Quick Setup Guide for Faronics Anti-Executable Standard — Best PracticesFaronics Anti-Executable Standard is a security solution designed to prevent unauthorized or malicious software from running on endpoints by enforcing application control policies. This guide walks you through planning, installation, initial configuration, policy creation, deployment, and best practices to get Anti-Executable protecting your environment quickly and effectively.
1. Planning and prerequisites
Before you install Anti-Executable, prepare a deployment plan.
- System requirements: verify endpoint OS versions, hardware, and available storage meet Faronics’ requirements.
- Licensing: ensure you have valid Anti-Executable Standard licenses for all endpoints.
- Network: confirm network access between endpoints and your management server (if using Faronics Core or other central management).
- Backups & rollback plan: create image backups or system restore points for critical endpoints in case a policy blocks needed applications.
- Inventory: compile an inventory of installed software and critical executables so you can allow needed programs during the initial rollout.
- Test group: choose a small pilot group (5–20 machines) representing different user roles and software sets.
2. Installation options
Anti-Executable can be installed locally on endpoints or managed centrally. Choose the option that fits your environment:
- Standalone installation: install the Anti-Executable client directly on each endpoint. Appropriate for small environments or isolated systems.
- Managed deployment: use Faronics Core (or integrated management system) to deploy and manage Anti-Executable across many endpoints. Ideal for enterprise environments.
Installation steps (high level):
- Download the latest Anti-Executable installer from Faronics.
- Run the installer with administrative privileges.
- For managed deployments, connect the client to Core during installation or configure it post-installation via agent settings.
- Reboot endpoints if required.
3. Initial configuration and mode selection
Anti-Executable operates in different modes—select the one that matches your risk tolerance and readiness:
- Audit/Log-only mode: the product records execution attempts without blocking them. Use this first to build visibility into what would be blocked.
- Learning mode (if available): automatically creates allow rules based on observed, legitimate execution. Use cautiously and review generated rules.
- Enforcement/Block mode: actively prevents execution of unauthorized files. Move to this mode only after thorough testing and rule refinement.
Set up basic options:
- Configure logging level and central log collection if available.
- Define notification settings for administrators and helpdesk.
- Set a grace period or exclusions for software installation/upgrades during rollout.
4. Creating an application control policy
A clear, simple policy reduces false positives and simplifies management.
Policy elements:
- Default action: choose “Block unknown” (recommended after testing) or “Allow known, block unknown” depending on environment.
- Allowed list: include trusted directories (Program Files, Windows folder), digitally signed applications, and hashes for critical executables.
- Blocked list: explicitly block known bad programs or script hosts if needed.
- Exceptions: create temporary exceptions for specific users, groups, or machines during compatibility testing.
Rule types:
- Path-based rules: simple but can be bypassed if malware is dropped into allowed folders.
- Hash-based rules: strict and safe—allow specific file hashes. Update when software patches change binaries.
- Publisher/signature rules: allow applications signed by trusted vendors. Good balance of security and maintainability.
Example approach:
- Start with a baseline allow list containing OS folders and major application directories.
- Add publisher rules for common vendors (Microsoft, Adobe, etc.).
- Use hash rules for in-house or legacy apps that change infrequently.
- Keep a small set of path rules for installers or update tools, with additional monitoring.
5. Pilot deployment and tuning
Roll out to the pilot group in audit mode first.
- Monitor logs for a minimum of 1–2 weeks to see what would be blocked.
- Identify false positives: locate legitimate apps that were blocked and create appropriate allow rules (prefer publisher/hash over path).
- Use the inventory gathered earlier to pre-populate allow rules for critical software.
- Document each rule you add—reason, scope, and who authorized it.
Transition plan:
- After resolving obvious false positives, move pilot group to enforcement mode.
- Continue monitoring closely and keep a rapid rollback plan.
- Expand to larger groups incrementally, repeating monitoring and tuning at each stage.
6. Operational best practices
- Least privilege: ensure users do not run with unnecessary admin rights to reduce the likelihood of bypassing controls.
- Change control: apply a documented change process for adding/removing rules. Include testing and approvals.
- Patch management: keep OS and applications up-to-date—Anti-Executable is not a substitute for patching.
- Application lifecycle: maintain a catalog of approved applications and update rules when software is updated or replaced.
- Regular reviews: quarterly review of allowed/blocked lists to remove stale exceptions.
- Incident response integration: feed Anti-Executable logs into your SIEM or incident response process to detect suspicious activity and investigate blocked attempts.
- Backup policies and rule exports: regularly export configurations so you can restore settings quickly after failures.
7. Troubleshooting common issues
- Legitimate app blocked after update: verify whether hash changed; replace hash-based rule or add publisher rule if appropriate.
- Too many false positives: switch to audit mode, expand publisher rules, or temporarily allow by user/group while investigating.
- Performance concerns: confirm endpoints meet system requirements; exclude real-time scans on highly transient folders if safe to do so.
- Remote workers: ensure managed clients can reach the management server or implement local policies for offline operation with periodic sync.
8. Example rollout timeline (simplified)
- Week 0: Planning, inventories, licenses.
- Week 1: Install on pilot group in audit mode.
- Week 2–3: Monitor logs, create/adjust rules.
- Week 4: Move pilot to enforcement mode; continue monitoring.
- Weeks 5–8: Gradual expansion to additional departments, repeating tuning cycles.
- Ongoing: Quarterly reviews and continuous monitoring.
9. Security considerations and limitations
- Anti-Executable is focused on preventing execution of unauthorized binaries and scripts; it complements but does not replace antivirus/EDR or network controls.
- Advanced threats may attempt to abuse trusted, signed applications (living-off-the-land). Monitor behavior, not only execution.
- Rely on multiple rule types (publisher, hash, path) to balance security and manageability.
10. Documentation and training
- Provide end-user guidance explaining why certain apps may be blocked and how to request exceptions.
- Train helpdesk staff on reading logs and applying temporary exceptions.
- Maintain an internal knowledge base with common false positives and resolutions.
11. Checklist (quick)
- [ ] Inventory installed software.
- [ ] Create pilot group.
- [ ] Install in audit mode.
- [ ] Build initial allow lists (publishers, hashes).
- [ ] Monitor and tune for 2–4 weeks.
- [ ] Move to enforcement gradually.
- [ ] Integrate logs with SIEM.
- [ ] Schedule quarterly reviews.
Faronics Anti-Executable Standard can significantly reduce the attack surface when deployed with a cautious, measured approach: start with visibility, build precise rules, pilot widely, and operationalize with change control and monitoring.