1.6.3 General procedure for automatically controlling network access of devices in violation of a security policy

(1) Specifying network control settings in a security policy

To automatically disable network access for computers that lack security protection, specify the network control settings in a security policy. In the network control settings, you can specify whether to allow or deny network access for computers according to the violation level determined for each computer. You can also specify a condition for disabling network access for computers, such as a time limit (in days) to correct the violation.

For example, by using the automatic message notification function, you can have a message sent to a user after a routine security check to prompt the user to implement security protection measures on the user's computer. If the user continues to ignore this message, you can disable network access for the user's computer. You can perform this operation by specifying a security policy as follows:

• Specify the security configuration items.

  Specify mandatory security requirements. Network access is disabled for any computers in violation of these requirements. In addition, for each requirement, set violation levels that determine judgment results.

• Specify a message to be sent to users.

  Set the violation level that triggers message notification and specify the text of a message.

  Tip

  Write a message stating that network access is disabled if the problem persists.

• Specify the network connection control settings.

  Set a violation level that causes network access to be disabled for a computer. If you want to disable network access for computers only when the violation persists for several days in a row, set a time limit (in days) in Disconnect Condition. You do not have to specify Disconnect Condition if you want to immediately disable network access for computers determined to be lacking security protection.

  When security protection measures have been implemented on a computer that was previously in violation of a security policy and the computer is determined to be Safe, network access is automatically enabled for the computer.

  Important note

  If you have manually disabled network access for a computer, network access is not automatically enabled for that computer even when the computer is determined to be Safe after implementation of proper security protection measures. If you want to automatically enable network access for a computer when the computer is no longer in violation of a security policy, do not manually disable network access for the computer.

After you specify a security policy, you can control network access of computers according to the security status determined for the computers.

Tip

For security protection, even when network access is disabled for a computer, you can allow that computer to access certain servers by settings.

Related Topics:

• 1.7.1 Setting a security policy

To Page Top

(2) Identifying the devices for which network access has been disabled

By specifying the message notification setting in a security policy, you can automatically send a message to a computer in violation of a security policy and prompt the user to implement security protection measures on the user's computer. In addition, by specifying the network control settings in a security policy, you can automatically disable network access for a computer in violation of the security policy.

When a computer is in violation of a security policy, a message is sent to the user of that computer after a routine security check. If the user continues to ignore this message and takes no measures to implement security protection on the computer, network access is automatically disabled for the computer according to the network control settings.

If a user finds out that network access has been disabled for the user's computer and contacts you (administrator) for assistance, you need to instruct the user to implement security protection measures on the user's computer. By identifying the status of the user's computer, you can give clearer instructions on what the user has to do to implement proper security protection measures on the user's computer.

To identify the computers for which network access has been disabled, display the devices whose Connection Status is in the Computer Security Status view of the Security module. By using the filtering function, you can quickly find the computer you are looking for. By identifying the status of the device for which network access has been disabled, you can understand the security flaws of the device.

Tip

You (administrator) can also have email notification sent out to you to inform you that network access has been disabled for a device. To enable email notification, in the Event Notifications view of the Settings module, select the Warning and Security check boxes. When you select these check boxes, email notification is sent out not only when network access is disabled for a device but also when other warning events occur.

After identifying what the problem is, ask the user to take appropriate measures.

Related Topics:

• (1) Recognizing a security policy violation through email

To Page Top

(3) Implementing security protection measures on a device in violation of a security policy

After appropriate measures are taken to correct the security flaws found in a device for which network access has been disabled due to violation of a security policy, network access is automatically enabled for the device.

When, according to a request made by an administrator or based on the content of a message, a user corrects all the problems that have led the violation of the security policy, the violation level of the computer becomes Safe. When the computer is determined as Safe, network access is automatically enabled for the computer.

Related Topics:

• 9. Managing the Security Status

• 1.7.2 Taking measures against a security policy violation

To Page Top