Dynamic Application Containment (DAC) allows unknown and potentially unsafe applications to run in a container where DAC rules limit what actions the applications are allowed to perform.
For best practices for DAC rules, see
https://kc.mcafee.com/corporate/index?page=content&id=KB87843.
For example, some best practices for DAC rules are:
- Identify DAC rules that align with uses cases or security concerns in your environment.
- Evaluate the impact of implementing DAC rules using the McAfee Default policy. DAC rules in the McAfee Default policy are set to report only.
- Monitor the logs and reports to determine whether to set rules to block.
- If you determine that an application is safe, take an action to allow it to run normally, such as configuring a DAC exclusion or changing the reputation of the file to a level that allows it to run.
- Review best practices for specific DAC rules, such as the rule “Creating files with the .bat extension”: If batch files are not used to administer the system, set this rule to block and report to prevent malware from creating scripts that scripting engines execute later.
For more resources, visit the ServicePortal and search for related content.
SNS ProTips help you maximize your protection with troubleshooting, best practices, how-to tips, and links to Knowledge Center resources.
