Introduction

Secure4U is a tool that gives the system administrator the possibility to implement the organization’s security policy on each workstation, by enabling him/her to control the access rights of any application, known or unknown.

Through the rapid growth and increased use of e-mail and Internet, numerous applications are now spread worldwide by unsuspected users such as ActiveX, Java and Trojans, etc. without the control of the system administrator. Just mentioning Love Letter, WinExplorer.zip or Back Orifice visualizes this threat.

The majority of today’s most active Internet sites use active content to enhance their presence. Active content can be described as extensions to build additional capabilities into the Web browsers (e.g., menus, spreadsheets or animations). To create active content , new types of executables (ActiveX , Java ) are used in binary form. As a result, new security issues are rising. If your Web browser finds a reference in the page you are viewing, it automatically downloads the active content (often from unknown or unrecognized sources) and executes the code. Through the spread and use of e-mail, numerous unknown/unrecognized applications are spread throughout the world started by unsuspicious users creating substantial threats to their own computers and corporate networks.

This received unknown content might include malicious or hostile code, which can damage resources on your computer and/or network. It can also scan, copy and send out files or information, and simply make your computer unusable for your daily work. Secure4U can proactively protect you from both active content (ActiveX, Java, Java Script or VB Script) as well as any other mobile code (any unknown executable) introduced to your system.

Classic firewalls, acting as gateways to the network and virus scanners cannot proactively protect you against these threats .

Functionality of Secure4U

Secure4U is the first commercially available security solution to protect workstations and networks against attacks from any kind of active content (ActiveX , Java and other executable code) received from the Internet or any other domains .

With Secure4U you can create a closed environment (sandbox) around any application (known or unknown) and restrict its access to your computer’s resources. Within this closed environment any code can run and access calls of the application to system resources. Drivers, the registry database (all configurations), and the file system are shielded and constantly monitored to protect the privacy and integrity of your system.

When installing Secure4U, the program scans the workstation for already installed or known applications. In addition, it sets up pre-configured default sandboxes around the most common Web browsers (Netscape and Internet Explorer), email clients (Outlook, Outlook Express and Lotus Notes), and a restricted area for unknown applications (high restricted application group).

Secure4U checks for application activities and does not base its security mechanism on a comparison with a database of hostile applet references. It checks all actions and access to resources, but only suspicious or unwanted actions are blocked. Hence, it is the first commercially available behavior checker, which not only protects against intended hostile attacks, but also against unintentionally buggy applications. Any other application within your user environment can run and access resources without being restricted by Secure4U. You can view which components are installed and running on your computer, where they came from, monitor what an application does, and which resources it accesses.

Secure4U adds a security perimeter within a Windows workstation, transparently layers it into your operating system. With this security, Secure4U protects against flaws and holes within the security mechanisms of the Web browser and the Java virtual machine.


Protection Overview

Resources Protection

Secure4U protects the following resources within your computer against unwanted and suspicious accesses and changes:

The registry

Windows operating systems save the system and application configurations within the registry database. If a hostile applet changes settings within the registry database, it might leave applications or your entire system unusable. By changing the registry database, a hostile applet can also gain unwanted access to resources on your computer.

Access to services

Secure4U monitors all access to system services issued from restricted applications. By changing the settings of particular services (stopping or accessing certain services), a hostile applet can make your computer unusable or gain unwanted access to resources and data.

Dangerous calls to the system

Some functional interface of the system is intended for Windows internal or some special application use only. There is no reason for these to be used in normal circumstances. Also, dangerous device access is protected. Secure4U restricts the availability of these system entry points for restricted applications.

Access to the file system

By accessing the file system, an applet gains access to all your data and files. Secure4U can restrict access to the file system depending on its configuration . In a typical scenario, you might want to set up a directory for saving information received from the Internet while blocking access to all other areas for your Web browser.

Access and monitoring of IP ports and IP addresses

Secure4U can monitor access to IP ports by restricted applications. By using certain IP ports an applet can e-mail information to the Internet or connect using any other protocol.

Spawning of processes control

Secure4U can prevent starting another application from a restricted one or force inheriting a restricted application secured environment. This can prevent misuse of trusted applications by hostile code.

Content Filtering, Viruses

With Secure4U, you can manage and protect your computer from all installed ActiveX and Java applets. Secure4U will safeguard your computer when a new applet comes on board and becomes active. In the case of ActiveX, you can find out who created the applet, if the applets properties are correctly filled out, from which site it was downloaded from, and how it interfaces with your system. Also, any installed ActiveX can also be deleted.

Scanning for viruses

If you have a virus scanner installed that Secure4U supports, all CAB files received through your Web browser will be opened and scanned for viruses before they are installed on the computer. To undertake the actual virus scanning process, Secure4U calls a virus scanner installed on your computer through an API or command line. A number of the most common virus scanners are supported. In addition, user–defined custom virus scanners can be used with command line parameters. Even if your virus scanner does not offer command line support it will work with Secure4U.

Cache management

Cache Manager is completely integrated into the Secure4U environment. Cache Manager allows the automatic removal of session information in the browser cache.

Cookie management

A cookie-manager is included to allow the blocking, removal and management of all cookies for all users / profiles on a computer and to restrict cookie placement by Web site/URL.

WWW and e-mail content filtering

To increase security, web pages with unwanted information (e.g. active content) or outgoing e-mails containing confidential information can be blocked.


Administration Tool Overview

The Secure4U Administrator Tool provides the interface that allows the administrator to interactively configure all parts and components of Secure4U. It is divided into two parts: Sandbox & Firewall and Content Filtering. Sandbox & Firewall is also divided into an Easy and an Advanced Mode.

With the Secure4U Administrator Tool you can configure Secure4U. The Secure4U Administrator Tool scans your system for installed applications and sets up default settings for the most common Web browsers and e-mail clients. A typical installation of Secure4U will only take a few minutes to complete.


The Menus

The following menus are currently available in the Secure4U Administrator Tool:

  • The File Menu
  • The Edit Menu
  • The View Menu
  • The Help Menu


The File Menu

The following commands are available on the File menu:

  • Save local configuration
  • Restore local configuration
  • Restore default configuration
  • Change password
  • Exit

Save and restore local configuration

You can save your current or more configurations and later restore them by selecting the save or restore local configuration command on the menu displaying the configuration manager dialog:

Type the name of the configuration you want to save in the Configuration label box. This activates the Save button and the configuration can be saved. To return to this configuration, select it in the dialog and click the Restore button.

Restore default configuration

This command restores the system configuration back to the original configuration that applied at setup.

Change password

You can block the access to the configuration Administration Tools by choosing your own password. When typing the password, leave the column with Old password empty and fill in the rest. If you want to unblock the access, write the password in the Old password column and leave the rest empty.

Exit

This command ends your administrator session and saves all configuration changes.


The Edit Menu

The following commands are available on the Edit menu:

  • Enable Secure4U

  • Disable Secure4U

  • Create new Application Group

  • Audit

  • Execution settings

  • Options

Enable/Disable Secure4U

You can enable or disable Secure4U by selecting Enable Secure4U or Disable Secure4U on the Edit menu. Disabling will stop all prevention and monitoring. Enabling allows the prevention and monitoring in accordance with the personalized settings.

Note! When Secure4U is disabled, it happens immediately. When you enable it, on the other hand, you need to restart the restricted applications in order for the change to take effect.

Symbol | Status | Note
 | Green | This is the normal mode and Secure4U is enabled.
 | Red | This indicates an active connection to the Internet and active Secure4U.
 | Gray | If the Secure4U tray icon is changed to a gray color, then Secure4U is disabled.

Create new Application Group

Please see the chapter Advanced Mode / Creating an Application Group .

Audit

Execution Settings

For the different appropriate application groups, it is possible to disable (e.g for performance reasons) functional blocks.

If certain security checks are not needed, you can disable them. We advise caution when disabling as it can disable vital parts of Secure4U for restricted groups. When an item in execution settings is turned off, the particular feature in Administration tool is disabled

Kernel mode engine
  • Registry guard – guards access to registry information
  • File guard - guards access to file system
  • Process spawning guard – guards the application spawned (called) by other application
  • TCP/IP guard – guards the TCP/IP ports and IP addresses.
  • Dangerous device access guard – guards the items below written
    • Dismount volume
    • Lock volume
    • Set compression
    • Unlock volume
    • Disk eject media
    • Disk format tracks
    • Disk load media
    • Disk media removal
    • Disk reassign blocks
    • Disk set drive layout
    • Disk set partition info
    • Disk verify
    • Serial lsrmst insert
  • Checksum guard – protects executables from replacement. The replaced file can have the same name, but Secure4U will still recognize that it is not the original one. If you have this feature turned on (by default it is disabled), please be aware that it will enforce some restrictions – e.g. Secure4U may block the installation of a service pack or update of some software. If you update the guarded file, please recalculate the checksum (see Applications Groups chapter). Otherwise the application will be treated as unknown and therefore high-restricted and an alert message will be displayed.
System – user mode engine

See the chapter Miscellaneous in System .

HTTP filtering - user mode engine

See the chapter Content Filtering .

Options

Process spawning dialog

Show dialog when unknown process is executed – if this feature is set, the user can move a new application to an application group without the need to run the Administrator tool. On the first start of a new application, Secure4U will display a dialog for a user to choose to which application group, representing security level, should be the application assigned to. It can be controlled, to which application groups have the user permission to assign the new unknown application.

Networking properties

Treat network applications as unrestricted – all applications running from other computers in a local network are treated as unrestricted.

Do not resolve network drives to UNC – If you have a mapped network drive, then Secure4U will by default resolves it to the UNC path in the Administration tool as well as in the Secure4U engine itself. You should enable this feature, if you want to avoid this behavior. (In networks with Novell . file servers this option can be useful).

Miscellaneous

Integrate the Secure4U menu into Windows Explorer context menu on executable files – This feature allows moving executables among Secure4U application groups in the Windows Explorer without the need to run the administrator tool. If you right click an executable file, a pop-menu will be shown. In the Secure4U submenu you can choose the new security group for this application.

Treat System Applications group as a regular group – if not selected (default) the applications in the System Application group can neither be moved into or out from the group nor can any access restrictions be set for them.


Audit Settings

Audit

You can write monitored events into a file and view them on the local computer.

In the first panel of Audit Settings, you can set a log file directory.

In the Logwrite interval field it is possible to set the number of monitored events (entries) which are cached before a write entry is made to the log.

Audit levels

Here, you can redefine auditing levels and actions.

For the specific audit level, choose a level name. Once the level has been named, assign the different actions for that level. Some audit levels are the same, but you can redefine them.

Note: By default a higher number results in higher auditing.

It is not possible to restore the default state. The default state is written below.

The default states are:

Nr | Name | Description
0 | Ignore | No audit
1-2 | Activity Window | Activity Window
3-4, 7 | Log to File | Activity Window, Local file logging
5, 8-10 | Log to File | Activity Window, Activity window forced on top, Local file logging
6, 11 –15 | Local Alert | Activity Window, Local file logging, Message box to user

It means

  • Activity Window – auditing messages are displayed in the activity window
  • Activity window forced on top – by this action the activity window is shown on the top of all windows
  • Event Log – sends a message to the Windows NT/2000 application event log
  • Local file logging – write events to a specific file
  • Message box to user – message box on local computer is displayed

All changes become active immediately.

Audit Analyzer

XML format is used. Internet Explorer 5.0 or higher and any other application supporting the XML format can view the created files. There is also an XML script file (all.xml) available in the logging directory to filter and analyze the created logs. The File accesses, Registry accesses, Applications usage, IP ports, URL list (web pages visited) and other object types can be separately displayed through a custom filter.

Note! Only actions set in the audit levels to be handled as Local file logging are displayed in the local Log Analyzer.

System Messages

You can also set audit level to the following events:

Name | Default Audit Level
Start of application | 7
End of application | 1
Enable/disable Secure4U | 7
URL change | 3
WWW content filtering | 3
E-mail filtering | 3
Warning messages | 1
Information messages | 1
Spawning in parent sandbox warning | 6


The View Menu

You can use the commands on this menu to customize the Secure4U administrator interface. The following commands are available:

  • Toolbar

  • Status Bar

  • Easy Mode

  • Advanced Mode

  • Refresh

Check these commands show/hide the toolbar or the status bar, switch between easy and advanced mode and refresh displayed data.

Toolbar

The toolbar includes four icons. The first one lets you create a new application group. The second one is used to enable/ disable Secure4U. The third one switches the Administration Tool between Easy and Advanced Mode. Clicking on the fourth one displays the About box for the Secure4U Administrator Tool.

Status Bar

The status bar is displayed in the lowest part of the window and displays the status of each command in the menus, status of Secure4U and key settings (Caps Lock, Num Lock and Scroll Lock).

Easy Mode

Select this command to switch the Administrator Tool to Easy Mode.

Advanced Mode

Select this command to switch the Administrator Tool to Advanced Mode.

Refresh

Select this command to refresh the current view.


The Help Menu

The following commands are available on the Help menu:

  • Help Topics

  • Secure4U on the Web

  • About Administration Tool

Help Topics

You can search for a help topic in the online help. For additional help we recommend you consult this User Manual, consult the FAQ on our Web site or contact us directly at support@Secure4U.com.

Secure4U on the Web

This command contains two hyperlinks, one to Secure4U’s home page.

About Administration Tool

The Secure4U version is displayed here.


Easy Mode

Easy mode Configuration

Easy Mode provides an interface for Sandbox & Firewall components that makes it easy to change the security level of the included pre-configured applications. However, the simplicity provided by this tool may be insufficient for some requirements. This is why an advanced mode is included.

The Easy Mode Administration window includes three administration groups on the left:

  • Preconfigured Applications

  • Groups

  • Directories


Preconfigured Applications

This Secure4U component lets you change the security level for some predefined applications: Outlook, Outlook Express, Internet Explorer, Netscape Communicator and Lotus Notes. You can select one of the following security levels for each pre-configured application.

Security Levels

High

This is the highest security level offering the best protection.
Safe spawning is used. When using safe spawning the unrestricted application inherits the restricted application’s security environment. Because of this, the spawned application may not have access to all necessary resources.

Access is granted only to a very limited number of directories (e.g. Downloads) and registry keys.

IP ports are very restricted.

Note! This might cause a problem when downloading items from some Web sites or if entering through a firewall. If this is the case, please lower the security level temporarily. Always make sure that you only download applications you trust!

Medium

When an unrestricted application is spawned, it does not inherit the spawning application’s security environment. Read access to files except confidential directories. Write access is granted to a very limited number of directories. (e.g. Downloads)
Registry read access to all apart from a few items.
Less restricted IP ports security.

Low

Full access to files except confidential, risk and system directories.
Full access to the registry apart from a few items that are read-only.

None

No restrictions on the application. We recommend only temporary use of this level.

To apply the new settings click Change Security Level button.

The protection for each level depends on the setting of a pre-defined database. If you need to change the access rights of a pre-configured application, you need to switch to Advanced Mode.

Note! The security is indicated by a color bar. The red color means low protection (dangerous), the blue color means high protection (safer). The custom level is represented by red-blue-red color.


Application groups

Selecting Application Groups in the pane on the left displays the following window. Here you can set the security level for any known application. The security levels are the same as described in pre-configured applications.

Note! Because the security levels are fixed, an application might not work properly when it is restricted. If you need the application to have different access rights, then you can set this in Advanced Mode.

Middle pane

The middle pane displays four groups of applications. Each of these represents a pre-configured security level:

  • Unrestricted

  • Low Restricted

  • Medium Restricted

  • High Restricted

During installation, the software scans the applications installed on the computer (except for the pre-configured applications) and places them into the unrestricted applications group. All unknown applications added to the computer after installation of Secure4U (e.g., downloaded executables from the Internet or received by e-mail) are automatically put into the high-restricted applications group. They can subsequently be put in any of the above security levels.

When you right-click on the High Restricted Applications group, you can Search for Unknown Applications on all local drives.

Right Pane

By selecting a group in the middle pane all its applications are displayed in the right pane.

Right-clicking the application displays a popup menu where it is possible to Add application, Add all application in directory, Add all application in sub-tree to the group, move application to the different group in middle pane or remove applications from the group. Removed application can you find by Search for unknown applications on all local drives (Right-click on High restricted application).

You can also drag and drop the selected application to the desired group in the middle pane.


Directories

This component allows you to specify which directory can be accessed by a restricted application. You can select the (unprotected) directories to be used for data from the Internet. You can also specify which (confidential) directories you want to hide from restricted applications. Selecting Directories on the left displays the following window:

Pane | Access | Note
Unprotected | All applications | All applications on the workstation have access to these directories. We recommend that you add only folders without important data to these directories, e.g., folders for temporary use.
Confidential | Only unrestricted applications | Only unrestricted applications have access to these directories.

Access to all other directories depends on the preset database's setting, the High to None security level, you can set for a restricted application.

Note! These directories were set during the installation process. It is possible enlarge the unprotected or confidential directories for other folders.

Adding and deleting directories

You can add a directory to the unprotected or confidential directory by clicking Add in the top right corner of the relevant directory pane. Selecting a directory and then clicking Delete removes the directory from the pane as well as any files it contains.

Tip! If you have data in a confidential directory that needs to be accessed by a trusted restricted application, it is better to move the application to the Unrestricted Applications group and then access the folder, instead of moving the folder between confidential and unprotected directories. By doing this, you prevent all applications from having access to the folder.


Advanced Mode

Advanced mode Configuration

Advanced Mode provides an interface in which you can configure the access rights of any application on the workstation.

The Advanced Mode Sandbox & Firewall window has seven administration groups on the left:

  • Application Groups
  • System
  • File Security
  • Registry Security
  • Firewall
  • Virus Scanning
  • Learning Mode


Application Groups

Applications Groups

Application Groups have a similar set up to Application Groups in Easy Mode . In addition to the preset security levels, individual groups for all restricted applications can be created.

The configured application groups can be split into different categories. The first category groups are with various security levels (unrestricted, low, medium, high restricted).

The second category groups are specifically designed for appropriate applications like Outlook, Internet Explorer, Netscape etc.

The third category groups are designed for special purposes:

MS-DOS Applications | Contains all 16-bit applications, default security is set to none on Windows 9x/ME platforms.
Command Interpreter | Contains command interpreter cmd.exe. In Windows 9x/ME the command interpreter command.com is a part of MS-DOS Applications group.
Harmless Application | This group should contain applications, which can be safely spawned from other applications. The default settings for this group are similar to Unrestricted Applications group.
Installation Applications | All applications spawned from an application in the Installation Applications group have the same security level as the spawning application (which is usually unrestricted access).
System Application | Contains critical applications to run the system. Unless "Treat System Applications group as a regular group" is checked (default is not selected), in the Options , the applications in the group can neither be moved into nor out from the group nor can any access restrictions be set for them.
Windows Shell | This group contains the explorer exe. If you browse the internet through clicking on the internet icon within the Windows Explorer, "Microsoft Internet Explorer" security settings are applied as long as you are browsing (without memory, window number limit, shutdown, keystrokes and force process/thread termination protection). Otherwise the "Windows Shell" settings are used. You can avoid this sandbox switching by moving explorer.exe from the Windows Shell application group.
Visual Basic and Java Scripts | Access restrictions for the script.exe in order to handle attacks by dangerous scripts.

Note! For Installation Applications and Harmless groups all security components are disabled. This state can be modified, please see Execution Settings .

Creating an application group

To create a new application group, click Create New Application Group on the Edit menu or right-click an existing application group and select the command on the pop-up menu. The following window is displayed:

Enter the friendly name of the application group, i.e., Office, and specify whether the group is to be Restricted or Unrestricted. You can reconfigure the application group later. When selecting Next the following window is displayed empty:

You can add one or more applications to the application group by clicking Add in the top right corner of the pane. To remove an application from the pane and group, select it and click Delete. Then click Finish. Your Application Groups window might look like this after creating a new application group named Office and including, for example WinWord, MS Access and the Graph application in the group.

In the Secure4U Administration tool, the application group can be renamed in the Application Groups configuration by selecting the appropriate group and pressing the F2 key or by clicking twice on the desired group. Not all of the application groups can be renamed.

If you right-click an application group a pop-up menu is displayed. There you can select between:

  • Create Application group
  • Remove Application group
  • Export Application group
  • Recalculate checksum for application – this will create a new checksum for all applications in the selected group and must first be allowed in the Execution Settings .
  • Search for Unknown applications (in High restricted application group only) – this will find you all application that are not handled by any other application group.

Note! If you choose to remove an application group, all its contained applications will, as a security measure, be treated as high-restricted (unknown) applications by the system. Consequently, it is advisable to first move the applications within the group to another pre-selected group.

Add an application to the correct group

In the right pane, you can view all the applications in a selected application group.

Right-clicking one of the applications in the pane on the right lets you add/remove/move an application to the group.

On this menu you can:

  • Add application

  • Add all applications in directory

  • Add all applications in sub-tree

  • Move application to any of the groups displayed on the pop-up menu

  • Remove the selected application.

You can also drag-and-drop the selected application to the desired group in the middle pane.

Note: If you want to add an application from a hidden share, you have to select Add application and type the path manually.


System

This configuration component lets you enumerate and set up access rights for core system components and functions (i.e. system shutdown access). You can also limit the resource quotas of applications for the number of windows and the amount of memory they can use.

To set up the system configuration component, select System in the pane on the left. Four branches are shown in the middle pane:
  • Services (not available for Windows 9x)
  • Devices (not available for Windows 9x)
  • Process Spawning


Services

To set up access rights for services, select Services in the middle pane. The Administrator Tool will display the settings for the selected application group in the pane on the right.

Access possibilities

You can choose between four major accesses right alternatives in the top part of the pane on the right:

Free, unlimited access

This access type gives free access by default to all the objects within the file system or to the selected drive.

Read-only access

This access type gives read-only access by default to all the objects within the file system or to the selected drive.

No access

This access type blocks access by default to all the objects within the file system or to the selected drive.

Custom access

With this access type you can fine grain access rights and Secure4U actions by combining different access rights and Secure4U activities to a custom access type. The lower part of the dialog features three tabs for access, monitor and ask user actions.

The box includes all the available options for each of the tabs. These settings are based on the settings Windows NT/2000 uses for object access security. On the access tab you can set access restrictions to specify whether and how a restricted application is allowed to interact with an object . On the monitor tab you can set up the actions to be displayed in the activity window. In addition, on the ask user tab, you can set the level of interactivity will use – in other words, the actions for which Secure4U will issue a prompt before committing its activities, i.e. before performing a specific access request.

Note! In Windows 9x/ME the ask user feature is not always available for all objects.

In the right-hand part of the pane, you can specify how the file restrictions are applied – upwards or downwards in the file tree:

  • Inherit permissions from parent

The object has the same security permissions as the parent. Changing the parent’s security setting will thus cause the object's security permissions to change too.

  • Replace permissions on sub objects
    • Force inheriting from parent

All permissions for the sub tree are replaced with the parent's security settings and have the inherit permissions from parent flag set.

    • Create own explicit permissions

This setting forces all sub objects (one level down only) not to inherit the security permissions from the parent. Hence, if the security permissions are currently the same as the parent and you change the parent’s security setting, then the sub tree permissions of existing objects remain unchanged when explicit permissions for these objects are created.

Symbols on directory

The different colors for each folder allow identify a different access type.

Color | Access
Red | No access
Blue | Read only
Yellow | Full
Orange | Custom

The small rectangle present on a folder icon marks a folder/registry key that does not inherit security from its parent folder/registry key.

The small star indicates the rectangle somewhere in the folder/registry subtree. It means that some or all the files or folders in the sub tree have different settings than this specific object.

Note! Click Set to apply the new settings. All changes to the access restrictions become active immediately after a change.

Audit

Secure4U allows you to set the auditing level for each object, which defines what to do with the monitored accesses (e.g. display it in Activity Window, log it to a file). By default the higher the number, the more complex the auditing will be. However, the administrator can customize all audit settings to his wish in the Edit Menu. For details please see the chapter entitled Audit in The Menus .

Access alternatives

The lower part of the pane features three tabs: access, monitor and ask user. On the access tab you can set access restrictions to specify whether and how a restricted application is allowed to interact with a service . On the monitor tab you can set up the actions to be monitored. The Audit level defines what will be done with the monitored events (e.g. displaying in Activity Window, logging into file etc.). In addition, on the ask user tab, you can set the level of interactivity. In other words, Secure4U will issue a prompt before performing a specific access request (for details please see the chapter Secure4U Alert ).

Click on the flags to toggle between yes and no access for the application group.

Note! Click Set to apply the new settings.

The seven service access alternatives are:

  • Query service status
  • Start service
  • Stop service
  • Remove service
  • Open service
  • Install service
  • Control service

Note! For more details about the shown services please look into the Windows component services (Start -> Settings -> Control Panel -> Administrative tools -> Component Services -> Services (Local) (Valid for Windows 2000).


Devices

In this component the access to system devices can be set (for example to CD Rom, ISDN, Com and LPT port). Only devices present on your computer are displayed.

Configuration is similar to that of Services.

Note! This is the Windows NT/2000 feature only.


Process Spawning

Spawning means that the spawned application inherits the security environment of the application that invokes the spawned application. For Example: In Outlook (the spawning app), you may receive an email with a word document. If you choose to open the attachment file, the outlook will call the Microsoft Word program and send it the attachment document. The Microsoft Word is then spawned application.

For every application group you can specify the spawning mode (allow, monitor, ask user and prevent – see Access possibilities ) and the sandbox type (parent or own). If you choose parent sandbox, the spawned application will inherit the security environment of the parent process. The own sandbox results in using the application’s own security settings. The later is similar to a situation where the application is started by a user and not from another process. You can change the status by a right-click on the group name and select your four alternatives in the pop up menu. For every application group you can specify the spawning mode.

Default process means other application groups than these included in the list (e.g. application groups added in the future).

Note! By default, some groups have disabled the changing of spawning properties. You can permit it in the Execution Settings but recommend keeping the default setting. Changes to the access rights can lead to potential problems with the applications you are restricting. An application will not run if it is too restricted!


Miscellaneous

The miscellaneous access rights are set up in a similar manner to the access rights for services. Select Miscellaneous in the middle pane for the Administrator Tool to display the selected application group’s access rights in the pane on the right.

Seven access types are available for the selected application groups. To change a setting for an access type, right click and select the required action on the pop-up menu.

Setting | Secure4U activity
Allow | All access will be granted
Monitor | All access requested of this type will be monitored
Ask User | The user will be asked before granting or blocking access
Prevent | All access requests will be automatically blocked and monitored.

In addition to the seven access types you can also set a memory and a Windows number limit.

System shutdown access

When this option is set, no system shutdown requests will be allowed to the selected application.

System low level access

When this option is set, a number of unusual application requests are not allowed from the selected application.

The following functions are blocked every time, if system low level access is prevented:

  • AdjustTokenPrivileges
  • SetFileSecurity
  • SetKernelObjectSecurity
  • SetServiceObjectSecurity
  • SetSecurityInfo
  • SetNamedSecurityInfo
  • SetUserObjectSecurity
  • CreateProcessAsUser
  • CreateProcessWithLogonW
  • SHCreateProcessAsUserW

The following are blocked if System low-level access is prevented and the function wants to work in other process than in the caller process

  • WriteProcessMemory
  • CreateRemoteThread
  • VirtualAllocEx
  • VirtualProtectEx

Dangerous device access

When this option is set, access rights requests, (e.g. reformat hard drive) are not allowed from the selected application.

Following device accesses are blocked:

  • Dismount volume
  • Lock volume
  • Set compression
  • Unlock volume
  • Disk eject media
  • Disk format tracks
  • Disk load media
  • Disk media removal
  • Disk reassign blocks
  • Disk set drive layout
  • Disk set partition info
  • Disk verify
  • Serial lsrmst insert

Simulate Keystrokes

This option can prevent an application from simulating keystrokes, and thereby causing destructive actions on the computer.

Forced process / thread termination

With this option is enabled all thread and process manipulation of the selected application group is restricted in accordance with the set policy .

Memory limit

With this number you can limit the amount of memory the selected application can allocate for its use. The number you enter here is the number of bytes that the particular application will be allowed to allocate before Secure4U will reject further requests for memory allocation from the program in question.

Limiting the amount of memory an application is allowed to use can protect against various denial of service attacks.

Window number limit

With this security option, you can limit the number of windows the selected application can open. The number you enter is the number of windows or controls, which the application will be allowed to open before Secure4U will reject further requests to open new windows from the program.

Limiting the number of windows an application is allowed to open will protect a program against various denials of service attacks.

Activating of changes / settings

Memory and Windows quotas become active after the application in question is restarted.

Note! Click Set to apply the new settings.


Files Security

File Security

This configuration component lets you enumerate and set up file system access rights for all restricted and unknown applications . On Windows 9x systems you can enforce file security compatible to Windows NT/2000 file access security.

The steps under Network Neighborhood for setting up network file and directory access are the same as for a local disk.

To set up the file configuration component, select File Security in the pane on the left. The local files on the workstation are displayed in the middle pane.

To display all the files within the drives/folders, right click Drives in the middle pane and choose Show File Restrictions on the pop-up menu.

Note! The File Security root defines also the Network Neighborhood’s root security!

If you change access to a particular computer, this will also affect the hidden shares that are not displayed.

Setting file access rights

Secure4U comes with pre-configured default settings for some applications. These default access rights settings are used when no other customized access rights exist. Follow the steps below to change the access rights for an application or application group :

In the local configuration branch of the configuration component tree, select the Files component to display a dialog similar to the one below:

The Administrator displays the directory tree in the middle pane. Select a directory or file to display the access right restrictions for the selected application group to the directory or file in the pane on the right.

This process is similar to file configuration.

Control of the right panel is similar as it is described in chapter entitled Access .

Windows security flags

Configured attributes relates with Windows NT security flags.

  • Full control = all accesses below
  • Read - display the file's data, attributes, owner, and permissions
  • Write - write to the file, append to the file, and read or change its attributes
  • Execute - execute an application or list a directory
  • Read file data
  • Write file data
  • Delete - attempts to delete.
  • Append data - to a file or add file to a directory
  • Read extended attributes
  • Write extended attributes
  • File Execute
  • Delete child
  • Read attributes
  • Read control - attempts to read security information.
  • Write DAC - attempts to modify the discretionary access control (DAC) list
  • Write owner - change the owner of the object
  • Synchronize - allow to use synchronization functions on this object


Registry Security

This Secure4U configuration component lets you enumerate and set up the registry database access rights for all applications . On Win9x systems you can enforce registry security compatible to the Windows NT/2000 Registry access security.

To set up the registry security component, select Registry Security in the pane on the left. The registry on the workstation is displayed in the middle pane.

Note! To display all the registry values in the registry, right click Registry in the middle and activate Show Value Restrictions on the pop-up menu.

Setting registry access rights

The options for the registry security settings are very similar to the settings for file security and are set in the same way. Secure4U comes with pre-configured default settings for some applications. The default access right settings are used when no other customized access rights exist. Follow the steps below to change the registry access rights for an application :

In the local configuration branch of the configuration component tree, select the Registry component to display a dialog similar to the one below:

The Secure4U Administrator displays the registry tree in the middle pane. Select a registry key or value to display the access right restrictions for the selected application group.

The process of configuration is quite similar to the file configuration.

Control of the right panel is similar as is described in the Services section.


Firewall

Secure4U includes two personal firewall components. This allows you to set the access rights of a selected application to:

  • IP ports
  • IP addresses


IP Ports

The Secure4U default access rights for restricted applications are intended to prevent all access to IP ports. Access to IP ports that are not visible in the Administrator Tool is received from IP Port root (default is prevented). Follow the steps below to change the setting for one or more restricted applications:

Select IP Ports in the middle pane. Double-clicking the IP Ports will display the number of pre-configured ports. The restrictions for the selected application group are displayed in the pane on the right.

Access possibilities

You can set one of the following access options to IP ports for the selected application group:

Free, unlimited access

With this option, the selected application has full access to the IP ports. Secure4U will automatically forward all requests from this application and will not display any messages.

Outgoing only

Application can connect to the IP port on a remote computer, but it cannot act as a server exposing the IP port to the network.

No Access

When this option is checked, Secure4U automatically blocks and monitors all access requests to ports from the selected application(s).

Custom access

Setting of access, monitor and the ask user is the same as in the chapter File Security . Outgoing security means connecting to a port on a different computer. Incoming enables other computers to connect to a port exposed by this application.

Audit level

You can set the auditing level for each port. For details, please see the chapter Audit in The Menus chapter.

Note! Click Set to apply the new settings. All changes to IP port restrictions are activated immediately after a change.

Creating a New IP Port Entry

Secure4U allows the creation of specific access restrictions to an IP port or range of IP ports not included in the current port component tree. To add an entry for a port number, right-click the IP Ports component root entry in the tree pane.

A pop-up menu appears with two alternatives: Add single port and Add port range. Select an alternative on the pop-up menu. A dialogue will be displayed in which you can specify the port number for the new port or port range.

Click Add to confirm your settings and add the new port/port range to the tree.

You can now set up specific access rights to this IP port for each of the restricted application groups.

Removing an IP Port Entry

You can also remove an IP port or range of IP ports. Right-click the selected port to display a pop-up menu with Remove explicit restrictions. Select this command to remove the IP port.

The sense of IP ports

Port

Keyword

Description

21

FTP

File Transfer Protocol

23

TELNET

Remote login

25

SMTP

Simple Mail Transfer Protocol

53

DNS

Domain Name Server

80

HTTP

Hypertext Transfer Protocol

110

POP3

POP3 (Post Office Protocol - v3)

119

NNTP

Network News Transfer Protocol

137

NETBIOS-NS

NETBIOS Name Service

138

NETBIOS-DGM

NETBIOS Datagram Service

139

NETBIOS-SSN

NETBIOS Session Service

143

IMAP

Internet Mail Access Protocol

443

HTTPS

HTTP protocol over TLS/SSL

1352

Lotus Notes

Lotus Notes

3129

Used by Trojan Horses often

8080

HTTP-ALT

HTTP Alternate

12345

Used by Trojan Horses often

12346

Used by Trojan Horses often

31337

Used by Trojan Horses often


IP Addresses

In order to restrict a user's access right to certain IP addresses , you can set up IP address ranges in Secure4U.

Follow the steps below to change the setting for one or more restricted applications:

Select the IP Address component in the middle pane. The restrictions for the selected application group are displayed in the pane on the right.

Right-clicking the IP Addresses component displays a pop-up menu with two alternatives: Add address range and Remove all ranges.

Add Address Range

The following dialogue is displayed when you select Add address range :

You are now able to insert the appropriate IP range or select Host name for Secure4U to get the appropriate IP address from the Internet. (This can of course only be done if the workstation already has access to the Internet.)

You can set one of the following access right options to the specified IP address range for the selected application group: Allow all access, Monitor access, Ask user for access interactively and Unconditionally prevent all access. These commands are similar to the above section described as system miscellaneous.

You can set the auditing level for details please see the chapter Audit in The Menus .

Remove All Ranges

Currently, you can only remove all IP Ranges at once.

Note! All changes for this Secure4U configuration component become active immediately.


Virus Scanning

Secure4U provides protection against malicious mobile code or “modern viruses”. These applications can actually cause even more harm than viruses in the traditional sense, i.e., I Love You and Back Orifice. Secure4U controls the access rights of a specific application, hence a virus that corrupts files “within” the application, i.e., viruses infecting only Word files “within” the WinWord Application are not combated with. Therefore, you should always use a virus scanner together with Secure4U. When set up correctly, Secure4U will communicate with the virus scanner on your workstation through command line parameters. To set this up on your computer, please select the Virus Scanning icon among the administration groups displayed in the pane on the left. The window is displayed in the middle pane:

Searching for Installed Virus Scanners

During installation, the Secure4U Administrator runs a full search of the file system to find any installed virus scanner(s) that can be used by Secure4U.

Selecting a Virus Scanner

The list shows the entire virus scanners pre-configured for Secure4U.

In addition, user-defined custom virus scanners can be used with command line parameters as described below.

Note! You don’t have to use Secure4U together with a virus scanner. Both products will also work independently of each other.

The virus scanners that Secure4U is pre-configured for but that have not been found on your hard drive(s) are grayed out in the list of available virus scanners.

When you right-click one of the listed virus scanners, it will be display the pop-up menu with the following options:

  • Add new Virus Checker

  • Delete selected configuration

  • Properties

  • Test run

Configuring a Virus Scanner

When you select the Properties command on the pop-up menu, Secure4U displays a dialogue similar to the one below (depending on the selected virus scanner):

You can review parameter uses to call up the selected virus scanner in this dialog .

Creating a Custom Virus Scanner

If you want Secure4U to call your virus scanner with different parameters or want to add a new virus scanner , select Add new Virus Checker on the popup menu.

Note! For custom configuration you can only use virus scanners, which can be run with command line parameters. The virus scanner must also provide a return value to tell Secure4U the status of the checked file(s).

In the dialogue you can add the parameters used by your virus scanner. To find out the parameters used by your virus scanner, please contact the developer or reseller of your virus scanner.

Note! The changes are activated immediately.


Learning mode

The Learning mode creates security groups for new applications. Once you begin the learning mode process, it traces all requests and demands from the registry, file, ports, etc.

To use the learning mode, you must first specify the name of the application group that is going to be created. You may then select the group and begin the learning mode.

During the learning mode, you should perform all the actions you want to do with the application in the future. To quit the learning mode, press the stop button.

After the learning mode has finished, Secure4U will ask you if you would like to create a new group. Once you have created the group you need, check the group settings. The longer you let the learning mode run and “learn”, the more effective and efficient it is.

Note! Currently only direct accesses to a single file are recorded. Therefore it is easier to set write access to a specific directory directly in the “File Security” part of the Administrator Tool after stopping the learning mode.

A special format text file with the security profile is created in a “Learning Mode” subdirectory under the installation directory.


Content Filtering

Select the Content Filtering bar in the pane on the left of the Administration Tool to display the cache and cookie configuration tools. The window displays seven administration groups displayed on the left.

  • Cache Configuration
  • Cache Editor
  • Cookie Configuration
  • Cookie Editor
  • Typed URLs
  • WWW Content Filtering
  • E-Mail Filtering

Cache is the HTML and GIF files shown by your browser when you access a Web page, for example. Cache contents are automatically downloaded and stored on your computer, together with all web page components. As a rule, each file arriving on your computer is stored in a specific cache file. If not deleted from time to time, the cache can take up a lot of memory space on the computer. In addition, Internet sessions can be tracked via the stored cache files thus posing a threat to your privacy.

Cookies are text files, not programs, which are written to the local drive of the client visiting Web sites. Web sites use cookies to store information in order to keep track of user activity. Since cookies are not executables, they cannot themselves launch an attack. However, any other Web site can retrieve the information stored by a cookie through a script or ActiveX control. Apart from being an intrusion on your privacy, this confidential information can be used to monitor your behavior, collect passwords, etc. that could be used for criminal purposes.


Cache Configuration

The Secure4U Cache Configuration Manager allows session information to be removed automatically from the browser cache file. In the Configuration pane, you can choose to save cache from a specific or all URLs. Secure4U displays the following window when you select the Cache Configuration component in the configuration tree:

In the Configuration pane you can add the URL(s) that you do not want to be deleted (in the example above it is www.Secure4U.com) when the logon session ends. Activating the Do not delete cache box prevents any cache from being deleted.


Cache Editor

If you are using more than one Web browser, you can select which one you want to display the cache from in the Cache Editor as well as from which local user using this Web browser. The browser and the user are selected from drop-down lists.

The cache is displayed in four columns in the lower part of the window:

  • Local File Name

  • Source URL

  • Last Access

  • File Size

Selecting and right-clicking a cached file displays a popup menu with the following commands:

  • Execute

  • Delete selected item(s)

  • Delete all listed items

  • Properties

Execute

Use this to display the file.

Delete selected item(s)

Use this to delete the selected item(s) irrevocably.

Delete all listed items

Use this to delete all listed items irrevocably.

Properties

Use this to open a dialog with the properties of the cached file.

Show Filter

When you check the Show filter box, the filter directory is displayed in a new pane on the left. Select the filter folder to list a number of file folders:

  • Text
  • Application
  • Audio
  • Image
  • Video
  • Message

When open, each folder contains a number of file extensions. Clicking on one of the file extensions displays only the cache related to that specific extension in the middle pane.

Note! The cache deletion rules become active and the cache files are deleted at the end of the logon session.


Cookie Configuration

When a cookie tries to install on your computer, the Secure4U Cookie Manager checks its configured cookie list to see if the URL/site the cookie was received from is registered or not. Depending on the set policy the Cookie Manager undertakes the action set for this site. In addition, the Secure4U Cookie Manager allows the automatic removal of all cookies at the end of a logon session. In the Cookie Configuration pane, you can choose to save a cookie from a specific or all URLs. Secure4U displays a window when you select the Cookie Configuration component in the configuration tree.

The Cookie Configuration pane is similar to the Cache Configuration pane. You can add URL(s) for which Secure4U is to perform a specific action when a cookie is downloaded from the site. Right-clicking a URL entry in the lower part of the window displays a popup menu with the following commands:

  • Delete
    Removes the URL from the list.

  • Never
    All cookies received from this URL/site are automatically blocked. No cookies from this URL/site are allowed.

  • Always
    All cookies received from this URL/site are automatically saved on your computer.

You can view the action taken by Secure4U in the activity window.

Activating the Delete all Cookies after session box ensures that all cookies are deleted at the end of the logon session.

If the "Do not ask user for cookies" checkbox is selected in the Cookie configuration from the Secure4U Administration tool, the cookies will be automatically accepted (the same feature as e.g. Internet Explorer offers) except these are configured for "never".

Activating the “Apply permanently to this object” box ensures that all cookies are accepted except ones marked with the “never” command.


Cookie Editor

If you are using more than one Web browser, you can select which one you want to display the stored cookies from in the Cookie Editor as well as from which user using this Web browser. The browser and the user are selected from drop-down lists.

The cookies are displayed in four columns in the lower part of the window:

  • Cookie name
  • URL
  • Last Access
  • Cookie value

Selecting and right-clicking a cookie displays a popup menu with the following three commands:

  • Delete selected item(s)
  • Delete all listed items
  • Properties

Delete selected item(s)

Use this to delete the selected item(s) irrevocably.

Delete all listed items

Use this to delete all listed items irrevocably.

Properties

Use this to open a dialog with the properties of the cookie file. The dialog is similar to the one for cached file properties.

Self-learning Mode

The URL resolving mechanism needs the precise address to be able to properly block a cookie from a specific site.

However, many sites on the Internet use different URLs for cookie placement than their actual “home” address. Therefore, as a type of self-learning mode Secure4U presents the alert window when a new site wants to place a Cookie on the computer.

If you select the “Apply permanently to this object”, the cookie is added to the cookie manager list.

If you do not select the “Apply permanently to this object” the settings are only used for the current cookie. We recommend not using the “Apply permanently to this object” when sites save passwords or user-IDs within the cookie.

When Secure4U blocks a cookie placement or the creation of a cookie is granted automatically / by the user, it will inform you in the Secure4U activity window about each of these actions.

All the cookies currently on your computer are displayed in the lower part of the activity window.

Right-click an entry in the list to remove a cookie or display its properties.

Removing Existing Cookies

You can either remove cookies in the Cookie Manager in the Administrator Tool as described above or in the activity window. To remove a cookie from your computer in the activity window, select and right-click the entry and select Remove on the popup menu. The cookie is then physically deleted (irrevocably). For more information, please turn to the chapter about the activity window in this User Manual.

Note! All changes for this configuration component become active immediately.


Typed URLs

Typed URLs is similar to Cache Content and Cookies.

Selecting and right-clicking a typed URL displays a popup menu with two commands:

  • Delete selected item(s)

  • Delete all listed items

Delete selected item(s)

This command deletes the selected typed URL.

Delete all listed items

Use this to delete all listed items irrevocably.

Activating changes/settings

All changes become active immediately.


WWW Content Filtering

Due to the amount of unnecessary and inappropriate information on the Internet, WWW Content Filtering was created to control what is seen and what is not seen via the web.

Web pages that contain certain words, subjects, or ideas can be censored by using this service. For example, if you don’t want someone visiting a website that contains inappropriate words such as “sex” or “games”, you can add those specific words to a list for filtering. When a person attempts to visit a website to download new games or view inappropriate content, they are denied access to that website.

Note! Content filtering is not active if no word(s) for filtering are set.


E-Mail Filtering

E-mail filtering is used for the control and access to unnecessary or dangerous mailing. When using this mode, one can select specific words that may be threatening, such as “confidential”, “private”, “sex” etc. Once selected, e-mail documents containing these words, will be unable to be sent.

On the other hand, E-mail filtering allows emails with confidential information to be sent only to certain addresses that are specified in your “trusted list”. Your trusted email list may include employees within the company itself. That way you can send documents containing vital information internally.

Example: If you want to be able to send emails to people within your company (Joe.Smith@yourcompany.com and Mary.Jones@yourcompany.com), then enter the address after the ‘@’ yourcompany.com. Emails will then be able to be sent to employees within your company.

Note! Only the whole domain name after the ‘@’ can be used.