Let's not discuss the methods in which the mechanism can be bypassed.
We mentioned before what can happen if you use a path rule
if you're using a file hash rule you need to make sure a hash rule don't match your code to bypass it.
You can open a file in a hex editor and change a bit hoping it won't affect the operation of the program.
There are quite a lot of safe bits behind the file header so users shouldn't hit the bit.
This can serve to bypass existing security solutions
Internet and zone rules are generally not very secure since they apply only to Internet Explorer.
If you're using a different web browser they don't work at all.
To bypass certificat rule you need to sign the file with a different certificate.
This might seem difficult but in fact there are visual studio tools that can generate a certificate
that can be used to sign a file this doesn't change the trustworthiness of a file in its issuer.
But this might be used to bypass the software restriction policy.
What's important is that all these solutions will only work if you've implemented a model that shouldn't
be used in the first place.
This is the everything is allowed except for what is explicitly disallowed.
Model.
Now everyone is trying to think of ways to make their favorite instant messaging software slip in.
If you're working in the opposite model all such attempts are doomed to fail.
This doesn't mean however that if a user has local administrative permissions they will not have control
over this mechanism.
Over other security solutions it's true that central policies policies that are set by a domain administrator
override any local administrator permissions.
But before this happens a computer needs to be made aware of the central policies during startup before
you log on.
A computer connects to a domain controller and downloads a security policy.
It's safe to a registry.
This means that a user who has a local administrator might erase data in the registry key and revoke
permissions of a system account to what is left to an empty key.
The rules will not appear after another restart.
This is a simple mechanism that you need to remember is available to local administrators
application control rules.
The latest version of the mechanism we're discussing have been significantly streamlined.
There are only three rules a path rule a file hash rule and a publisher rule.
As we mentioned the Internet zone rule was controversial from the start.
Just like before.
You might specify program types to which the rules will apply you can select from executable files the
MSIE installer files scripts N-deal Elle's.
Your role is to create a list of software that will be allowed to run.
The previous solution did not require running any additional system services setting up application
control rules on the other hand will not have an effect unless you run an additional service this service
is designed to audit and oversee their operation.
It is by default in manual startup mode
as part of a configuration procedure.
You need to switch to automatic mode to make implementation of this solution simpler.
You can create default rules.
There are three default rules.
The first default rule is meant to allow users to run all programs that are installed in the program's
file folder or sub folders which aren't appropriate locations for any programs.
The second rule allows users to run components of an operating system that need to be trusted.
The third rule allows an administrator group to do anything to run all files and programs.
The rules are designed to smooth the process of protecting your system.
Don't shrink from creating the rules and everything is blocked.
Mode default rule will cause some files and programs to be accessible.
Some files and programs won't run
the ability to generalize rules is an interesting feature that will look into in a moment.
You can indicate a digitally signed file and say for example make a rule that is not applicable to this
file but a more general one.
This will apply to specified versions of a piece of software or to all programs from the issuer of a
certificate
to fault rules aren't perfect.
There are two general a general security solution will most of the times be inefficient.
But this problem has been solved as well.
There's a rule generator instead of creating rules manually and not your own.
You can indicate a folder and instruct the tool to generate rules applying to all files in a specified
folder.