Application Control

Application control is a process in which security administrators can limit or completely restrict users’ access to unwanted/untrusted applications. Some application control systems also allow security administrators to configure the control settings even granularly so that an application can be made available to some users, while restricting the access to same application for other users.

Application control works according to the policies that security administrators create and configure according to the requirements of the organization. A good example can be that with the help of application control system, security administrators can restrict users from accessing social networking sites like Twitter or Facebook, while allowing them to access YouTube during working hours.

Application Control Process

As discussed above, application control system works on the policies that security administrators create to restrict or allow certain applications. When such policies are created and applied, and when the application control system receives application traffic, the received traffic is verified using Deep Packet Inspection (DPI) and Deep Flow Inspection (DFI) processes. If the received application traffic is found to be inappropriate according to the configured application control policies, the traffic is blocked, hence restricting the application for entire network, specific users, groups or subnets. On the other hand if the traffic is found safe, it is allowed to pass through the application control system, hence making the application accessible to the users.

Usage Monitoring and Logging

A sophisticated application control system allows security administrators to regularly monitor and log the usage of applications in a network. With the help of regular monitoring and logging, security administrators can assess overall bandwidth consumption caused by the culprit applications. This further helps them take appropriate actions (restricting/allowing the applications for certain users or for everyone) in order to improve the productivity of the organization.

Security administrators can configure monitoring and logging even more granularly so that they can assess the consumption of a particular application on per user basis. For example, administrators can configure monitoring and logging in a way that they can see which user is consuming how much of available bandwidth while using Skype, YouTube or Facebook.

Almost all application control systems are also capable of logging the success or failed attempts made to access the applications for which policies have been configured. This allows security administrators to assess and identify doubtful activities of culprit users.

Most Common Application Control Policies

In most organizations, security administrators consider creating and implementing the some important application control policies in order to extract the maximum outputs by allowing end-users to focus on their works, and without wasting network bandwidth. The most configured and implemented application control policies include:

• Global Policies – Global policies are configured by security administrators when they want to restrict unwanted and/or bandwidth intensive applications for all users in the entire enterprise. Examples of such applications can be Web 2.0 applications such as Facebook, Twitter, Skype, etc. When global policies for unwanted applications are configured, users using computers that belong to that security scope are restricted from accessing the target applications.
• User Specific Policies – Some sophisticated application control systems also allow security administrators to allow or restrict applications on per user basis. For example administrators can restrict Skype for all users in a network, except for user A, who belongs to international sales department.
• Group Specific Policies – Using advanced features of some latest application control systems, security administrators can allow or restrict applications on per group basis. A group can be thought of as a container that contains multiple user accounts. When an application control policy is applied on a group, all user accounts that belong to that group get affected with that policy. In case the same application control policy is to be applied on any other user account, administrators are just required to add that user account to the pre-existing group on which the required policy has been already implemented. This saves security administrators’ decent amount of time.
• Network Specific Policies – As the name suggests, administrators can configure network specific policies to restrict or allow the selected applications for the entire subnet. Such policies are mostly configured in the organizations that have multiple subnets which are allocated to different departments of the organization. For example, security administrators can allow the entire international sales department that belongs to 192.168.10.x subnet to access Skype, while restricting all other users of other departments from accessing the same application.

In all, application control system helps organizations a great deal by preventing users from accessing unwanted applications, websites, etc., hence remarkably increasing their productivity.