Is it possible to prevent executables or portable apps from being downloaded in a corporate environment on the network layer? (i.e not some agent on a host preventing it) Would this require MITM SSL certificates being installed to dissect to the traffic? I can imagine that there are solutions with deep packet inspection to prevent them from being downloaded if sent in cleartext (over HTTP or FTP for example).

In short, what is good practice to prevent users from downloading executables? I know that for installing/running them one can whitelist applications, that is not the question.

3 Answers 3


Depends in the scope of the proyect and the ammount of data thats managed for the network. This could have different approaches:

Web Security Appliance

You can deploy a WSA (Web Security Appliance) there you can modify the configuration to block certain types of files to be downloaded.


You could use a proxy were you can define the type of traffic allow to enter your network

Active Directory Policy

You can Set "Allow file download" policy to "Disabled" in the OU that affect your users. Sadly this is inefective if there is already other browsers installed in the host.


You could configure your ISA server to block downloading all together.


The network layer is not aware of the higher level data that its packets are forming. Its just packets and rules to handle them. You have to analyze the payload of the packets if you want to know what is transmitted in the bigger picture. What you wrote is therefore correct. Deep packet inspection would be the only way. And in case of encrypted data you have to somehow decrypt it.

It is also necessary to keep in mind that deep packet inspection is not allowed in some legal environments already, as well as methods to decrypt the traffic.


From what we understand, your intention is to prevent the downloading of specific file types (e.g. executables) on the network layer such that your users are protected against malicious file types.

This can be done by installing a network proxy in your corporate environment. The proxy stands between your users on the internal network and the Internet. Every user will be authenticating / connecting to the network proxy for external communication. Settings on the network proxy can block certain file types such that the proxy will deny users download of executables by inspecting a URL. For example, a forbidden URL might be '.exe' or '.zip'.

The web filter on the proxy server can thus be used to restrict clients from accessing specific file types or URLs on the web.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .