Application Run Control

The easy availability of applications—games, consumer-oriented utilities and third party tools—for mobile devices results in end users installing and running unauthorized personal programs and recreational software on devices meant for business use. In addition to contributing to memory and battery life overhead, this situation also contributes to productivity losses. The installation of unauthorized and unapproved non-business applications contributes to a significantly higher volume of support calls, increasing the IT help desk's support burden. Most critically, it is imperative for security-conscious users to control and restrict the unauthorized installation of personal applications to ensure compliance with strict mobile data protection requirements.

MobiControl's application run control features reduce the risk of leakage of sensitive data and complement the existing network security model by preventing the introduction of malware and viruses into the network through the mobile devices. Additionally, it also allows memory management on the mobile devices to free up resources taken up by unnecessary processes, and allowing for better device performance. MobiControl integrates tightly with the operating system to prevent restricted applications from running entirely on the mobile device, making it much more efficient than competing white list and black list solutions which use CPU and battery-consuming processes to monitor for and destroy restricted applications.

Application Run Control dialog box

For assistance with Override Settings Click Here.

To enable application run control for a device or group of devices, select Application Run Control Policy from the MobiControl Security Center. (Please see the Device Security and Control page.)

Control List Creation Methods

Important:

Whether you are creating a white list or a black list, the use of learning mode is strongly encouraged.

Configuration of application run control begins with the creation of an application control list. An application control list is simply a listing of the names of the executables files that correlate to the application you may wish to allow or disallow on the mobile device. For example, pword.exe corresponds to Microsoft Word for Windows Mobile, and tmail.exe corresponds to Microsoft messaging client for Windows Mobile. The categorization of the application control list, either as a white list or a black list, determines whether the specified programs will be allowed or disallowed.

Application control lists may be specified manually or they can be auto-generated using learning mode.

Learning Mode

Learning mode can only be enabled or disabled on a device that is online. If you right-click on a device group or an offline device, you will receive an error message if you try to enable learning mode.

Learning mode allows you to quickly and easily capture the names of all the executable processes that might be relevant to the everyday use of the device by the end user. Once generated, you may edit the list that was created. One device can be used to capture the applications that are commonly used. A control list can then be applied to a larger set of devices, for instance by applying the control list at a group level.

Select Control List Creation Method dialog box

Enable learning mode by selecting the New button in the Application Run Control dialog box, and then choosing Learning Mode in the Select List Creation Method dialog box.

Once you have enabled learning mode, begin using the device. If you wish to develop a white list, run all the applications that the typical end user will need (i.e. Microsoft Messaging, Microsoft Word, Calendar, Contacts). Go through normal, everyday situations like making and receiving a phone call, soft-resetting the device, etc. Use the device with learning mode enabled for as long as it takes you to ensure that all the applications that your user will need to execute have been launched at some point. (You can run it for an hour, a day, a week,…)

Once you are satisfied that you have fully trained the device's application run control, click the End Learning button.

Application Run Control Learning Mode dialog box

While the device is in learning mode, a red L icon will appear on the device until learning mode has ended.

The list of "learned" applications will be presented to in a dialog box that allows you to edit the list. For example, you may wish to delete an application that was mistakenly executed during the learning. Before saving the control list, you must name it.

Application Run Control Learning Mode list

Now the application run control list has been created, you may assign it to various devices and groups.

If you wish to develop a black list using the Learning Mode, run all the applications that you do not want your user to be able to access (i.e. Solitaire, Bubble Breaker, Internet Explorer, etc.) Once you are satisfied that you have executed all the applications that are to be banned, click End Learning. Since learning mode lists all the processes that were found to be running, it is important that you go through and remove from the blacklist those application that are not to be disallowed.

Manual Mode

Select Control List Creation Method dialog box

Manual list creation is provided for the expert device administrator who already knows exactly which executables are to be put on the white list or black list. This advanced feature is only recommended if you have already used learning mode and are aware of the names of the executables that need to be allowed for correct device operation, and those that you wish to restrict.

You can manually create a new application control list by clicking the New button in the Application Run Control dialog box, and then choosing the Manually Create a New Control List option in the Select Control List Creation Method dialog box.  The New Application Control List dialog pops up, allowing you to specify the application that you want to add to the list, and the platform for which this entry would be valid. This allows you to restrict applications on a device running a specific operating system (e.g. Windows Mobile 5), if you have a mix of devices with different operating systems in the same group.

Once created, the list may be applied to one or more devices or groups.

Creating a black list in manual mode

Important:

Application run control can adversely impact the operation of the mobile device if configured incorrectly. After you have developed a control list, apply it to one or two select devices for extended field testing before expanding it to the general deployment. As a general rule, if you don't know what the executable does (e.g. somestrangename.exe), allow it to run instead of blocking it as it might be  critical for the device's proper operation.

Notes:

• When logged in as Admin on the mobile device, application control enforcement is suspended.
• Certain processes and applications are critical and necessary for stable device operation and normal execution of the MobiControlDevice Agent. These processes are automatically protected through a built-in "permanent white list" and cannot be put on a black list. Applications that are included in a lockdown program menu are automatically on a white list, and cannot be put on a black list.