The McAfee Application Control Options Reputation-Based Execution settings, if enabled, must be configured to allow Most Likely Trusted or Known Trusted only.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213331	MCAC-TE-000105	SV-213331r506897_rule		Medium

Description
When a file is executed on an endpoint, the Application Control performs multiple checks to determine whether to allow or ban the execution. Only files with a reputation of "Most Likely Trusted", "Known Trusted" or "Might be Trusted" are considered to be allowed. By configuring the setting to only "Most Likely Trusted" or "Known Trusted", the files with a reputation of "Might be Trusted" are blocked. While this may impact operationally in the beginning, after the inventories are vetted by the administrators, files with a "Might be Trusted" value may be recategorized in that organization.

Description

When a file is executed on an endpoint, the Application Control performs multiple checks to determine whether to allow or ban the execution. Only files with a reputation of "Most Likely Trusted", "Known Trusted" or "Might be Trusted" are considered to be allowed. By configuring the setting to only "Most Likely Trusted" or "Known Trusted", the files with a reputation of "Might be Trusted" are blocked. While this may impact operationally in the beginning, after the inventories are vetted by the administrators, files with a "Might be Trusted" value may be recategorized in that organization.

STIG	Date
McAfee Application Control 8.x Security Technical Implementation Guide	2020-10-02

Details

Check Text ( C-14559r505028_chk )
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. If Reputation-Based Execution settings is not enabled, this check is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset(s) that need the organization-specific policy. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Verify the "Reputation-Based Execution Settings" is configured to allow binaries with "Most Likely Trusted" and above. If the allow binaries "Most Likely Trusted" and above is not selected for "Reputation-Based Execution Settings", this is a finding.

Check Text ( C-14559r505028_chk )

This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable.

If Reputation-Based Execution settings is not enabled, this check is Not Applicable.

From the ePO server console System Tree, select the "Systems" tab.

Select "This Group and All Subgroups".

Select the asset(s) that need the organization-specific policy.

Select "Actions".

Select "Agent".

Select "Modify Policies on a Single System".

From the product pull-down list, select Solidcore 8.x: Application Control.

From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed.

Select the "Reputation" tab.

Verify the "Reputation-Based Execution Settings" is configured to allow binaries with "Most Likely Trusted" and above.

If the allow binaries "Most Likely Trusted" and above is not selected for "Reputation-Based Execution Settings", this is a finding.

Fix Text (F-14557r505029_fix)
If Reputation-Based Execution settings is not enabled, this check is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Place a check in the "Reputation-Based Execution Settings: Allow binaries with" check box and select "Most Likely Trusted" from the drop-down selection box. Click "Save".

Fix Text (F-14557r505029_fix)

If Reputation-Based Execution settings is not enabled, this check is Not Applicable.

From the ePO server console System Tree, select the "Systems" tab.

Select "This Group and All Subgroups".
Select the asset.
Select "Actions".
Select "Agent".
Select "Modify Policies on a Single System".

From the product pull-down list, select Solidcore 8.x: Application Control.

From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed.

Select the "Reputation" tab.

Place a check in the "Reputation-Based Execution Settings: Allow binaries with" check box and select "Most Likely Trusted" from the drop-down selection box.

Click "Save".