Creating a new protection policy

GFI EndPointSecurity ships with a default protection policy so that the software is operational upon installation. You can create further protection policies to suit your company’s device access security policies.

To create a new protection policy:

1. Click Configuration tab > Protection Policies.
2. From Common tasks, click Create new protection policy….

Creating a new policy - General settings

3. Key in a unique name for the new protection policy.
4. Select whether you want to create a blank policy or copy the settings from an existing policy. Click Next.In the settings area select the required settings inheritance option from:

Creating a new policy - Controlled Categories and Ports settings

5. Click Controlled Device Categories.

Controlled Device Categories options

6. From the Controlled Device Categories dialog, select the required device categories you want to control by this new policy. Click OK to close the Controlled device categories dialog and return to the wizard.

7. Click Controlled Connectivity Ports.

Controlled connectivity ports options

8. From the Controlled connectivity ports dialog, select the required connectivity ports that you want to control by this new policy. Click OK to close the Controlled connectivity ports dialog and return to the wizard.
9. Click Next.

Creating a new policy - Global Permissions settings

10. From the Global Permissions dialog, select the required global access permissions from:

• Block any access to the controlled devices - to block access to all selected devices/ports.
• Allow everyone to access the controlled devices - to allow access to all selected devices/ports. If this option is selected, activity monitoring will still be carried out on target computers covered by the protection policy.

11. Click Next.
12. Click File-Type Filter and add the file-types to block/allow by this policy.

13. Click OK to close the File-Type Filter dialog and return to the wizard.
14. Click Encryption and enable/configure the preferred encryption engine.

15. Click OK to close the Encryption dialog and return to the wizard.
16. Click Next.

17. From Storage Devices, select the required options that you want to control from the tabs described below:

Tab	Description
File-Type Filter	GFI EndPointSecurity enables you to specify file-type restrictions on files, such as .DOC or .XLS files, being copied to/from allowed devices. You can apply these restrictions to Active Directory (AD) users and/or user groups.
Content Awareness	GFI EndPointSecurity enables you to specify the file content restrictions for a particular protection policy. The content awareness feature looks into files transiting the endpoints via removable devices and it \identifies content based on pre-configured and custom regular expressions and dictionary files. By default the module looks for secure confidential details such as social security numbers and primary account numbers as well as information related to companies and enterprises such as names of diseases, drugs, dangerous chemicals and also trivial language or ethnic / racist terms. You can configure content checking as a global policy in a similar fashion to the file checking module.
File Options	GFI EndPointSecurity enables you to specify the options required to block or allow files based on size. GFI EndPointSecurity also enables you to ignore large files when checking file type and content and archived files.
Encryption	GFI EndPointSecurity enables you to configure settings that specifically cater for encrypted devices. It also enables you to encrypt devices that are not yet secured.

18. Configure logging and alerting options for this policy and click Next.

19. Review the summary page for information about your policy and click Finish.