1.7.2 Taking measures against a security policy violation

(1) Recognizing a security policy violation through email

You (administrator) can set the configuration in such a way that if a security policy violation is found by the determination result of the security status, you are automatically informed of the violation by email. By specifying this mail notification setting, you can recognize in a timely manner that there is a problem with the security status and take action quickly.

If a security policy violation occurs, an event of the type security control is generated. Set the configuration in such a way that an email is automatically sent when this event is generated. Based on the sent email, check the security status and take necessary measures against a security policy violation.

1. Set mail notification.

Set the event that triggers mail notification and the mail destination in the Event Notifications view, which is displayed by selecting Events in the Settings module and then Event Notifications.

To report a security policy violation by email, set an event with the severity Critical or Warning and of the type Security as a mail notification target.

The following table describes the correspondence between the severity of each event to be reported and the violation level of the security status:

Severity	Violation level
(Critical)	(Critical)
(Warning)	(Important)
	(Warning)
(Information)	(Safe)

2. Check the sent email.

You can check the occurrence conditions of a security-related event in the email sent from JP1/IT Desktop Management 2. If a critical event has occurred, start the operation view of JP1/IT Desktop Management 2 from the URL written in the email, check the security status, and then take necessary measures.

The following figure shows the content of an email to be sent:

3. Check the security status.

In the operation view of JP1/IT Desktop Management 2, you can obtain detailed information such as the details of a security policy violation and the location in which the security policy violation occurred. In the Home module or Security module, check the status of the computer judged as Critical and take action.

For mail notification, you need to specify the mail server to be used to send and receive emails.

Related Topics:

• (2) Automatically taking measures against a security policy violation

• (3) Manually taking measures against a security policy violation

• 15.7.1 Specifying settings for event notification

• 9.1 Checking the security status

• 15.8.1 Setting up mail servers

To Page Top

(2) Automatically taking measures against a security policy violation

If you enable automatic enforcement, when some security configuration item of a computer is in violation of a security policy, that security configuration item is automatically changed to its expected status.

If you set automatic enforcement to a security policy, the security configuration items of computers are automatically changed to their expected status at the time when a security policy is applied to computers. Automatic enforcement can save the administrator of JP1/IT Desktop Management 2 and computer users the effort of taking necessary measures. According to the security principles and operation in your organization, examine the security configuration items for which automatic enforcement is enabled in a security policy.

Tip

For example, in an environment where Windows Firewall is disabled intentionally, if automatic enforcement enables Windows Firewall, a problem might occur with operation. In such a case, set a security policy not to apply automatic enforcement to the specified security configuration items.

You can see if necessary measures are taken against a security policy violation by confirming that Safe () is displayed for the relevant item in the Security module.

Related Topics:

• 9.1 Checking the security status

• (3) Manually taking measures against a security policy violation

To Page Top

(3) Manually taking measures against a security policy violation

If you select manual enforcement, when you check the security status and find some security configuration item of a computer is in violation of a security policy, manually take measures against that violation.

Forcibly take measures.

For the security configuration items for which you can enable automatic enforcement, if some security configuration item is in violation of a security policy, you can forcibly take measures against that violation in an arbitrary timing.

Request the user to take measures.

You can set the configuration to automatically send an arbitrary message including details of a security policy violation to the user of the computer that is in violation of a security policy. Using this function with automatic enforcement, you can request the user to take measures in the security configuration items (such as password strength and power on password) to which automatic enforcement is not (cannot be) applied. To enable automatic message notification, specify the settings in Action Items in the Add Security Policy dialog box or the Edit Security Policy dialog box.

You can also set the configuration to send a message to a computer user in an arbitrary timing.

You can see if necessary measures are taken against a security policy violation by confirming that Safe () is displayed for the relevant item in the Security module.

Related Topics:

• (2) Automatically taking measures against a security policy violation

• 9.1 Checking the security status

• 9.4 Enforcing the correction of security policy violations

• 6.26 Sending a notification to a user

To Page Top

(4) Taking measures against a security policy violation by a computer managed offline

The following automatic enforcement items do not work for computers managed offline:

• Auto Enforce for Install Updates

• Auto Enforce for prohibited software (uninstallation)

• Auto Enforce for mandatory software

For that reason, if you (administrator) check the security status and find that some security configuration item that automatic enforcement does not work for is in violation of the security policy, you must directly instruct the user of the computer to take necessary measures.

After the user has taken necessary measures, obtain the device information of the computers managed offline again to check the security status.

You can see if necessary measures are taken against a security policy violation by confirming that Safe () is displayed for the relevant item in the Security module.

To Page Top