A service or website is being blocked when Elements Endpoint Protection Connection Control is active

Issue:

After opening a banking website, other services or websites are being blocked when Elements Endpoint Protection Connection Control feature is active. How to allow a site so that is can be accessed when Connection Control is active? How to find out the blocked URL is no "block page" is shown to the user? 

Resolution:

The behavior is expected if a Connection Control has been triggered prior opening the websites. Connection Control is also known as "Banking Protection". It is the feature which activates when a user enters a banking site. When Connection Control is active, the browser only allows the user to visit trusted websites. 

The Connection Control will block access to other URL and in order for users to continue to other websites, the address needs to be added as trusted. A local user can from the Elements Agent local settings add the blocked website as trusted if the user has local admin rights and it has been allowed from the Elements profile.

An Elements portal administrator can add the website as trusted. You can add the website URL address to the allowed sites list in the profile used be the devices by following these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security Configurations section from the menu on the left
3. Go to the Profiles page
4. Click on the profile you want to edit
5. Go to the Browsing Protection settings page
6. Scroll down to the Web site exceptions section and enable it
7. In the Allowed sites section, click Add sites
8. Enter the site address which you want to allow
9. Click Save profile

Once the profile has been saved and published, all devices using the profile will be able to go to the allowed site even if Connection Control is activated.

If the access to a website or service is blocked by Connection Control in a way that no block page is shown to the user telling which URL was blocked, the easiest way to identify the blocked address is to create a test profile with the “Include the blocked URLs in all security events” setting enabled, so that the blocked address is shown on the Events > Security Events page in the Elements portal.

Then assign this profile to one device and reproduce the issue on that device. You can then check the blocked address on the Events > Security Events page in the Elements portal.

Here is how you can clone your current profile and modify it so that the clone has “Include the blocked URLs in all security events” enabled:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the three dots on the right side of your current profile and select Clone
4. Go to the Browsing protection settings page
5. In Common settings, enable Include the blocked URLs in all security events
6. Click Clone profile

Note: Make sure that your current exception rules are retained in the clone.

Now the profile can be assigned to the device on which the issue will be reproduced:

1. Navigate to the Environment > Devices page
2. Select the device (a menu will appear)
3. Click Assign profile and select the cloned profile

Now that the device is using the cloned profile with the include URLs setting enabled, you can reproduce the issue on the test device.

After that, you can check the alerts for that device on the Events > Security Events page in the Elements portal, where the source is Connection Control. Check the address of the blocked page and create an exception rule for it in the Allowed sites list, found on the profile’s Browsing protection page.

Another workaround for the local user is to simply deactivate the Connection Control immediately after it has been activated after going to a bank page. The local user can to this by either closing the banking website first or to end the Connection Control session (green border / frames around the screen with check mark sign at the top of the screen).

Note: The is no setting to stop Connection Control from triggering on a web site that has been marked as a banking page.