Reply to thread

Message

<blockquote data-quote="ForgottenSeer 98186" data-source="post: 1032440">Linux has a list of LOLBins that is larger than Windows.As long as a user is not downloading and executing code on their system -- either by choice or blocked from doing so by policy, then LOLBin blocking is not necessary except if you fear exploits (e.g. you are running Windows with unpatched software). If they user is downloading stuff and executing it, then to protect the system LOLBins can be blocked to break the kill chain.If you want case-hardened security against the greatest number of potential eventualities of rogue code execution, then there is no other localhost protection that beats SRP global blocking.Blocking LOLBins can create corner case issues, but virtually all of them are manageable. It is based upon SRP with the purpose of configuring a known-clean system, enabling and configuring policies, and then modifying that system carefully only once in a while.If users want to use stuff, then default deny really isn&#039;t for them. If a user never wants to look at a log, then default deny definitely is not for them.It all comes down to what a user wants. Do they want ballistic nuclear armor security or are they a &quot;user that wants to use stuff.&quot;</blockquote>

[QUOTE="ForgottenSeer 98186, post: 1032440"] Linux has a list of LOLBins that is larger than Windows. As long as a user is not downloading and executing code on their system -- either by choice or blocked from doing so by policy, then LOLBin blocking is not necessary except if you fear exploits (e.g. you are running Windows with unpatched software). If they user is downloading stuff and executing it, then to protect the system LOLBins can be blocked to break the kill chain. If you want case-hardened security against the greatest number of potential eventualities of rogue code execution, then there is no other localhost protection that beats SRP global blocking. Blocking LOLBins can create corner case issues, but virtually all of them are manageable. It is based upon SRP with the purpose of configuring a known-clean system, enabling and configuring policies, and then modifying that system carefully only once in a while. If users want to use stuff, then default deny really isn't for them. If a user never wants to look at a log, then default deny definitely is not for them. It all comes down to what a user wants. Do they want ballistic nuclear armor security or are they a "user that wants to use stuff." [/QUOTE]

Verification