Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Application whitelisting review: Lumension Application Control

Lumension Application Control is a competitive product with a number of standout features and one significant omission
Page:

Lumension Application Control is a strong whitelisting solution with broad file coverage, excellent reporting, and a complete set of Windows file definitions that can be used to spot potentially troublesome changes to system files. Its one noteworthy shortcoming is the inability to create whitelisting rules based on the digital signatures of application publishers.

Lumension, which is the product of the marriage of PatchLink and SecureWave, is the parent of several security components and modules, including Application Control (covered in this review), device control, data protection, vulnerability assessment, patching, and anti-virus.

Application Control is essentially the latest incarnation of SecureWave's Sanctuary, an application whitelisting product that has been on the market for more than six years. Application Control can be purchased separately, but it is intended to be a primary part of the Lumension Endpoint Protection solution, which includes Lumension AntiVirus, or the Lumension Endpoint Security Solution Pack, which includes Lumension Device Control. Application Control and Device Control share the same management console.

The server-side management console, called Lumension Endpoint Security Management screen image, serves multiple components, so it's inherently a bit busier than its counterparts in whitelisting-only products. However, Lumension allows customers to use as many management servers as they need, without paying any server licenses -- a key advantage when trying to scale out an enterprise deployment or address performance or management issues.

Lumension, like SignaCert, comes with a complete set of standard file definitions (SFDs) for Windows 2000 to Windows 7 operating systems, prescanned and prehashed. These "gold" definitions are useful for noting deviations from the Microsoft defaults. Like all of the competitors in this roundup, Lumension can scan one or more existing computers to automatically generate whitelist execution rules, using the Scan Explorer feature.

Unlike most of the other competitors, Lumension can create whitelisting rules for all file types, although it defaults to executables only. The Exe Explorer feature will reveal individual files and their attributes found during the scan or already stored in the database. Files are identified by the normal file attributes (such as name or size) and SHA-1 hashes. Additionally, Lumension allows you to define path rules (allow only) and trusted users who can run anything (called Local Authorization). Unfortunately, Lumension does not support whitelisting using publisher digital signatures, which is a significant omission in an otherwise very good product.

Page:

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Adobe, etwork, Lumension, Microsoft, Novell, PatchLink
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: application whitelisting, reviews, security
Latest Blog Posts
Whitepapers
  • The Case for Real-Time Networking
    CIOs are facing several powerful trends and inflection points that are defining the new IT landscape, including cloud computing, virtualization, the consumerization of IT, smart computing, and communications to collaboration. Taken individually, each one of these trends will have significant ripple effects throughout the planning and operations of IT network infrastructure. In aggregate, they will have an even more dramatic impact on the way that future network architectures need to be planned and designed. Read on.
    Learn more »
  • Managing IBM License Complexity
    IBM provides thousands of products in its portfolio and uses a variety of license models, contract terms and conditions. These license models can be very complex, causing frequent confusion for organisations trying to grasp the concepts while maintaining license compliance. While at first IBM licensing may seem incomprehensible, some education on the license models and licensing scenarios will help minimise the confusion. In addition, a more automated approach to managing licenses enables organisations to gain control, reduce ongoing software costs and minimise license liability risks. Read on.
    Learn more »
  • A Technical Overview of the Oracle Exadata Database Machine and Exadata Storage Server
    Businesses today increasingly need to leverage a unified database platform to enable the deployment and consolidation of all applications onto one common infrastructure. Whether OLTP, DW or mixed workload a common infrastructure delivers the efficiencies and reusability the datacenter needs – and provides the reality of grid computing in-house. Read on.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments