Mitigation Strategy 1: Control use of application (application control)

Application allow listing is a security measure that involves approving and trusting specific programs to prevent the execution of unauthorised or malicious programs, including file types such as .exe, DLL, scripts (e.g., Windows Script Host, PowerShell, HTA), and installers.

Forcepoint ONE addresses the challenges posed by the increasing adoption of cloud and SaaS applications, especially as organisations wrestle with the complexity of Bring Your Own Device (BYOD) trends. This platform offers users streamlined access to necessary apps while safeguarding the network and data, ensuring consistent threat protection and Data Loss Prevention (DLP) across both cloud and private applications. With the ability to protect sensitive data on managed and unmanaged devices through agentless or agent-based security, Forcepoint ONE intelligently enforces security measures without compromising the user experience. It provides:

• Visibility and control over hybrid workers' interactions with data;
• Prevents misuse of sensitive information;
• Controls access to high-risk web content; and
• Facilitates secure remote access to business resources and private apps without the intricacies of Virtual Private Networks (VPNs).
  

Forcepoint Next Generation Firewall (NGFW)



Forcepoint NGFW is enhanced by Forcepoint Endpoint Context, which gathers essential endpoint metadata, including user, application, and network details, and transmits it to the NGFW. This integration empowers administrators with precise control over user and application access to data, enabling the creation of sophisticated, human-centric access policies. The NGFW, through features like Application Control, can restrict network access to specific applications based on trusted signing authorities, exemplified by blocking browsers such as portable Google Chrome and Firefox while permitting only Microsoft Internet Explorer. Additionally, Endpoint Application control policies can prevent applications like Putty.exe from establishing connections.

Mitigation Strategy 2: Manage application vulnerability (patch application)

Ensure the security of computer systems by promptly patching applications like Flash, web browsers, Microsoft Office, Java, and PDF viewers, particularly addressing 'extreme risk' vulnerabilities within 48 hours and utilising the latest versions of these applications.

Forcepoint Next Generation Firewall (NGFW)

The Intrusion Prevention System (IPS) feature of Forcepoint Next Generation Firewall (NGFW) offers strong defense against application vulnerabilities, employing advanced technologies like Deep Packet Inspection to guard against exploits. This aspect of NGFW serves as a mitigation strategy for unpatched vulnerabilities, offering protection during the period between patch availability and actual deployment.

Forcepoint Remote Browser Isolation (RBI)

Web browsers are specific target for compromise, with organisations often managing multiple browser platforms and versions, both sanctioned and unsanctioned. The Information Security Manual (ISM) emphasises the urgent need to patch extreme-risk drivers and applications within 48 hours. For example, the rollout of Chrome Stable version 87.0.4280.141 included 16 security fixes, 15 of which were high-severity, prompting warnings from the US Cyber and Infrastructure Security Agency (CISA).

The challenge of promptly patching browser applications within 48 hours is compounded by their widespread installation on numerous endpoints, frequently beyond the organisation's network. The introduction of BYOD devices further complicates security efforts, broadening the attack surface

Forcepoint RBI addresses these challenges by providing real-time protection against web browser compromise, eliminating direct user interaction with websites and web applications to mitigate security vulnerabilities. This approach safeguards against risks associated with compromised browsers, restricts users' data-sharing activities, such as rendering embedded email URLs in read-only mode to prevent data loss and credential theft from phishing attacks. Additionally, web applications accessed through RBI ensure sensitive corporate data is not stored in the browser caches of endpoints.

Mitigation Strategy 3: Removing or disabling active content from Microsoft documents and PDF (configure Microsoft Office macro settings)

Adjust Microsoft Office macro settings to enhance security by blocking macros from the internet. Instead, permit only approved macros either in designated 'trusted locations' with restricted write access or those digitally signed with a trusted certificate. This configuration helps mitigate the risk of malicious macros compromising the integrity of Office applications and ensures that only verified and secure macros are allowed to execute.

Forcepoint Zero Trust Content Disarm and Reconstruction (CDR)

Attackers have been repeatedly exploiting vulnerabilities in widely used software like Microsoft Office, Microsoft Windows, and Adobe PDF to access data and execute malicious programs, including executable files, DLLs, and scripts. Conventional detection-based defenses struggle to keep pace with these evolving threats. In contrast, Forcepoint's Zero Trust Content Disarm and Reconstruction (CDR) takes a unique approach. Instead of relying on malware detection, it operates on the premise that nothing can be inherently trusted. This method involves extracting valid business information from files, either discarding or storing the originals, verifying the extracted information's structure, and then creating new, fully functional files to securely transmit the information. Zero Trust CDR proves to be a game-changer in mitigating even the most advanced zero-day attacks and exploits. By exclusively extracting and delivering the positive aspects of a file without attempting to detect the negative elements, Forcepoint Zero Trust CDR prevents file-based malware from infiltrating organizations, offering protection against zero-day and completely unknown threats. Notably, this malware prevention approach eliminates the need for constant updates with the latest malware signatures, ensuring the defense is consistently up-to-date.

Mitigation Strategy 4: User application hardening for attack surface reduction

Enhance cybersecurity by configuring web browsers to block Flash, preferably uninstalling it, along with ads and Java when accessing the internet. Additionally, disable unnecessary features in Microsoft Office (such as OLE), web browsers, and PDF viewers. This proactive approach mitigates potential vulnerabilities associated with these elements, enhancing the overall security posture of the digital environment.

Forcepoint Next Generation Firewall (NGFW)



Forcepoint Endpoint Context gathers essential endpoint metadata, including user, application, and network information, transmitting it to NGFW for comprehensive security measures. The Forcepoint endpoint security solution provides administrators with precise control over user and application access to data, enabling the implementation of intelligent and human-centric access policies. Endpoint Applications can be restricted from accessing the network based on trusted signing authorities, exemplified by NGFW's Application Control feature blocking browsers like portable Google Chrome and Firefox, allowing only Microsoft Internet Explorer internet access. For instance, the Endpoint Application control policy can also prevent Putty.exe from establishing connections.

Mitigation Strategy 5: Control privileged access (restrict administrative privileges)

Forcepoint ONE

The Forcepoint ONE Security Service Edge (SSE) Platform is a comprehensive cloud-based solution providing SaaS protection to ensure the safety of users and data across the entire enterprise. It consolidates various cloud security services, including Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Zero Trust Network Access (ZTNA), eliminating the need for fragmented solutions and simplifying security for hybrid workplaces. This all-in-one platform also incorporates advanced features like Remote Browser Isolation (RBI), Content Disarm & Reconstruction (CDR), and Data Loss Prevention (DLP).

Forcepoint ONE has the capability to implement user-based policies for any application across all devices, including BYOD scenarios. This functionality proves effective in managing access to both internal and external business applications, offering heightened visibility into data movements, as well as user and device activities. The data management pane in Forcepoint ONE can impose restrictions based on various parameters such as user, device, and location. For example, it can prevent a Domain Admin located outside approved locations from accessing critical applications, ensuring a secure and controlled data environment.

Mitigation Strategy 6: Manage Operating Software (OS) vulnerability (patch operating systems)

To enhance cybersecurity measures, it is important to promptly patch or mitigate computers, including network devices, harbouring 'extreme risk' vulnerabilities within a strict 48-hour time-frame. Utilising the latest operating system version is crucial for optimal security, as unsupported versions should be avoided to mitigate potential vulnerabilities. This proactive approach ensures that systems are fortified against emerging threats and vulnerabilities, minimising the risk of exploitation and enhancing overall cybersecurity resilience.

Forcepoint Next Generation Firewall (NGFW)



Forcepoint NGFW incorporates a robust Intrusion Prevention System (IPS) capability designed to offer substantial protection against application vulnerabilities. This is achieved through the implementation of advanced technologies like Deep Packet Inspection, which plays a crucial role in safeguarding against potential exploits. The NGFW's IPS feature not only serves as a proactive defense against known vulnerabilities but also functions as a mitigation strategy in cases where vulnerabilities remain unpatched. Specifically, it provides protection during the critical period between the identification of a vulnerability and the subsequent deployment of the necessary patch, ensuring a secure environment even in the interim.