Policy Settings

The primary global settings include:

Wireless Control

Wireless Control globally sets adapter connectivity parameters to secure both the endpoint and the network. To access this control, click the Global Policy Settings tab, then click the Wireless Control icon in the policy tree on the left.

Figure 6-7 Wireless Control Policy

The wireless control settings include the following:

Communication Hardware

Communication hardware controls, by location, which hardware types are permitted a connection within this network environment.

Figure 6-8 Communication Hardware Policy

Select to either allow or disable the global setting for each communication hardware device listed:

Storage Device Control

Storage device controls set the default storage device settings for the policy, where all external file storage devices are either allowed to read/write files, function in a read-only state, or be fully disabled. When disabled, these devices are rendered unable to retrieve any data from the endpoint; while the hard drive and all network drives remain accessible and operational.

Figure 6-9 Global Storage Device

Storage Device Control is differentiated into the following categories:

Fixed storage (hard disk drives) and network drives (when available) are always allowed.

To set the policy default for a category, select from the following options:

Figure 6-10 Verify Local Storage Device Options are set as Disabled

USB Connectivity

All devices that connect via the USB BUS can be allowed or denied by policy. These devices can be scanned into the policy from the USB Device Inventory report or by scanning all devices currently connected to a machine. These devices can be filtered based on manufacturer, product name, serial numbers, type, and so forth.For support purposes, the administrator can configure the policy to accept a set of devices, either by manufacturer type, (for example, all HP devices are allowed), or by product type (all USB-human interface devices [mouse and keyboard] are allowed). Additionally, individual devices can be permitted to prevent non-supported devices from being introduced into the network (for example, no printers are allowed except for this one).

To access this control, click the Global Policy Settings tab, then click USB Connectivity in the policy tree on the left.

Figure 6-11 USB Connectivity page.

Access is first evaluated based on whether the bus is active or not. This is determined by the USB Devices setting. If this setting is set to Disable All Access, the device is disabled and evaluation stops. If this setting is set to Allow All Access, the client continues the evaluation and set looking for filter matches. As with many other fields in the ZENworks Management Console, when being set on a location, the USB Devices value can also be set to Apply Global Settings and the global value of this field will be used instead.

The client gathers the filters that are applied from the policy, based on the location and global settings.The client will then group the filters based on access into the following groups:

A device is evaluated against each group in the above order (first the Always Block group, followed by Always Allow, and so forth). When a device matches at least one filter in a group, the device's access is set to that level and evaluation stops. If the device is evaluated against all filters, and no match is found, the Default Device Access level is applied.

Device Access set in the Device Group Access area is considered along with all other filters being used at that location. This is done by generating matching filters for each of the grouping when the policy is published to the client. These filters are as follows:

Advanced

In most situations, the four device groups listed on the USB Connectivity page (Human Interface Device, Mass Storage Class, Printing Class, and Scanning/Imaging) are sufficient to allow or deny access to most USB devices. If you have devices that do not register in one of these groups, you can configure settings on the USB Connectivity Advanced page. You can also use the settings on the Advanced page to provide whitelist access to certain devices even though they might be denied access because of the settings on the USB Connectivity page.

To access the Advanced USB Connectivity options, click the plus sign next to USB Connectivity in the Global Settings tree, then click Advanced. You can use the USB Device Audit report as a means of getting all the information you could potentially use on the USB Connectivity Control Advanced page.

Figure 6-12 USB Connectivity Advanced page.

To add a device to the list, fill in the following fields:

You can click the Advanced Columns box to add the following columns: USB Version, Device Class, Device Sub-Class, Device Protocol, Vendor ID, Product ID, BCD Device, O/S Device ID, and O/S Device Class.

A device makes available a set of attributes to the OS. These attributes are matched by the client to the fields required by a filter. All fields in the filter must match an attribute provided by the device in order to have a match. If the device does not provide an attribute or field that is required by the filter, that filter fails to match.

For example, suppose a device provides the following attributes: Manufacture: Acme Class: 8, Serial Number: "1234".

The filter: Class == 8 would match this device. The filter: Product == "Acme" would not match because the device did not provide a Product attribute to the OS.

The following fields are sub-string matched: Manufacturer, Product, and Friendly Name. All other fields are exact matches.

As a matter of interest, USB serial number(SN) field by spec. is only unique when considered when specifying the following fields along with the SN: USB Version, Vendor ID, Production ID, and BCD Device.

Current valid values for USB version in decimal are: 512 - USB 2.0, 272 - USB 1.1, 256 - USB 1.0.

Data Encryption

Data Encryption determines whether file encryption is enforced on the endpoint and what type of encryption is available. Data can be encrypted to permit file sharing (with password protection) or can set encrypted data to be read-only on computers running the Storage Encryption Solution.

To access this control, click the Global Policy Settings tab, then click Data Encryption in the policy tree on the left.

Figure 6-13 Data Encryption controls

To activate the individual controls, click the Enable Data Encryption check box.

Determine what levels of encryption are permitted by this policy:

ZSC Update

Patches to repair any minor defects in the Endpoint Security Client are made available with regular ZENworks Endpoint Security Management updates. Rather than providing a new installer, which needs to be distributed through MSI to all endpoints, ZENworks Security Client Update allows the administrator to dedicate a zone on the network that distributes update patches to end users when they associate to that network environment.

To access this control, click the Global Policy Settings tab, then click ZSC Update in the policy tree on the left.

Figure 6-14 ZSC Update

To facilitate simple and secure distribution of these patches to all Endpoint Security Client users:

Each time the user enters the assigned location, the Endpoint Security Client checks the URI for an update that matches that version number. If an update is available, the Endpoint Security Client downloads and installs it.

VPN Enforcement

This rule enforces the use of either an SSL or a client-based VPN (Virtual Private Network). This rule is typically applied at wireless hotspots, allowing the user to associate and connect to the public network, at which time the rule attempts to make the VPN connection, then switches the user to a defined location and firewall setting. All parameters are at the discretion of the administrator. All parameters override existing policy settings. The VPN-Enforcement component requires the user be connected to a network prior to launching.

To access this control, click the Global Policy Settings tab, then click VPN Enforcement in the policy tree on the left.

Figure 6-15 Basic VPN Enforcement

To use the VPN Enforcement rule, at least two locations must exist.

To add VPN enforcement to a new or existing security policy:

The standard VPN Enforcement settings described above make VPN connectivity an option. Users are granted connectivity to the current network whether they launch their VPN or not. For stricter enforcement, see Advanced VPN Settings below.

Advanced VPN Settings

Advanced VPN controls are used to set Authentication Timeouts to secure against VPN failure, connect commands for client-based VPNs, and use Adapter controls to control the adapters permitted VPN access.

To access this control, click the Global Policy Settings tab, click the “+” symbol next to VPN Enforcement, then click Advanced in the policy tree on the left.

Figure 6-16 Advanced VPN Enforcement

The following advanced VPN enforcement settings can be configured:

If an adapter is checked (changing it to Enabled, Except), those adapters (Wireless being specific to card type) are permitted connectivity to the VPN.

Adapters entered into the exception lists below, are denied connectivity to the VPN, while all others of that type will be given connectivity.

If an adapter is not checked (Disabled, Except), then only the adapters entered into the exception list are permitted to connect to the VPN; all others are denied connectivity.

This control can be used for adapters incompatible to the VPN, for example, or adapters not supported by the IT department.

This rule overrides the adapter policy set for the switch-to location.

About Locations

The following types of locations can be configured:

To access the Unknown Location controls, click the Locations tab, then click the Unknown location in the policy tree on the left.

To create a new location:

To associate an existing location:

It is recommended that multiple defined locations (beyond simple Work and Unknown locations) be defined in the policy to provide users with varying security permissions when they connect outside the enterprise firewall. Keeping the location names simple (for example, Coffee Shops, Airports, Home) and providing a visual cue through the location's Taskbar icon, which helps users easily switch to the appropriate security settings required for each network environment.

Communication Hardware

Communication hardware controls, by location, which hardware types are permitted a connection within this network environment.

Figure 6-18 Location Communication Hardware Control

The Endpoint Security Client receives notification whenever a network device is installed in the system and determines if the device is approved. If it is not approved, the solution disables the device driver, which renders this new device unusable, and notifies the user of the situation.

When a new unapproved adapter first installs its drivers on the endpoint (via PCMCIA or USB), the adapter displays as enabled in Windows Device Manager until the system is rebooted, though all network connectivity is blocked.

Storage Device Control

Storage device controls set the default storage device settings for the policy, where all external file storage devices are either allowed to read/write files, function in a read-only state, or be fully disabled. When disabled, these devices are rendered unable to retrieve any data from the endpoint; while the hard drive and all network drives remain accessible and operational.

Figure 6-19 Location Storage Device Control

Storage Device Control is differentiated into the following categories:

Fixed storage (hard disk drives) and network drives (when available) are always allowed.

To set the policy default for storage devices, select the global setting for both types from the drop-down lists:

Figure 6-20 Verify Local Storage Device Options are set as Disabled

Wi-Fi Management

Wi-Fi management allows the administrator to create Access Point lists. The wireless access points entered into these lists determine which access points the endpoint is permitted and not permitted to connect to within the location, and which access points it's permitted to see in the Microsoft Zero Configuration Manager (Zero Config). Third-party wireless configuration managers are not supported with this functionality. If no access points are entered, all access points are available to the endpoint.

To access this control, click the Locations tab, then click Wi-Fi Management in the policy tree on the left.

Figure 6-21 Location Wi-Fi Management

Entering access points into the Managed Access Points list turns off Zero Config and forces the endpoint to connect only to the access points listed when they're available. If the Managed access points are not available, the Endpoint Security Client falls back to the Filtered Access Point List. Access points entered into Prohibited Access Points never display in Zero Config.

The following sections contain more information:

Wi-Fi Signal Strength Settings

When more than one WEP-managed access point is defined in the Managed Access Points list (see Managed Access Points), the signal strength switching for the Wi-Fi adapter can be set. The signal strength thresholds can be adjusted by location to determine when the Endpoint Security Client searches for, discards, and switches to another access point defined in the list.

Figure 6-22 Signal Strength Control

The following settings can be adjusted above or below the current defaults:

• Search: When this signal strength level is reached, the Endpoint Security Client begins to search for a new access point to connect to. The default setting is Low [-70 dB].

• Switch: In order for the Endpoint Security Client to connect to a new access point, that access point must broadcast at the designated signal strength level above the current connection. The default setting is +20 dB.

The signal strength thresholds are determined by the amount of power (in dB) reported through the computer’s miniport driver. As each Wi-Fi card and radio may treat the dB signals differently for their Received Signal Strength Indication (RSSI) the numbers vary from adapter to adapter.

The default numbers associated with the defined thresholds in the Management Console are generic for most Wi-Fi adapters. It is recommended you research your Wi-Fi adapter's RSSI values to input an accurate level. The Novell values are:

Name	Default Value
Excellent	-40 dB
Very Good	-50 dB
Good	-60 dB
Low	-70 dB
Very Low	-80 dB

Although the above signal strength names match those used by the Microsoft Zero Configuration Service, the thresholds may not match. Zero Config determines its values based on the Signal to Noise Ratio (SNR) and not solely on the dB value reported from RSSI. For example, if a Wi-Fi adapter were receiving a signal at -54 dB and had a noise level of -22 dB, the SNR would report as 32dB (-54 - -22=32), which on the Zero Configuration scale would translate as Excellent signal strength, even though on the Novell scale, the -54 dB signal (if reported that way through the miniport driver, possibly reported lower) would indicate a Very Good signal strength.

It's important to note that the end user never sees the Novell signal strength thresholds; this information is merely provided to show the difference between what the user may see through Zero Config and what is actually occurring behind the scenes.

Because both signal strength and encryption type (see Wi-Fi Security) are used to determine the order in which access points are attempted, you must select the preferred method. For example, if signal strength is the preference, then the strongest signal is given the preference when connecting. If WEP 64 is the encryption requirement and encryption is the preference, then access points with the highest encryption strength are given preference over all others.

Managed Access Points

ZENworks Endpoint Security Management provides a simple process to automatically distribute and apply Wired Equivalent Privacy (WEP) keys without user intervention (bypassing and shutting down the Microsoft Zero Configuration manager), and protects the integrity of the keys by not passing them in the clear over an e-mail or a written memo. In fact, the end user never needs to know the key to automatically connect to the access point. This helps prevent possible re-distribution of the keys to unauthorized users.

Due to the inherent security vulnerabilities of Shared WEP Key Authentication, Novell supports only Open WEP Key Authentication. With Shared Authentication the client/AP key validation process sends both a clear text and encrypted version of a challenge phrase that is easily sniffed wirelessly. This can give a hacker both the clear and encrypted versions of a phrase. Once they have this information, cracking the key becomes trivial.

Figure 6-23 Managed Access Points Control

Enter the following information for each access point:

• SSID: Identify the SSID number. The SSID number is case sensitive.

• MAC Address: Identify the MAC Address (recommended, due to the commonality among SSIDs. If not specified, it is assumed there are multiple access points beaconing the same SSID number).

• Key: Specify the WEP key for the access point (either 10 or 26 hexadecimal characters).

• Key Type: Identify the encryption key index by selecting the appropriate level from the drop-down list.

• Beaconing: Check if the defined access point is currently broadcasting its SSID. Leave un-checked if this is a non-beaconing access point.

The Endpoint Security Client attempts to first connect to each beaconing access point listed in the policy. If no beaconing access is located, the Endpoint Security Client then attempts to connect to any non-beaconing access points (identified by SSID) listed in the policy.

When one or more access points are defined in the Managed Access Points list, the Signal Strength switching for the Wi-Fi adapter can be set (see Wi-Fi Signal Strength Settings).

Filtered Access Points

Access points entered into the Filtered Access Points list are the only access points that display in Zero Config; this prevents an endpoint from connecting to unauthorized access points.

Figure 6-24 Filtered Access Points Control

Enter the following information for each access point:

• SSID: Identify the SSID number. The SSID number is case sensitive.

• MAC Address: Identify the MAC Address (recommended, due to the commonality among SSIDs. If not specified, it is assumed there will be multiple access points beaconing the same SSID).

Prohibited Access Points

Access points entered into the Prohibited Access Points list do not display in Zero Config, nor will the endpoint be permitted to connect to them.

Figure 6-25 Prohibited Access Points Control

Enter the following information for each access point:

• SSID: Identify the SSID number. The SSID number is case sensitive.

• MAC Address: Identify the MAC Address (recommended, due to the commonality among SSIDs. If not specified, it is assumed there will be multiple access points beaconing the same SSID).

Wi-Fi Security

If Wi-Fi Communication Hardware (Wi-Fi adapter PCMCIA or other cards, and built-in Wi-Fi radios) is globally permitted (see Wireless Control), additional settings can be applied to the adapter at this location.

To access this control, click the Locations tab, then click Wi-Fi Security in the policy tree on the left.

Figure 6-26 Location Wi-Fi Security

The Wi-Fi adapter can be set to communicate only with access points with a specific level of encryption or greater in a given location.

For example, if a WPA configuration of access points were deployed in a branch office, the adapter can be restricted to only communicate with access points with a level of WEP 128 encryption or greater, thus preventing it from accidentally associating with rogue, non-secure access points.

It is recommended a custom user message be written when the setting is placed above No Encryption Required.

A preference can be set to connect to access points by order of encryption level or by signal strength when two or more access points are entered into the Managed and Filtered Access Points lists. The level selected enforces connectivity with access points that meet the minimum encryption requirement or greater.

For example, if WEP 64 is the encryption requirement and encryption is the preference, then access points with the highest encryption strength are given preference over all others. If signal strength is the preference, then the strongest signal is given the preference when connecting.

Antivirus/Spyware Rules

Antivirus/Spyware Rules verify that designated antivirus or spyware software on the endpoint is running and up to date. Tests are run to determine if the software is running and if the version is up-to-date. Success in both checks allow switching to any defined locations. Failure of either test could result in any or all of the following actions (defined by the administrator):

After endpoints are determined compliant by a follow-up test, security settings automatically return to their original state.

To access this control, click the Integrity and Remediation Rules tab, then click Antivirus/Spyware Rules in the policy tree on the left.

Figure 6-27 Antivirus/Spyware Integrity rules

Custom tests for software not on the default list can be created. A single test can be created to run checks for one or more software pieces within the same rule. Each set of Process Running and File Exists checks have their own success/failure results.

To create a new antivirus/spyware rule:

To associate existing Antivirus/Spyware Rules:

Integrity tests and checks are automatically included and can be edited as necessary.

Integrity Tests

Each integrity test can run two checks, File Exists and Process Running. Each test has its own success and fail results.

Figure 6-28 Integrity Tests

All defined antivirus/spyware rules have standard tests and checks pre-written. Additional tests can be added to the integrity rule.

Multiple tests run in the order entered here. The first test must complete successfully before the next test runs.

To create an integrity test:

Integrity Checks

The checks for each test determine if one or more of the antivirus/spyware process is running or if essential files exist. At least one check must be defined for an integrity test to run.

Figure 6-29 Integrity Checks

To create a new check, right-click Integrity Checks from the policy tree on the left, then click Add New Integrity Checks. Select one of the two check types and enter the information described below:

Process is Running

This check is used to determine if the software is running at the time of the triggering event (i.e., the AV client). The only information required for this check is the executable name.

File Exists

This check is used to determine if the software is current and up-to-date at the time of the triggering event.

Enter the following information in the provided fields:

The checks are run in the order entered.

Advanced Scripting Rules

ZENworks Endpoint Security Management includes an advanced rule scripting tool that gives administrators the ability to create extremely flexible and complex rules and remediation actions.

To access this control, click the Integrity and Remediation Rules tab, then click the Advanced Scripting Rules icon in the policy tree on the left.

Figure 6-30 Advanced Scripting

The scripting tool uses either of the common scripting languages, VBScript or JScript, to create rules that contain both a trigger (when to execute the rule) and the actual script (the logic of the rule). The administrator is not restricted on the type of script to be run.

Advanced scripting is implemented sequentially, along with other integrity rules. Therefore, a long-running script will prevent other rules (including timed rules) from executing until that script is complete.

To create a new advanced scripting rule:

To associate an existing advanced scripting rule:

Script Variables

This is an optional setting, which permits the Administrator to define a variable (var) for the script and either be able to use ZENworks Endpoint Security Management functionality (i.e., launch defined custom user messages or hyperlink; switch to a defined location or firewall setting) or have the freedom to change the value of a variable without changing the script itself.

Figure 6-31 Script Variables

To create a new script variable:

1. Select Script Variables from the components tree and click Add New

2. Name the variable and provide a description

3. Select type of variable:

   • Custom User Messages - defines a custom user message which can launch as an action

   • Firewall - defines a firewall setting which can be applied as an action

   • Hyperlinks - defines a hyperlink which can be launched as an action

   • Location - defines a location which can be applied as an action

   • Number - defines a number value

   • String - defines a string value

4. Select/enter the value of the variable

5. Click Save. Repeat the above steps to create a new variable

Script Text

The ZENworks Endpoint Security Management Administrator is not limited to the type of script the Endpoint Security Client may execute. It is recommended that ANY script be tested prior to distributing the policy.

Select the script type (Jscript or VBscript) and enter the script text in the provided field. The script may be copied from another source and pasted into the field. See Section 6.3.11, Rule Scripting Parameters, for acceptable script syntax.

Figure 6-32 Script Text Window

Updating a Published Policy

Once a policy has been published to the user(s) or computer(s), simple updates can be maintained by editing the components in a policy, and re-publishing. For example, if the ZENworks Endpoint Security Management Administrator needs to change the WEP key for an access point, the adminstrator only needs to edit the key, save the policy, and click Publish. The affected end-users and computers receive the updated policy (and the new key) at their next check-in.