Best Of

Re: How do I block a smartphone on PSB

Hi Carlos2285

To block/disable mobile phone via Device Control from PSB web portal, you need to block the following device classes.

Please add a device access rule as below, and let me know if it works:

Display name: Mobile Phone storage
HardwareID: USB\Class_FF
Access level: Blocked

Repeat this rule with the below mentioned device classes to block all smart phones:

HardwareID: USB\Class_00
HardwareID: USB\Class_08
HardwareID: USB\Class_02
HardwareID: USB\Class_EF

JamesC

2

Re: Quarantine rules for Fw | CS 14.02

Hello Vincent,

Network isolation rules are the firewall rules applied when a managed host gets isolated. It can become isolated either due to Network quarantine feature when certain criteria are not met, or get isolated manually by Policy Manager administrator using Operations > Network isolation > Isolate remote operation. The same isolation rules will be applied in both cases.

Best regards,

Vad

Vad

1

Re: F-Secure: left hand doesn't know what the right hand is doing? (PSB remote FSDIAG confusion)

Hi Tamas,

As MonikaL shared, obtaining the file samples during the first stage would be the most efficient way to resolve a false positive case.

The binaries are required for us to debug how the false positive may occur in a particular file and then apply the necesary fixes, while keeping the protection on a good level to still detect valid malware samples.

In some cases, the samples may be publicly available or already in our backend. I would recommend whenever possible to provide at least the file hash (SHA1) when filing a false positive case, so that we can check if the sample is already available to us.

The PSB Management API documentation contains some examples on how to generate a report containing the detection details (including SHA1) programmatically:
https://help.f-secure.com/product.html?business/psb-rest-api/1.0.0/en/concept_216D5455656A49A38AA049D6C7B37427-1.0.0-en

For cases where the sample is not available to us (e.g. internally-developed software), there's an easy-to-use F-Secure tool available that we recommend to both Home and Corporate users to utilize in order to safely retrieve the quarantined files before submission.

The tool would have to be executed at the endpoint where the samples were quarantined, and its usage instructions are described here:
https://community.f-secure.com/t5/Common-topics/How-do-I-collect-quarantined/ta-p/78104

As PSB currently doesn't feature remote sample submission capabilities, I hope you find the above information useful for the time being.

victor_js

7

Re: Quarantine rules for Fw | CS 14.02

Hi Vad,

This is exactly what we were waiting for...

And it works perfectly...

Thank you.

_Vincent_

1

Re: HTTPS Communication to PolicyManager 14.20

There is no client certificate to be distributed.
The server has a self signed certificate.

ClientSecurity "knows" the certificate that is in use, so what you see is only from a browser.
If you prefer you can replace that with a company certificate.
If your Clients are V14 they will automatically switch to https
Port 80 will only be used for Updates.

MJ-perComp

7

Re: FW rules from 13 to 14

Hello Askoik,

- You can have different profiles for 80 and 20 clients.
- To minimize effect of Microsoft rules you can check the checkbox "Ignore all firewall rules that are not listed in this profile".

Best regards,
Vad

Vad

1

Re: Endpoint Security Portal (formerly Endpoint Protection Portal) Changelog

Hi,

new release will be rolled out to all portals in next few days with folloging changes:

New features:

Mobile devices can be searched by UDID.
Added operating system build number to the computer device listing.

Fixed issues:

Exported CSV report from infection tab does not include Computer name.
If Server Security subscription is upgraded to Server Protection Premium, profile assignment option is not available for old Server Security 12.
Portal UI displays "No Premium subscription" for Server Protection Premium products.
Request fsdiag operations status handling fixed and no longer loses statuses.

PSB Team

PetriKuikka

2

Re: FW rules from 13 to 14

In V13 we had ruleset with a hirarchical management.
But Admins tend to organize their systems by departments and not by technical needs.
Thus having a special rule on one system in each department was a mess as this rule had to be added to an extra subdomain in that department or to special single hosts in that department. A change to these rules had to be done in various places.

In V14 Profiles we introduced. All profiles ar bound to the root of your tree.
(I have to admit that knowing the old cncept leads to misconfiguration as the profiles are visible in each subdomain, at least until you have understood this new concept.)

So your experience is correct any change to a profile in global. To assign a different setup to a subdomain or host you need a different profile, which is done by cloning an existing one.

As mentioned, these profiles are no longer hirarchical, the clone is independant from it's original.

Now you can add your special rule to the new profile and choose that profile on the subdomain or host.

Any change done to the profile will automatically change the settings for all systemes using tha profile, means only one change for all host with the same technical setup even if they are located in different subdomains/departments.

While I think this concept is better than the old I would have loved to see the profiles still be hirarchical.

Nevertheless I recommend to move away from USB-printes to network printers to be able to close this huge secuity gap. If your special printers do not have a LAN-interface you better buy a LAN2USB-prinserver, which are available on Amazon or eBay starting at 12€. These one-time-expenses will add a lot to your IT-Security!

Matthias

MJ-perComp

2

Re: Complete Unisntall of Client Security

Hi Vincent

There are two uninstall tools available, and what version of CS are you removing ?

First tool - https://download.f-secure.com/support/tools/uitool/UninstallationTool.exe

Second tool - https://download.sp.f-secure.com/uninstallationtool/FsUninstallationTool.exe

If the first tool not work, we suggest to use the second uninstallation tool, which is the newer one.

New uninstallation tool:
FsUninstallationTool.exe
- Accept licence terms, GUI shown, Prompt for reboot (Consumer default)

FsUninstallationTool.exe --silent
- Completely silent

Old uninstallation tool:
UninstallationTool.exe
- Accept licence terms, GUI shown, Prompt for reboot (Consumer default)

UninstallationTool.exe -a --nogui
- Accept license terms, no GUI displayed, auto-reboot

UninstallationTool.exe -a --nogui --noreboot
- Accept license terms, no GUI displayed, no auto-reboot

UninstallationTool.exe -s -a --nogui
- Completely silent, auto-reboot

UninstallationTool.exe -s -a --nogui --reboot-delay=60
- Completely silent, auto-reboot 60 seconds after execution finishes (with user countdown)

JamesC

8