CoreTrace's Bouncer 5 is application control and more. Bouncer is the only product in InfoWorld's review that successfully protected against buffer overflows. It also offers unique write protection of whitelisted files and does a nice job of handling updates to controlled applications.
A great-looking GUI, good reporting, and secure sessions between clients and the management server round out the rich feature set. However, Bouncer doesn't cover all program file types, notably those written in interpreted languages such as Python, PHP, or Java.
[ Read the Test Center review of application whitelisting solutions from Bit9, CoreTrace, Lumension, McAfee, SignaCert, and Microsoft. Compare these application whitelisting solutions by the features. ]
Started in early 2008, Bouncer is made up of a Windows XP Embedded management appliance and supports clients running Windows NT 4 SP6a and later and Solaris 7 through 10. The extra features and security considerations put into this product are evident from the start.
Logging into Bouncer's Control Center management console screen image requires a two-factor USB access token and either physical access to the management appliance or a Remote Desktop Protocol (RDP) session. Connections between the management console and clients are IPSec protected with PKI certificates. This is all automated in the setup of clients and server, and it does not use the normal Windows implementations.
The use of client certificates also aids monitoring. Clients can get new IP addresses, new network interfaces, new names, and so on, yet still be identified and tracked through the use of the certificate. Clients automatically check back in to the management console every 60 seconds using heartbeat packets across two high-numbered UDP ports, or you can schedule the connections for finer-grained control.
Managed computers are collected into groups known as Security Configurations. In fact, calling groups of computers Security Configurations is one of the few minor weaknesses of an otherwise top-of-the-class product. To be fair, Security Configurations are really the grouping of computers along with their defined treatment. But a simpler label would avoid potential confusion.
Three Security Configurations are provided out of the box -- All Installed Systems, Pending Systems, and Unsecured Systems -- but administrators are encouraged to make their own custom groupings. Each Security Configuration (i.e., group) will have its own Bouncer settings and Policy Components defined.
Policy Components are built around the concept of trusted change. Administrators can define Trusted Applications (applications that are allowed to run), Trusted Digital Signatures (all applications signed by the same digital signature can run), Trusted Network Shares (any application in a trusted location can run), and Trusted Users (trusted users can run any program). Each managed computer will inherit the policy components defined for its Security Configuration.
Computers, users, and groups can be enumerated from Active Directory. Each computer can be scanned to generate a new whitelist baseline or another predefined policy can be applied. When generating a new baseline, Bouncer can create whitelisting rules for all binaries (including .EXE, .DLL, .COM, .DRV, .SYS, .CPL, .OCX, .DEV, .MANIFEST, .FON, 16-bit apps, and batch files), and these rules can be enforced on the system drive only or on all drives. Other file types (scripts, text files, and so on) must be added manually and become part of the Custom Policy component.
Only executable binaries and batch files can be prevented from executing. Like most of its competitors, Bouncer cannot prevent scripts or Java programs from executing without blocking the scripting engine or Java Virtual Machine. This means you may be forced into an all-or-nothing decision for non-executable file types.
Whitelisted files become write-protected by Bouncer's own kernel drivers. Although files can be copied, they cannot be modified, renamed, or deleted. This is an interesting feature that no other competitor has. Besides preventing computer viruses, it could be used to prevent unauthorized modification of security-related files like the DNS Hosts file, which is often maliciously manipulated by malware programs. Bouncer can be put into Learning mode,
Post new comment