Manage Endpoints Using SecureConnector

SecureConnector can be implemented on the endpoint as a dissolvable executable, a permanent application, or a service.

• A dissolvable executable runs once on installation and does not run again after the user logs out or the machine is rebooted.
• When installed as a permanent application, SecureConnector runs every time the user logs in, and in some cases as soon as the machine boots.
• When installed as a permanent service, SecureConnector runs when the machine boots.

The Start SecureConnector action installs SecureConnector on endpoints detected by a Forescout policy. Endpoints are redirected to the HTML page, where end users can download the appropriate installer package.

You can specify interaction and installation settings including:

• The text displayed to prompt end users to install the package
• Whether SecureConnector is deployed as a permanent service/system daemon, or as a dissolvable executable
• Whether the SecureConnector icon is visible in the task bar

  When the Start SecureConnector action is applied to Linux endpoints, configure the following action options as follows:

  Install Method

  Only the HTTP installation at the endpoint installation method is supported.

  Deployment Type

  Only the Install Dissolvable and Install Permanent as Service options are supported for Linux endpoints.

  Refer to the section about the Start SecureConnector / Stop SecureConnector actions in the Administration Guide for more details.

The Stop SecureConnector action stops the SecureConnector executable and removes all files related to SecureConnector from the endpoint. Refer to the section about the Start SecureConnector / Stop SecureConnector actions in in the Administration Guide for more details.

By default, end users can stop SecureConnector on their devices as follows:

• End users can select the SecureConnector toolbar icon, and then select Exit.
  • When SecureConnector is installed as a service/daemon, this stops SecureConnector for the current session. The daemon runs at the next session.
  • When SecureConnector runs as a dissolvable executable, this stops and removes SecureConnector.
• End users can use the following command to uninstall SecureConnector from their device:

  bash /usr/lib/forescout/Uninstall.sh

  When you configure the plugin, you can enable password protection for SecureConnector on endpoints. When password protection is enabled, users who try to stop or uninstall SecureConnector are prompted for a password.

Additional Sites are Forescout devices that SecureConnector connects to when it cannot connect to the managing Appliance of the endpoint. Use the Additional Sites table in the SecureConnector tab to define a list of alternative Appliances. SecureConnector first tries to connect to the Enterprise Manager that manages its managing Appliance, and then steps through this list of Forescout devices.

Typically Forescout endpoint detection capabilities are combined with endpoint authentication and compliance policies to enforce network access control: Upon connection, network access of endpoints is restricted (typically to the DHCP and DNS servers and to the for detection and remediation interactions) until the user/endpoint is authenticated and compliance is proven. Only then is the necessary network access granted. However, authenticating endpoints and verifying compliance can cause a delay during which even legitimate endpoints have only restricted access. If complex compliance policies are in place, this delay in network access may be noticeable, resulting in an unsatisfactory user experience for corporate users.

Certificate-based rapid authentication provides a strong, secure and extremely fast endpoint authentication mechanism. It uses your corporate PKI (Public Key Infrastructure) to provide immediate, authenticated network access for corporate users and other known endpoints.

The following describes a typical scenario when endpoints connect to the network:

• Corporate endpoints and other trusted endpoints managed by SecureConnector immediately initiate certificate-based authentication as part of SecureConnector’s TLS interaction with the . Endpoints are granted immediate network access based on a signed X.509 digital certificate. The continues the compliance checks defined in active policies, and may revoke or change endpoint access if these checks fail.
• A corporate policy may grant limited network access to endpoints without a valid rapid authentication certificate, or with an expired or revoked certificate, or endpoints not managed by SecureConnector, until normal, policy-driven compliance checks are run.

For more information about implementing certificate-based rapid authentication in your environment, refer to the About the SecureConnector Advanced Features How-to Guide.