+SYS.2.2.2.A14 Application Control Using Software Restriction Policies and AppLocker (H)

SYS.2.2.2.A14 Application Control Using Software Restriction Policies and AppLocker (H)

Applications in paths for which users have write privileges SHOULD be prevented from being executed by software restriction policies (SRP) or AppLocker. In a domain-based network, AppLocker and SRP GPO SHOULD ONLY be managed centrally by means of Group Policy Objects for each user and user group.

AppLocker SHOULD be used in a whitelist approach, meaning that all applications that are not explicitly allowed SHOULD be prohibited. Preference SHOULD be given to rules based on the application signatures of defined publishers. Attempted violations of the rules SHOULD be logged and evaluated appropriately.

For clients with particularly high security requirements, AppLocker SHOULD prevent the execution of any unapproved applications (instead of merely logging them).

The SRP and AppLocker rules SHOULD be tested on a test system or by means of operation in monitoring mode before being used on a production system.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.22 Manipulation of Information
blocks G 0.32 Misuse of Authorisation
blocks G 0.36 Identity theft
blocks G 0.39 Malware
blocks G 0.46 Loss of Integrity of Sensitive Information