Reply to thread

Message

<blockquote data-quote="SpyNetGirl" data-source="post: 1029874" data-attributes="member: 98858">I see there are talks about ISG (Intelligent Security Graph) and Smart App Control:One of the differences between using ISG in a WDAC policy vs using Smart App Control (which also use ISG) is that WDAC policy + ISG rule option passes along reputation from app installers to the binaries they write to disk, it can over-authorize files in some cases. For example, if the installer launches the app upon completion, any files the app writes during that first run will also be allowed.Smart App Control however doesn&#039;t do this, it will trust the installer file itself if it&#039;s trustworthy and subsequently checks the trustworthiness of any binaries the installer tries to use and write to the disk, if any of those binaries or components can&#039;t be verified or are malicious, they get blocked.Explained more in here:<ul>
<li data-xf-list-type="ul"><a href="https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph#security-considerations-with-the-isg-option" target="_blank">Security considerations with the ISG option</a></li>
<li data-xf-list-type="ul"><a href="https://support.microsoft.com/en-us/topic/smart-app-control-has-blocked-part-of-this-app-0729fff1-48bf-4b25-aa97-632fe55ccca2" target="_blank">Smart app control has blocked part of this app</a></li>
</ul>[URL unfurl=&quot;true&quot;]https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Lightly-Managed-Devices#security-considerations[/URL]</blockquote>

[QUOTE="SpyNetGirl, post: 1029874, member: 98858"] I see there are talks about ISG (Intelligent Security Graph) and Smart App Control: One of the differences between using [B]ISG in a WDAC policy[/B] vs using [B]Smart App Control[/B] (which also use ISG) is that WDAC policy + ISG rule option passes along reputation from app installers to the binaries they write to disk, it can over-authorize files in some cases. For example, if the installer launches the app upon completion, any files the app writes during that first run will also be allowed. Smart App Control however doesn't do this, it will trust the installer file itself if it's trustworthy and subsequently checks the trustworthiness of any binaries the installer tries to use and write to the disk, if any of those binaries or components can't be verified or are malicious, they get blocked. Explained more in here: [LIST] [*][URL='https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph#security-considerations-with-the-isg-option']Security considerations with the ISG option[/URL] [*][URL='https://support.microsoft.com/en-us/topic/smart-app-control-has-blocked-part-of-this-app-0729fff1-48bf-4b25-aa97-632fe55ccca2']Smart app control has blocked part of this app[/URL] [/LIST] [URL unfurl="true"]https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Lightly-Managed-Devices#security-considerations[/URL] [/QUOTE]

Verification