Summary

The Application Behavior Investigation feature in the CSA 4.5 release is by itself a compelling reason to implement the architecture. Many applications within every network are either unknown or untrusted in origin. The Application Behavior Investigation feature of CSA enables you to better understand the application in great detail and either permit or deny specific interaction observed. It is also common to attempt to control known deployed standard applications. Current applications are not always as easy to control as once thought, and a full investigation of system interaction can provide the results requested. Whereas one portion of the security administrator's job is to allow and prevent actions based on policy, it is also very important to understand and control application use or misuse in an effort to protect valuable proprietary intellectual data. The Application Behavior Investigation feature provides just that mechanism.