cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 3

Policy Discovery

Jump to solution

Hi everyone,

I was wondering why the Policy Discovery recommends to whitelist a file using its SHA-1 and SHA-256 value.

Using both seems kind of redundant, or am I wrong? 

Regards!

1 Solution

Accepted Solutions
Kenchee_etf
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Policy Discovery

Jump to solution

Hello @Former Member 

MACC didn't always support SHA-256 value. Actually that came into play with 8.x versions:

*** McAfee Application Control 8.0.0 Release Notes (McAfee ePolicy Orchestrator)
https://docs.mcafee.com/bundle/application-control-8.0.0-release-notes-epolicy-orchestrator/page/GUID-5D0238AC-F5F7-4F67-AF42-65BE2547E29C.html

New features -> SHA-256 support

"Application Control now supports file SHA-256 values for various workflows (Windows platform) in addition to SHA-1 and MD5. If you perform upgrade from earlier versions, you must fetch the inventory in order to view the SHA-256 values on the McAfee ePO console."

Now considering also that lot of environments are using MACC to protect their old OSs, like XP and 2003, versions of MACC used on those OSs do not have SHA-256 capabilities so that way MACC is ensuring backward compatibility.

Secondly, usage of SHA-256 values may have its performance cost, like described in:

*** Application and Change Control 8.x consumes more resources which can cause performance issues
https://kc.mcafee.com/corporate/index?page=content&id=KB89386

witch for some environments is more important that than enhanced security considering that takes a longer time to compute the file hash, however, some environments are more concerned about security and do not care about possible performance impact.

I hope this answers your question.


Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

2 Replies
DEViANCE
Level 8
Report Inappropriate Content
Message 2 of 3

Re: Policy Discovery

Jump to solution

Hi,

They display both but as far as i know it doesn't matter if you include one or both.

Possibly its just an option as most things are moving to prefer sha 256 over sha 1. personal preference? 🙂

 

Regards,

Dev 

Kenchee_etf
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Policy Discovery

Jump to solution

Hello @Former Member 

MACC didn't always support SHA-256 value. Actually that came into play with 8.x versions:

*** McAfee Application Control 8.0.0 Release Notes (McAfee ePolicy Orchestrator)
https://docs.mcafee.com/bundle/application-control-8.0.0-release-notes-epolicy-orchestrator/page/GUID-5D0238AC-F5F7-4F67-AF42-65BE2547E29C.html

New features -> SHA-256 support

"Application Control now supports file SHA-256 values for various workflows (Windows platform) in addition to SHA-1 and MD5. If you perform upgrade from earlier versions, you must fetch the inventory in order to view the SHA-256 values on the McAfee ePO console."

Now considering also that lot of environments are using MACC to protect their old OSs, like XP and 2003, versions of MACC used on those OSs do not have SHA-256 capabilities so that way MACC is ensuring backward compatibility.

Secondly, usage of SHA-256 values may have its performance cost, like described in:

*** Application and Change Control 8.x consumes more resources which can cause performance issues
https://kc.mcafee.com/corporate/index?page=content&id=KB89386

witch for some environments is more important that than enhanced security considering that takes a longer time to compute the file hash, however, some environments are more concerned about security and do not care about possible performance impact.

I hope this answers your question.


Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community