Application Control based on a baseline computer

You can use a baseline computer to create an image with a set of applications that you need. You can then use this image to deploy the operating system and applications on other computers. It is not always feasible to keep the image up to date. Application Control lets you maintain a list of allowed applications based on a baseline computer. Application Control automatically determines which applications are installed on the baseline computer and updates the category. In this way, the computers get an up-to-date list of allowed applications.

Configuring Application Control based on a baseline computer involves the following steps:

1. Creating an automatically update category. When creating the new category, select the Category that includes executable files from a specific folder category and select your baseline computer.

   How to create an automatically updated category in the Administration Console (MMC)

   1. Open the Kaspersky Security Center Administration Console.
   2. In the Administration Console tree, select Advanced → Application management → Application categories.
   3. Click the New category button in the workspace.

      This starts the application category creation wizard.

   4. Follow the instructions of the application category creation wizard.

   Step 1. Selecting the category type

   Select Category that includes executable files from selected devices as the category type.

   Step 2. Entering a user category name

   At this step, specify a name for the application category.

   Step 3. Settings

   This step is available if you selected the Category that includes executable files from selected devices category type.

   At this step, click the Add button and specify the computers whose executable files will be added to the application category by Kaspersky Security Center. All executable files from the specified computers presented in the Executable files folder will be added to the application category by Kaspersky Security Center.

   At this step, you can also configure the following settings:

   • Algorithm for hash function calculation. To select an algorithm, you must select at least one of the following check boxes:
     • Calculate SHA256 for files in this category (supported by Kaspersky Endpoint Security 10 Service Pack 2 for Windows and later versions).
     • Calculate MD5 for files in this category (supported by versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows).
   • The Synchronize data with Administration Server repository check box. Select this check box if you want Kaspersky Security Center to periodically clear the application category and add to it all executable files from the specified computers presented in the Executable files folder.

     If the Synchronize data with Administration Server repository check box is cleared, Kaspersky Security Center will not make any modifications to an application category after it is created.

   Step 4. Filter

   At this step, configure a filter for files.

   You can specify the file type that you want to use to create the application category.

   • All files. The category will match all files. This option is selected by default.
   • Only files outside the application categories. The category will match only files outside application categories.

   You can specify folders of selected computers that contain files that you want to use to create the application category.

   • All folders. The category will match all folders. This option is selected by default.
   • Specified folder. The category will match only the specified folder. If you select this option, you need to specify a folder path.

   Step 5. Creating a custom category

   Exit the Wizard.

   How to create a category with content added automatically in the Web Console and Cloud Console

   In the main window of the Web Console, select Operations → Third-party applications → Application categories.

   This opens the list of application categories.

   1. Click Add.

      This starts the application category creation wizard.

   2. Configure the general settings of the application category:
      • Category name.
      • Category creation method. Select Category that includes executable files from selected devices as the category type.

      Go to the next step.

   3. Configure the advanced settings of the application category:
      • Specify computers from which Kaspersky Security Center will add executable files to the application category. All executable files from the specified computers presented in the Executable files folder will be added to the application category by Kaspersky Security Center.
      • Select an algorithm for hash function calculation.
      • Configure an interval for synchronizing data with the Administration Server storage.
      • Configure a filter for files.
   4. Exit the Wizard.

   When creating an automatically updated category, it may be convenient to subdivide the files into multiple categories. For example, operating system files and files from the Program Files folder. To do so, you can use a filter in category settings and select individual folders.

2. Selecting the Application Control mode. You need to prevent the execution of all applications that are not explicitly allowed. To do so, select the Blocked applications mode.
3. Creating an Application Control rule. In rule settings, select the category that executable files from the baseline computer belong to.

   How to configure Application Control based on a baseline computer in the Administration Console (MMC)

   1. Open the Kaspersky Security Center Administration Console.
   2. In the console tree, select Policies.
   3. Select the necessary policy and double-click to open the policy properties.
   4. In the policy window, select Security Controls → Application Control.
   5. Select the Application Control check box.
   6. In the Application Control settings block use the Control mode drop-down list to select Denylist.
   7. In the Action drop-down list select the action for Application Control:
      • Test rules. Application Control does not block applications that are prevented from running by the rules, but generates events about the running of applications that would otherwise be blocked.
      • Apply rules. Application Control blocks the blocked applications and generates corresponding events.
   8. In the list of Application Control rules, click the Add button.

      This starts the wizard for adding an Application Control rule.

   9. In the Category drop-down list, select an automatically updated category based on the baseline computer.
   10. Select the users or groups of users to which you want to apply the Application Control rule.
   11. Configure the advanced settings of the Application Control rule:
       • Deny for other users. The application prevents the launch of applications that belong to the selected category for all users that are not on the list.
       • Trusted Updaters. Kaspersky Endpoint Security considers applications included in the selected application category as trusted updaters allowed to create other executable files that will be subsequently allowed to run.
   12. Save your changes. To apply the policy on computers, close the padlocks .

   How to configure Application Control based on a baseline computer in the Web Console and Cloud Console

   1. In the main window of the Web Console, select the Assets (Devices) → Policies & profiles tab.
   2. Click the name of the Kaspersky Endpoint Security policy.

      The policy properties window opens.

   3. Select the Application settings tab.
   4. Go to Security Controls → Application Control.
   5. Turn on the Application Control toggle.
   6. In the Application Control mode block, select Denylist.
   7. In the Action on starting applications blocked by rules block, select the action for Application Control:
      • Inform (Test mode). Application Control does not block applications that are prevented from running by the rules, but generates events about the running of applications that would otherwise be blocked.
      • Block. Application Control blocks the blocked applications and generates corresponding events.
   8. In the list of Application Control rules, click the Add button.

      This starts the wizard for adding an Application Control rule.

   9. Under Category, select an automatically updated category based on the baseline computer.
   10. Select the users or groups of users to which you want to apply the Application Control rule.
   11. Configure the advanced settings of the Application Control rule:
       • Deny for other users. The application prevents the launch of applications that belong to the selected category for all users that are not on the list.
       • Trusted Updaters. Kaspersky Endpoint Security considers applications included in the selected application category as trusted updaters allowed to create other executable files that will be subsequently allowed to run.
   12. Save your changes. To apply the policy on computers, close the padlocks .

   How to configure Application Control based on a baseline computer in the application interface

   1. In the main application window, click the button.
   2. In the application settings window, select Security Controls → Application Control.
   3. Turn on the Application Control toggle.
   4. In the Application Startup Control mode block, select Denylist. All applications, except for the ones in the rules list, are allowed.
   5. In the Action on starting applications blocked by rules block, select the action for Application Control:
      • Inform (Test mode) and log events in report. Application Control does not block applications that are prevented from running by the rules, but generates events about the running of applications that would otherwise be blocked.
      • Block. Application Control blocks the blocked applications and generates corresponding events.
   6. In the list of Application Control rules, click the Add button.

      This starts the wizard for adding an Application Control rule.

   7. Under Category, select an automatically updated category based on the baseline computer.
   8. Select the users or groups of users to which you want to apply the Application Control rule.
   9. Configure the advanced settings of the Application Control rule:
      • Deny for other users. The application prevents the launch of applications that belong to the selected category for all users that are not on the list.
      • Trusted Updaters. Kaspersky Endpoint Security considers applications included in the selected application category as trusted updaters allowed to create other executable files that will be subsequently allowed to run.
   10. Save your changes.