Policy Discovery

[Former Member]

Hi everyone,

I was wondering why the Policy Discovery recommends to whitelist a file using its SHA-1 and SHA-256 value.

Using both seems kind of redundant, or am I wrong? 

Regards!

[DEViANCE]

Hi,

They display both but as far as i know it doesn't matter if you include one or both.

Possibly its just an option as most things are moving to prefer sha 256 over sha 1. personal preference? 🙂

Regards,

Dev 

[Kenchee_etf · Accepted solution]

Hello @Former Member 

MACC didn't always support SHA-256 value. Actually that came into play with 8.x versions:

*** McAfee Application Control 8.0.0 Release Notes (McAfee ePolicy Orchestrator)
https://docs.mcafee.com/bundle/application-control-8.0.0-release-notes-epolicy-orchestrator/page/GUID-5D0238AC-F5F7-4F67-AF42-65BE2547E29C.html

New features -> SHA-256 support

"Application Control now supports file SHA-256 values for various workflows (Windows platform) in addition to SHA-1 and MD5. If you perform upgrade from earlier versions, you must fetch the inventory in order to view the SHA-256 values on the McAfee ePO console."

Now considering also that lot of environments are using MACC to protect their old OSs, like XP and 2003, versions of MACC used on those OSs do not have SHA-256 capabilities so that way MACC is ensuring backward compatibility.

Secondly, usage of SHA-256 values may have its performance cost, like described in:

*** Application and Change Control 8.x consumes more resources which can cause performance issues
https://kc.mcafee.com/corporate/index?page=content&id=KB89386

witch for some environments is more important that than enhanced security considering that takes a longer time to compute the file hash, however, some environments are more concerned about security and do not care about possible performance impact.

I hope this answers your question.