Document security policies

Live File Inventory

Tracks all executable files and scripts on all computers at all times. The near-real-time inventory provides a wide variety of information about these files, including the rate and nature of change across your organization. This feature is especially helpful during the first steps of identifying what information exists on cyber assets throughout your organization.

File Integrity Monitoring and Control

Monitors and controls all non-executable data and configuration files. This feature includes the ability to create custom software rules that apply to specified files or paths. It optionally restricts modifications to a specific folder or folders matching a specification. This feature is especially helpful during the first steps of identifying what information exists on cyber assets throughout your organization.

Enforcement Levels and Policies

Enables policy-defined administration and enforcement of classifications on a file-by-file, device-by-device basis. This feature applies information classifications to specific files and computers. Enforceable classifications range from very restrictive to no enforcement.

Global and Local States

Uses groups of security rules, also called policies, to control how different groups of computers treat different files in different states.

Global state determines what a specific file is allowed to do on a Bit9-managed computer. Global state is a combination of file state, which indicates the approval/ban of each individual file, and publisher state, which indicates the approval of the file’s publisher. Based on file and publisher states, each file is assigned a global state of one of the following:

• Approved – for all computers
• Approved by policy – approved for some computers, unapproved for others
• Banned – for all computers
• Banned by policy – banned for some computers, unapproved for others
• Unapproved – for all computers
• Mixed – banned for some computers but approved for others

Local state determines what each instance of a file is allowed to do on each computer, based on the following classifications:

• Approved
• Banned
• Unapproved
• Deleted (file was recently deleted on the device and will be removed from the database)