topic Re: CSA 5.2 and SAS Institute problem in Network Security

CSA 5.2 and SAS Institute problem

Rene Rolsted — Sun, 10 Mar 2019 11:02:49 GMT

I have read in the book â€Advanced Host Intrusion Prevention with CSAâ€ some applications , CSA can , at times look like a debugger trying to interfere with the licenseing code, and some crash.

You can work around this situation by implenting a simple policy changes that adds the application in question to the builtin CSA application class called <Processes Requiring Kernel Only Protection>. Subsequent runs of that application do not trigger this particular issue, and the application is allowed to run correctly.

But how could I add a application to the builtin CSA application class called <Processes Requiring Kernel Only Protection> ?

We have a problem with SAS institute

Re: CSA 5.2 and SAS Institute problem

tsteger1 — Fri, 28 Mar 2008 16:51:39 GMT

Create an application control rule that triggers whenever "any application" tries to run "SAS institute"

Set it to take the action "add new process to application class" and add it to the dynamic application class "processes requiring kernel only protection".

Tom

Re: CSA 5.2 and SAS Institute problem

chickman — Sun, 30 Mar 2008 18:58:14 GMT

Great explanation!

Re: CSA 5.2 and SAS Institute problem

tsteger1 — Mon, 31 Mar 2008 16:09:04 GMT

Thanks Christopher. Let's hope it works...

Tom