Document security policies

Default-Deny

The Bit9 Platform’s default-deny is capable of stopping customized, highly stealth malware by using a prevention technique called “whitelisting.” Whitelisting defines which applications are allowed to execute on a device or system – and then denies all other programs by default. So if an attacker's malware is not whitelisted by Bit9, it will be prevented from executing, regardless of how advanced, sophisticated, or stealth the software is.

Recognizing that different devices and systems contain different levels of sensitive information, this feature provides flexibility in implementation via three different levels of enforcement, which include the following:

• High enforcement: Allows only software IT has approved as trusted to run. All other software requires explicit approval. All device activity is recorded and logged for IT.
• Medium enforcement: End-user approval is required before any unauthorized application can run. User-driven approvals are limited to only that end-user’s machine. All device activity is recorded and logged for IT.
• Low enforcement: Records all device activity but allows all programs to run uninterrupted by default, unless explicitly banned by IT. IT can set up alerts to be notified of suspicious activity.

Detect-and-Deny

This form of proactive prevention enables the Bit9 Security Platform to automatically send files from endpoints to Check Point, FireEye, or Palo Alto Networks to be detonated and evaluated for suspicious behaviors and, if necessary, Bit9 administrative approval. Example use cases of this include sending all files from USB or other removable media for testing before execution, or having off-line devices automatically send all new executables for examination upon reconnecting to the network. This ensures that devices are protected and threats identified, even when operating outside the corporate network, such as while at a conference or using a public network.

Detonate-and-Deny

This third form of prevention enables a security administrator to identify malicious files and, as desired, individually or globally, ban those files with little to no end-user impact. This is true even if a malicious program has already executed on a device, because administrators can apply retroactive protection.