1.5	Key features

Group-based protection control

In GFI EndPointSecurity you can configure and place computers into groups which are governed by one protection policy. This allows you to configure a single protection policy and apply it to all the computers that are a member of that group.

Granular access control

GFI EndPointSecurity enables you to allow or deny access to a specific device as well as to assign (where applicable) ‘full’ or ‘read only’ privileges over every supported device (e.g., PDAs) on a user by user basis.

Scheduled deployment

When the administrator effects any policy or configuration changes through the GFI EndPointSecurity management console, it is possible to close the management console and allow the agent deployment to take place automatically on a schedule. The deployment is handled by the GFI EndPointSecurity service which will also handle failed deployments through rescheduling.

Access control

Apart from blocking a range of device classes, GFI EndPointSecurity also allows blocking:

•	By file type - For example, allow the user to read *.doc files but block access to all *.exe files.

•	By physical port - All devices connected to a particular physical port including USB, Firewire, Bluetooth, Infrared, WiFi, PCMCIA, Parallel, Serial, S-ATA & SD.

•	By device ID - Set permission for a single device based on the unique device Hardware ID.

NOTE: In Microsoft Windows 7,  a feature called BitLocker To Go can be used to protect and encrypt data on removable devices, GFI EndPointSecurity performs checks on real file types encrypted with BitLocker To GO. For more details, refer to Configure Security Encryption section in this manual.

Device whitelist and blacklist

The administrator can define a list of specific devices which are permanently allowed and others which are permanently banned.

Power users

The administrator can specify users or groups who would always have full access to the devices protected by GFI EndPointSecurity.

Temporary access

The administrator is able to grant temporary access to a device (or group of devices) on a particular computer. This new feature allows the administrator to generate an unlock code that the end-user can use to obtain a time-limited access to a particular device or port, even when the GFI EndPointSecurity agent is not connected to the network.

Status dashboard

A revamped user interface now shows the agents live status, agent deployment status, Database status, GFI EndPointSecurity service status and statistical data with charts.

The main application keeps track of the live agent status by communicating with its deployed agents. Maintenance tasks are performed automatically once an agent goes online.

Active Directory deployment through MSI

From the GFI EndPointSecurity management console it is possible to generate a single MSI file that can be later deployed using the Active Directory deployment tool or other deployment options. The MSI file will contain all the security settings configured in a particular protection policy.

Agent management password

Agent management functions (such as update & un-install) are protected by a user-configurable password. This means that any other GFI EndPointSecurity instances won’t have access to the agent management options.

Device discovery

The GFI EndPointSecurity engine can be used to scan and detect the presence of devices on the network. The information on detected devices can then be used to build security policies and assign access rights for specific devices.

Logs browser

An in-built tool allows the administrator to browse user activity and device usage that is detected by GFI EndPointSecurity and logged in the backend database.

Alerting

Standard notifications can be sent when devices are connected/used, or else when device access is blocked or allowed.

Custom messages

When users are blocked from using devices, they are shown custom popup messages explaining the reasons why the device was blocked.

Database operations

Simple automated maintenance for the database backend such as the option for deleting information older than X days.