November 04, 2009, 6:40 AM — Lumension Application Control is a strong whitelisting solution with broad file coverage, excellent reporting, and a complete set of Windows file definitions that can be used to spot potentially troublesome changes to system files. Its one noteworthy shortcoming is the inability to create whitelisting rules based on the digital signatures of application publishers.
Lumension, which is the product of the marriage of PatchLink and SecureWave, is the parent of several security components and modules, including Application Control (covered in this review), device control, data protection, vulnerability assessment, patching, and anti-virus.
[ Read the Test Center review of application whitelisting solutions from Bit9, CoreTrace, Lumension, McAfee, SignaCert, and Microsoft. Compare these application whitelisting solutions by the features. ]
Application Control is essentially the latest incarnation of SecureWave's Sanctuary, an application whitelisting product that has been on the market for more than six years. Application Control can be purchased separately, but it is intended to be a primary part of the Lumension Endpoint Protection solution, which includes Lumension AntiVirus, or the Lumension Endpoint Security Solution Pack, which includes Lumension Device Control. Application Control and Device Control share the same management console.
The server-side management console, called Lumension Endpoint Security Management screen image, serves multiple components, so it's inherently a bit busier than its counterparts in whitelisting-only products. However, Lumension allows customers to use as many management servers as they need, without paying any server licenses -- a key advantage when trying to scale out an enterprise deployment or address performance or management issues.
Lumension, like SignaCert, comes with a complete set of standard file definitions (SFDs) for Windows 2000 to Windows 7 operating systems, prescanned and prehashed. These "gold" definitions are useful for noting deviations from the Microsoft defaults. Like all of the competitors in this roundup, Lumension can scan one or more existing computers to automatically generate whitelist execution rules, using the Scan Explorer feature.