I recently attended a webcast held by Websense’s Chris Mitzlaff. The webcast highlighted Websense’s Client Policy Manager. The product restricts launching and installation of unauthorized software. It seems to be a great tool to stop blended security threats. CPM helps protect computers from being hacked
One cool feature allows the creation of a software set based on your current inventory. Lets say I use a patron internet PC as my base inventory for one group of computers. After running the CPM against the PC, you can apply a policy that only allows the software currently on that PC to launch. All other apps will not be allowed. I could then apply this policy to all patron internet PCs, since they are all the same build.
Someone attending the webcast asked if users could deactivate the Websense software on the client. The client services cannot be stopped by a user, and the user can’t use End Task to deactivate the software.
A feature exists called Express Lockdown. This can be used on the occasion when you hear of a threat, and you’re afraid you can’t apply the patch to all PCs and/or servers in time to be protected. It was also mentioned that there is often lag time between the instance a virus is discovered and the time the anti-virus company can release a definition to secure computers from the threat. So, if you hear of a threat, you can highlight the entire domain and select Express Lockdown. At that point only the software currently on the PCs can run – nothing else.
Real-time updates can be downloaded instead of waiting for a Websense database download every 24 hours.
There is a CPM client that must be installed. This installation can be done via a push. Websense also provides a remote installation tool.
This was a very good webcast. There were no slides. The entire webcast was hands-on with a lot of interaction with the attendees. CPM seems to be a great tool. Blended threats are one of the primary causes of PC failures. Often the PCs are so trashed with malware/spyware that they have to be rebuilt. CPM could also help ensure computers (PCs AND servers) are not hacked using malicious software