V-213323

Discussion

By default, the Trellix Application Control prevents installation of ActiveX controls on endpoints, enforces memory protection techniques on endpoints, and prevents MSI-installers from running on endpoints. The Feature Control allows for those safeguards to be bypassed and in doing so renders the Trellix Application Control less effective.

Check Content

Consult with the ISSO/ISSM to obtain a copy of the organization's documented policy for application whitelisting.

Review the written policy for how the Solidcore client interface is used by the organization.

Verify the written policy identifies whether additional features are enabled or not under "Enforce feature control" of the Trellix Application Control Options ePO policy.

If the written policy does not identify whether additional features are enabled or not under "Enforce feature control" of the Trellix Application Control Options ePO policy, this is a finding.