-realistic-recommendation-no-insanity-yes-96192
While discussing the various countermeasures (using Proxies, GPO, etc), they mentioned that SEP 12.1 brought new tools that can be used for Java defenses. They didn't get into detail, and I can't find anything in the documentation or the SEP or SEPM GUI. Any idea what they were talking about? What I would REALLY love is to identify all of the legit Java apps (we really don't have that many) and then create a java applet whitelist with SEP-- is that possible?
Much thanks in advance,
Bill
Discussion Filed Under:
Comments 7 Comments • Jump to latest comment
Would be interesting to hear what they were talking about.
Obviously you have the AV, SONAR, Firewall, Application and Device Control, HIPS, browser IPS and Downlod Insight. Yes, you can do whitelisting in SEP. Only executables on your hash list would be allowed to run.
My guess would be Download Insight as it was just implemented in 12.1
How the Insight Lookup process works
Article URL http://www.symantec.com/docs/TECH169282
Expected behavior of Download Insight
SEP Knowledge Base
Endpoint SWAT
Thumbs up to the above - apparently the Insight technology may have been exactly the feature that was discussed on that webinar - it is the one of more important changes and implementations between SEP 11.x and 12.1.
Have a look at one other article concerning SONAR and Insight:
http://www.symantec.com/docs/TECH168849
Is there a way to leverage SONAR to specifically lock down Java applets to a whitelist?
You wouldn't be able to use SONAR for this but can use the whitelisting feature
SEP Knowledge Base
Endpoint SWAT
Hi Bill,
This (and several previous Security Response blogs) may be of interest as well:
With thanks and best regards,
Mick
This new Security Response blog post will be of interest to followers of this thread:
With thanks and best regards,
Mick
Hmm i'm not sure what tool is that, most likely new features mentioned above (download insight or sonar)
Based on your words it sounds like whitelisting?
Would you like to reply?
Login or Register to post your comment.