Designing Access Controls
Finalize Security Policies
Table 3-100. Windows Automatic Updates
Options | Your selection |
|
|
•Download and install automatically
•Download automatically but notify before installing
•Notify before downloading and installing
11.Does your organization prohibit certain software applications? Does it require certain applications?
The NAC 800 can scan for Windows applications. You’ll need to record the exact way in which the application is listed in the “HKEY_LOCAL_MACHINE\Software” or “HKEY_CURRENT_USER\Soft- ware” folder of the Windows registry. (However, you do not have to worry about case.)
Table 3-101. Tests for Applications
Allowed P2P Applications
Prohibited Software Applications
Required Software Applications
12.Does your organization prohibit certain services on endpoints? Does it require certain services?
Some services open vulnerabilities because they allow remote access to the endpoint. Such Windows services include:
•Telnet
•Routing and remote access
•RPC
Such Mac services include:
•Remote login
•Personal file sharing
•Xgrid
Before you prohibit these services, however, check with users and other IT staff and verify that they are not required for legitimate use.
